Creating Automation

after resolving signals, you can create automation to handle similar signals in the future create a triage rule when to create when you see a signal pattern that should be automatically routed or processed what gets created clicking create a triage rule creates a record in the signal routing rules application (for example, rule 29) a link to the new rule record is shown—click it to open the record you can also open it from application records → signal routing rules or the routing rule management dashboard to edit, enable, or run it against pending signals availability create a triage rule is disabled while the case is still processing it becomes available once the case has been processed steps in the ai alert analysis panel, go to the automation section and click create a triage rule on the rule record, configure rule name pre populated from the signal name; edit for clarity description (optional) add a short explanation of when and why the rule runs status set the rule's state; leave it disabled until the rule is ready to run conditions define when the rule fires (for example, signal name contains a value, signal source equals x, severity is high) use the condition builder choose field , operator (for example, contains, equals), and value use and or group to add multiple conditions; all must be met for the rule to trigger selected playbook select a playbook with a rule execute flow event trigger (only those playbooks appear in the list) apply the rule to the playbook so the rule uuid condition is set automatically see building routing rule playbooks docid\ veifyg4oywkq3dcmmwjxi when the rule's conditions are met, this playbook runs rule order is assigned automatically the platform takes the highest rule order among existing rules except rules associated with ai soc trigger analysis agent via routing rule , then increments by one a correctly configured catch all agentic rule (high order such as 99999 , associated with that playbook) is excluded from this calculation, so new triage rules typically receive a low order (for example 2 , 3 , …) and evaluate before the catch all save the record enable the rule when ready (set its status ) once enabled, the rule evaluates incoming signals; when a signal meets all conditions, the selected playbook runs to test without waiting for new signals open the rule record, go to the support tab, and use run rule against pending signals expand records matched to see which signals were matched by the rule if a high order “default” or catch all rule is not associated with ai soc trigger analysis agent via routing rule , auto assigned rule order can land above that high value (for example 100000 after a 99999 rule) confirm the catch all uses the trigger analysis agent playbook—see building routing rule playbooks docid\ veifyg4oywkq3dcmmwjxi best practices start with simple conditions and refine based on volume test rules before enabling in production (use run this rule against pending signals ) use the routing rule management dashboard to reorder rules (drag and drop), open the rule or associated playbook, enable or disable rules, and edit or delete rules see ai soc applications for the full dashboard walkthrough document rule logic and purpose in the description field keep specific triage and automated playbook rules before the agentic catch all so known alerts avoid full agentic investigation and reduce ai/token cost create a playbook when to create when you have investigation steps that should be automated for similar signals—after manual plan execution or after on record re investigate or a trigger analysis agent routing run on the record recovery steps auto generated playbooks built from your investigation plan do not include recovery steps from generate remediation plan (when you have generated one) that is intentional the playbook automates investigation and containment; recovery in the same run can reverse containment (for example, rejoining a host after isolation) do not treat that as a requirement to perform recovery manually on every case build reusable recovery playbooks (saved in orchestration → playbooks ) and run them after containment and approvals, or seed them once from the remediation plan output and reuse them availability create a playbook is disabled while the case is still processing it becomes available once the case has been processed steps in the automation section, click create a playbook important allow browser pop ups for your swimlane domain the playbook builder opens in a new browser tab ; if pop ups are blocked, the playbook is not created and you see an error see pop up requirement below the playbook builder opens with suggested components from your plan or an agentic investigation session review and customize the playbook add or remove steps configure step parameters add error handling save and enable the playbook after saving, the associated routing rule is updated with this playbook, and links to the rule record and the playbook are shown—click either link to open it test the playbook with sample data recreate playbook when to use when a playbook already exists for the record and you changed the investigation plan (for example, after regenerate investigation plan ) and need a new playbook generated from the current plan recreate playbook appears in the automation section only after a playbook has already been created for the record; before that, you see create a playbook what it does click recreate playbook in automation a confirmation dialog appears; confirm to launch hero ai in the playbook editor (in a new browser tab) hero ai generates a new playbook from the latest investigation plan it recreates the playbook rather than incrementally updating it, so it does not merge changes you made manually in the previous version steps confirm a playbook already exists for the record the automation section shows create a playbook when no playbook exists yet, and recreate playbook once a playbook has been generated click recreate playbook and confirm in the dialog wait for generation to finish review the recreated flow in the builder, customize as needed, and save when a playbook run is linked to the case, a view details link (with a success or failure icon) appears next to recreate playbook ; click it to open the playbook run in canvas activity n+1 cases for an n+1 case (a repeat alert matched to an existing case through linked knowledge base articles), recreate playbook is disabled , and a tooltip explains why to update the playbook associated with an n+1 case, first generate a new investigation plan for that case with regenerate investigation plan the new plan is built using guidance from the linked kbas; you can then recreate the playbook from that plan see investigation plan workflow docid\ bde8p71mmp2lbymuzuooi if hero ai generation fails or you cancel the prompt before it completes, the playbook may be left incomplete or overwritten with a partial template allow generation to finish, or duplicate the playbook in orchestration before you recreate if you need a backup of manual edits pop up requirement create a playbook and recreate playbook open the playbook builder in a new browser tab if pop ups (new tabs) are blocked, the playbook is not created you see the message "pop up has been blocked this feature requires a new tab to be opened please disable your pop up blocker and try again " allow pop ups for the swimlane domain and click the action again known limitation — concurrent playbook edits turbine does not lock a playbook when it is open in more than one browser window or tab clicking create a playbook or recreate playbook more than once can open parallel builder sessions against the same playbook saves from different sessions can conflict or overwrite each other finish and save one builder session before starting another; close extra builder windows when you are done this is general platform behavior see playbooks overview docid\ dp agnnne2mjjfgtv2lz5 and how to create a playbook docid 0 kvg5p4lthw75itmpuwp in the turbine user guide best practices (create a playbook and recreate playbook) test playbooks with sample data before enabling add error handling for external integrations keep playbook flows focused on a single use case document what triggers the playbook and what it does update rule when to use when a triage rule already exists for the case and you need to change how it routes or which playbook it runs what it does once a rule exists, step 1 of the automation section shows the rule name (click it to open the rule record) and an update rule button click update rule to open the triage rule in the rule drawer—the same drawer used after creating a rule—where you can edit its conditions, selected playbook, rule order, and status, then save editing the rule writes an entry to the case timeline remove rule and playbook when to use when the automation set up for a case is no longer needed and you want to unlink it from the case what it does when a rule and/or playbook is linked to the case, a remove rule and playbook link appears in the automation header click it and confirm in the remove rule and playbook from case dialog this clears the case's automation links to the triage rule and playbook (whether they were linked automatically from a matched rule or created from the case) the link is unavailable while a create, recreate, or plan regeneration is in progress to build or attach a playbook outside the case record (duplicate, manual build, or generate then cancel template), see building routing rule playbooks docid\ veifyg4oywkq3dcmmwjxi for general turbine playbook authoring, see the playbooks documentation in the turbine user guide