Every playbook is based on an entity: Alert, file, host, user or socket. According to the entity you select, you can later include its parameters in the investigation. Alert parameters are listed here.For optimal results, enable File Monitoring.If you manage several sites, you can use Import/Export Playbook to share a playbook between sites. you can also use this functionality to save a playbook while you're creating it.Playbook Operation ModeFor all active playbooks, you must select an operation mode. The operation mode determines if remediation actions within the Playbook run automatically or require manual approval. If you select Manual, the action remains pending until you approve it via the Incident View (marked in grey): To enable Manual operation mode, you must clear the Remediation check box in the Group settings page:For a detailed example of creating a playbook, click here.To create a playbook:In the left navigation pane, click.In the top-right corner, click New playbook.The Playbook canvas opens.Select the entity type on which to base the playbook investigation: Alert, file, host, user or socket.The Modules menu opens on the left. See Playbook Modules for details about the different modules. Drag and drop modules onto the editor in the right order to reflect the required investigation flow. Every module includes different input fields, which you can populate with static content or dynamic parameters. Dynamic parameters are populated with the correct value during runtime. These can include parameters  from all the previous steps. Click .Enter a name for the playbook and click Save.The playbook appears under Playbooks. To set the playbook to run automatically when a specific alert is triggered, use the Automatic Trigger toggle, then select the alert type that will initiate the playbook.Playbook ResultsEvery alert that triggered a playbook is linked to the playbook run, accessible from the Incident View. You can also access playbook results from the Executed Playbooks tab, where all runs are logged with a completion status.