---
title: Creating Automation
slug: solutions/creating-automation
docTags: 
createdAt: 2026-03-04T10:50:56.980Z
---

After resolving signals, you can create automation to handle similar signals in the future.

### Create a Triage Rule

**When to create:** When you see a signal pattern that should be automatically routed or processed.

**What gets created:** Clicking **Create a Triage Rule** creates a **record** in the **Signal Routing Rules** application (for example, RULE-29). A link to the new rule record is shown—click it to open the record. You can also open it from **Application Records** → **Signal Routing Rules** or the Routing Rule Management dashboard to edit, enable, or run it against pending signals.

**Availability:** **Create a Triage Rule** is disabled while the case is still processing. It becomes available once the case has been processed.

**Steps:**

1. In the **AI Alert Analysis** panel, go to the **Automation** section and click **Create a Triage Rule**
2. On the rule record, configure:
   - **Rule Name:** Pre-populated from the signal name; edit for clarity
   - **Description:** (Optional) Add a short explanation of when and why the rule runs
   - **Status:** Set the rule's state; leave it disabled until the rule is ready to run
   - **Conditions:** Define when the rule fires (for example, Signal Name contains a value, Signal Source equals X, Severity is High). Use the condition builder: choose **Field**, **Operator** (for example, Contains, Equals), and **Value**. Use **AND** or **GROUP** to add multiple conditions; all must be met for the rule to trigger
   - **Selected Playbook:** Select a playbook with a **Rule-Execute** flow event trigger (only those playbooks appear in the list). Apply the rule to the playbook so the **rule UUID** condition is set automatically. See [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi). When the rule's conditions are met, this playbook runs
3. **Rule Order** is assigned automatically. The platform takes the highest **Rule Order** among existing rules **except** rules associated with **AI SOC - Trigger Analysis Agent via Routing Rule**, then increments by one. A correctly configured catch-all agentic rule (high order such as **99999**, associated with that playbook) is excluded from this calculation, so new triage rules typically receive a low order (for example **2**, **3**, …) and evaluate **before** the catch-all. Save the record
4. Enable the rule when ready (set its **Status**). Once enabled, the rule evaluates incoming signals; when a signal meets all conditions, the selected playbook runs
5. To test without waiting for new signals: open the rule record, go to the **Support** tab, and use **Run Rule Against Pending Signals**. Expand **Records Matched** to see which signals were matched by the rule.

:::hint{type="warning"}
If a high-order “Default” or catch-all rule is **not** associated with **AI SOC - Trigger Analysis Agent via Routing Rule**, auto-assigned **Rule Order** can land **above** that high value (for example **100000** after a **99999** rule). Confirm the catch-all uses the Trigger Analysis Agent playbook—see [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi).
:::

**Best practices:**

- Start with simple conditions and refine based on volume
- Test rules before enabling in production (use **Run this rule against pending signals**)
- Use the **Routing Rule Management** dashboard to reorder rules (drag and drop), open the rule or associated playbook, enable or disable rules, and edit or delete rules. See **AI SOC Applications** for the full dashboard walkthrough.
- Document rule logic and purpose in the **Description** field
- Keep specific triage and automated-playbook rules **before** the agentic catch-all so known alerts avoid full agentic investigation and reduce AI/token cost

### Create a Playbook

**When to create:** When you have investigation steps that should be automated for similar signals—after manual plan execution or after on-record **Re-investigate** or a Trigger Analysis Agent routing run on the record.

**Recovery steps:** Auto-generated playbooks built from your investigation plan **do not** include **recovery** steps from **Generate Remediation Plan** (when you have generated one). That is intentional: the playbook automates investigation and containment; recovery in the same run can reverse containment (for example, rejoining a host after isolation). **Do not** treat that as a requirement to perform recovery manually on every case. Build **reusable recovery playbooks** (saved in **Orchestration** → **Playbooks**) and run them after containment and approvals, or seed them once from the remediation plan output and reuse them.

**Availability:** **Create a Playbook** is disabled while the case is still processing. It becomes available once the case has been processed.

**Steps:**

1. In the **Automation** section, click **Create a Playbook**
2. **Important:** Allow browser pop-ups for your Swimlane domain. The playbook builder opens in a **new browser tab**; if pop-ups are blocked, the playbook is **not** created and you see an error. See **Pop-up requirement** below.
3. The playbook builder opens with suggested components from your plan or an agentic investigation session
4. Review and customize the playbook:
   - Add or remove steps
   - Configure step parameters
   - Add error handling
5. Save and enable the playbook. After saving, the associated routing rule is updated with this playbook, and links to the rule record and the playbook are shown—click either link to open it.
6. Test the playbook with sample data

### Recreate Playbook

**When to use:** When a playbook already exists for the record and you changed the investigation plan (for example, after **Regenerate Investigation Plan**) and need a new playbook generated from the **current** plan. **Recreate Playbook** appears in the **Automation** section only after a playbook has already been created for the record; before that, you see **Create a Playbook**.

**What it does:** Click **Recreate Playbook** in **Automation**. A confirmation dialog appears; confirm to launch Hero AI in the playbook editor (in a new browser tab). Hero AI generates a **new** playbook from the latest investigation plan. It **recreates** the playbook rather than incrementally updating it, so it does **not** merge changes you made manually in the previous version.

**Steps:**

1. Confirm a playbook already exists for the record. The **Automation** section shows **Create a Playbook** when no playbook exists yet, and **Recreate Playbook** once a playbook has been generated.
2. Click **Recreate Playbook** and confirm in the dialog. Wait for generation to finish.
3. Review the recreated flow in the builder, customize as needed, and save.

When a playbook run is linked to the case, a **View Details** link (with a success or failure icon) appears next to **Recreate Playbook**; click it to open the playbook run in Canvas Activity.

:::hint{type="info"}
**N+1 cases:** For an **N+1 case** (a repeat alert matched to an existing case through linked Knowledge Base Articles), **Recreate Playbook** is **disabled**, and a tooltip explains why. To update the playbook associated with an N+1 case, first generate a new investigation plan for that case with **Regenerate Investigation Plan**. The new plan is built using guidance from the linked KBAs; you can then recreate the playbook from that plan. See [Investigation Plan Workflow](docId\:BdE8P71Mmp2LByMuZuOOI).
:::

:::hint{type="info"}
If Hero AI generation fails or you cancel the prompt before it completes, the playbook may be left incomplete or overwritten with a partial template. Allow generation to finish, or duplicate the playbook in **Orchestration** before you recreate if you need a backup of manual edits.
:::

**Pop-up requirement:**

- **Create a Playbook** and **Recreate Playbook** open the playbook builder in a **new browser tab**.
- If pop-ups (new tabs) are blocked, the playbook is **not** created. You see the message: *"Pop-up has been blocked. This feature requires a new tab to be opened. Please disable your pop-up blocker and try again."*
- Allow pop-ups for the Swimlane domain and click the action again.

**Known limitation — concurrent playbook edits:**

- Turbine does **not** lock a playbook when it is open in more than one browser window or tab.
- Clicking **Create a Playbook** or **Recreate Playbook** more than once can open **parallel builder sessions** against the same playbook.
- Saves from different sessions can **conflict** or overwrite each other.
- Finish and save one builder session before starting another; close extra builder windows when you are done.
- This is general platform behavior. See [Playbooks Overview](docId\:Dp-AGNnnE2MJJFGtV2LZ5) and [How to Create a Playbook](docId:0-KvG5p4LTHw75ItmpUWp) in the Turbine User Guide.

**Best practices (Create a Playbook and Recreate Playbook):**

- Test playbooks with sample data before enabling
- Add error handling for external integrations
- Keep playbook flows focused on a single use case
- Document what triggers the playbook and what it does

### Update Rule

**When to use:** When a triage rule already exists for the case and you need to change how it routes or which playbook it runs.

**What it does:** Once a rule exists, **Step 1** of the **Automation** section shows the rule name (click it to open the rule record) and an **Update Rule** button. Click **Update Rule** to open the triage rule in the rule drawer—the same drawer used after creating a rule—where you can edit its conditions, selected playbook, rule order, and status, then save. Editing the rule writes an entry to the case timeline.

### Remove Rule and Playbook

**When to use:** When the automation set up for a case is no longer needed and you want to unlink it from the case.

**What it does:** When a rule and/or playbook is linked to the case, a **Remove rule and playbook** link appears in the **Automation** header. Click it and confirm in the **Remove rule and playbook from case** dialog. This clears the case's automation links to the triage rule and playbook (whether they were linked automatically from a matched rule or created from the case). The link is unavailable while a create, recreate, or plan regeneration is in progress.

To build or attach a playbook outside the case record (duplicate, manual build, or generate-then-cancel template), see [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi).

For general Turbine playbook authoring, see the Playbooks documentation in the Turbine User Guide.