Security Center:Playbook configuration guide

Playbook type

Security Center provides two types of playbooks:

• Predefined Playbook: Security Center provides built-in playbooks based on common security threat scenarios and solutions. You can use these playbooks directly without configuration. You can also copy a predefined playbook and save it as a custom playbook. Then, you can modify the custom playbook as needed. This reduces the complexity of configuring custom playbooks.

• Custom Playbook: For complex and highly personalized security threat scenarios, Security Center provides flexible custom playbooks. You can use the flow editor to freely configure various components and easily implement automated security response solutions.

Playbook parameters (input and output parameters)

• Input parameters define the conditions that trigger the playbook. When you select different conditions, the parameter examples for debugging change accordingly.

• Output parameters define the fields that are output after the playbook is executed. Subsequent nodes can use these fields. You can also use the setOutput action to make these fields available for reference by other playbooks. The syntax is `${event.parameter_path}`.

  Note

  In addition to custom output parameters, the system provides default system parameters. For more information, see System parameters in playbooks.

Step 1: Create basic information for a playbook

1. Log on to the Security Center console.

2. In the navigation pane on the left, choose Agentic SOC > SOAR. In the upper-left corner of the console, select the region where the assets that you want to protect are located: Chinese Mainland or Outside Chinese Mainland.

3. On the Custom Playbook tab, click Create Playbook.

4. In the Create Playbook panel, enter a Playbook Name and Playbook Description, and click OK.

Step 2: Configure the playbook flow

1. After you create the basic information for the playbook in Step 1, you are automatically redirected to the playbook flow configuration page. You can also click Edit in the Actions column on the custom playbook list page to go to the configuration page.

2. Configure playbook input and output parameters

   1. On the Playbook Editing page, click Settings in the upper-right corner. In the configuration panel, click Input & Output Settings.

      Note

      Each flow must have start and end nodes. Each flow can have only one start node but can have multiple end nodes.

      

   2. In the Input & Output Settings panel, configure the input and output parameters of the playbook. For more information, see Playbook parameters (input and output parameters).

3. Orchestrate the response flow

   This is the core of the playbook. You need to drag components that represent different operations onto the canvas and connect them. This topic uses the DataFormat component as an example. For information about how to configure parameters of other components, see Flow component description.

   Important

   • The start node uses event as the node name. Therefore, do not set the name of a component to event during playbook orchestration.

   • You can select multiple flow components as needed and establish contextual relationships between them.

   1. Select a component action

      In the Basic components section on the left, select the DataFormat component. Select an appropriate action, such as joindata or convertToJSON, and drag it to the canvas.

   2. Configure component parameters

      In the canvas area, click the selected DataFormat component, or on the Basic Information configuration page, in the Action Configuration module, click to open the parameter settings page. For more information, see DataFormat component.

      • You can enter constants, variable parameters, system parameters, and expressions. For more information, see Component parameters and node execution flow.

      • You can also manually enter parameter settings. In the input box, you can select a node parameter from the drop-down list to generate the corresponding syntax. The following figure shows an example.

        

4. After you complete the component configuration, click Save in the menu bar in the upper-left corner.

   Warning

   If you exit without saving, the edited flow information is lost.

Step 3: Debug the flow

After you set up the playbook, you need to debug it to verify that the flow is correct and runs smoothly.

1. Set a breakpoint (Optional):

   • Description: To verify a specific part of a complex flow, you can set a breakpoint on a component. During debugging, the flow executes up to the node before the breakpoint and then pauses. This lets you check intermediate results.

     Important

     • If the flow has multiple branches, the system debugs only the branch where the breakpoint is set.

     • If multiple breakpoints are set on the same branch, only the last breakpoint takes effect.

   • Procedure: Click the icon on a flow node to set it as a breakpoint.

     

2. Run the debug

   1. Click the debug button in the upper-left corner to open the Debug Parameters panel, and then click the Debug button.

      Note

      The debugging parameter settings vary depending on the type of input parameters configured for the playbook.

   2. Load parameter examples:

      1. Click Example.

      2. On the View Sample Input page, click Load Sample.

   3. Modify parameters: Modify the parameters as needed, and then click OK.

      Note

      The system provides a more intuitive Visual Mode to help you modify parameters.

3. View the debugging result

   Click the icon on a node or Run Logs in the debugging area to view the detailed input and output data and execution status of the node. The following table describes some of the output parameters.

   Parameter name	Description
   datalist	The preview data of the result. Important A maximum of three preview data entries are displayed. To view the full data, go to the Complete Output Result tab.
   total_data_successful	The volume of data that is successfully processed during execution.
   total_data	The total volume of data processed during execution.
   total_exe_successful	The number of times that the current action is successfully run.
   total_exe	The total number of times that the current action is run.
   total_data_with_dup	The volume of data after deduplication after successful processing during execution.

   

Step 4: Save and publish

After the debugging is successful, click the Publish button in the menu bar in the upper-left corner to convert the playbook to a published version.

Roll back a playbook

If you want to restore a published playbook to a previous version, you can perform a rollback operation. The following steps describe how to do this:

1. On the Custom Playbook tab, find the playbook that you want to roll back. Click Details in the Actions column. On the details page, go to the Basic Information tab and view the historical versions of the playbook in the publish history section.

2. Run a test (optional): Select the version to which you want to roll back and click View in the Actions column to go to the playbook tab. In the Input Parameters (Run) area, complete the test run of the rollback version.

3. Select the version to which you want to roll back and click Roll Back to Edit or Roll Back and Publish in the Actions column.

   • Roll Back and Publish: Overwrites the draft version on the editing page with the selected version and publishes it.

   • Roll Back to Edit: Overwrites the draft version on the editing page with the selected version.

Import a playbook

1. In the menu bar of the flow editor, click More and then click Import JSON from the drop-down list.

2. On the import page, upload the JSON file that you want to import and click OK.

View playbook execution records

In the playbook list, click the playbook ID or Details in the Actions column to go to the playbook details page. You can view basic execution records on the Historical Execution Records tab.

Modify the playbook name

In the playbook list, click the playbook ID or Details in the Actions column to go to the playbook details page. On the Basic Information tab, click the Edit button next to the playbook name.

Error codes related to playbook orchestration

Error codes related to component execution