Enable playbooks for analyst selection
-
- UpdatedJan 30, 2025
- 1 minute read
- Yokohama
- Security Incident Response setup
Add new playbooks to the playbook selection list.
You can select an appropriate playbook to investigate security incidents in the Security Analyst Workspace (Manage security threats using the Security Analyst Workspace). The playbook selection option supports only the playbooks which are designed using Flow Designer.

After you have created a playbook using Flow Designer, follow these steps to include it in the Selected Playbook choice list:
- Navigate to sys_hub_flow table.
- Search for the new playbook you have created using Flow Designer.
- Add the sir_playbook tag to the playbooks that you want to include in the Selected Playbook choice list.
Note: If you have old playbooks that have not been migrated from workflows to Flow Designer, they
will not appear in the list. But, if a playbook created using workflows is assigned to a security
incident either by a trigger condition or by manual selection (using Run
Orchestration option in the classic environment), this playbook is launched when you open the
security incident in the Security Analyst Workspace.