Security Center:Configure and use playbooks

Playbook types

Security Center provides two types of playbooks:

• Predefined playbook: Built-in playbooks covering common security threat scenarios. Use them directly without configuration. To adapt a predefined playbook to your environment, copy it to create a custom playbook, then modify it as needed.

• Custom playbook: For complex or highly specialized scenarios, build your own playbook using the visual flow editor. Drag, connect, and configure components to implement automated security response logic.

Playbook parameters

Input parameters define what triggers the playbook. When you select different trigger conditions, the parameter examples in the debugging panel update accordingly.

Output parameters define the fields the playbook produces after execution. Downstream nodes in the same playbook can reference these fields. Other playbooks can also access them using the setOutput action with the syntax ${event.parameter_path}.

In addition to custom output parameters, the system provides built-in system parameters. For details, see System parameters in playbooks.

Prerequisites

Before you begin, make sure that you have:

• Access to the Security Center console

• The permissions required to create and publish playbooks in the SOAR module

Step 1: Create the playbook

1. Log on to the Security Center console.Log on to the Security Center console.

2. In the left navigation pane, choose Agentic SOC > SOAR. In the upper-left corner, select the region where the assets you want to protect are located: Chinese Mainland or Outside Chinese Mainland.

3. On the Custom Playbook tab, click Create Playbook.

4. In the Create Playbook panel, enter a Playbook Name and Playbook Description, then click OK.

Alternatively, go to the Predefined Playbook tab, find a suitable playbook, and click Copy in the Actions column to use it as a starting point.

Step 2: Configure the flow

After creating the playbook, you are automatically redirected to the flow configuration page. To return to this page later, click Edit in the Actions column on the Custom Playbook list.

Step 3: Debug the flow

Before publishing, run a debug session to verify the flow runs correctly.

Set a breakpoint (optional)

Breakpoints let you inspect intermediate results in a complex flow. The flow runs up to — but not including — the breakpointed node, then pauses.

Click the icon on a node to set it as a breakpoint.

Important

• In a flow with multiple branches, the system debugs only the branch containing the breakpoint.

• If multiple breakpoints are set on the same branch, only the last one takes effect.

Review the results

Click the icon on any node, or click Run Logs in the debugging area, to view the detailed input, output, and execution status for each node.

The following output parameters appear in the debug results:

Parameter	Description
datalist	Preview of the output data. A maximum of three entries are shown. To view the full dataset, go to the Complete Output Result tab.
total_data_successful	Volume of data processed successfully.
total_data	Total volume of data processed.
total_exe_successful	Number of times the action ran successfully.
total_exe	Total number of times the action ran.
total_data_with_dup	Volume of data after deduplication, counted from successfully processed data.

Step 4: Publish

Click Publish in the menu bar to convert the playbook to a published version, making it available for use in response rules and event handling.

Roll back a playbook

To restore a published playbook to a previous version:

1. On the Custom Playbook tab, find the playbook and click Details in the Actions column.

2. On the Basic Information tab, locate the publish history section to view available versions.

3. (Optional) Click View next to a version to open it and run a test in the Input Parameters (Run) area.

4. Click Roll Back to Edit or Roll Back and Publish for the version you want to restore:

   • Roll Back to Edit: Replaces the current draft with the selected version. The playbook is not published.

   • Roll Back and Publish: Replaces the current draft with the selected version and publishes it immediately.

Import a playbook

Only JSON files are supported.

1. In the flow editor menu bar, click More, then select Import JSON.

2. On the import page, upload the JSON file and click OK.

View execution records

In the playbook list, click the playbook ID or Details in the Actions column. On the Historical Execution Records tab, view basic execution records for that playbook.

The system automatically creates an execution record each time a playbook is used to handle a security event or alert.

Rename a playbook

In the playbook list, click the playbook ID or Details in the Actions column. On the Basic Information tab, click Edit next to the playbook name.

Predefined playbook names cannot be changed.

Playbook names must be unique.

Orchestration errors

Component execution errors