Running playbooks in a detection

Run a playbook used by the rule for a detection.

To view a playbook in a rule:

1. Click the Detections tab and open a rule in the list.
2. Click the Events tab.
3. In the Timestamp column, right-click an entry and select Playbooks. The Add Playbook page opens.
4. Select a playbook in the list.
5. Click Run Playbook.