Playbooks
A playbook is an automated remediation runbook: an ordered sequence of actions that runs when a linked alarm fires. It turns an alert into a response — notify on-call, check dependent services, call a webhook, or block an attacker at the edge — with no human in the loop.
The list shows each playbook's Name, the Triggers / Alarms it's attached to, its Actions, Status (Armed / Disarmed) and Updated time. Playbooks are created disarmed — nothing runs against live traffic until you explicitly arm one.
Build a playbook
New playbook has a name, an Action sequence, and a live Summary and Safety panel on the right. Actions run top-to-bottom when the alarm fires — the first immediately, each subsequent action after its configured delay. Add action appends a step; use the ↑ / ↓ controls to reorder.
Action types
| Action | Type | What it does |
|---|---|---|
| Notify On-Call | Safe | Send a message to a channel (with severity and optional text). |
| Check Linked Services | Safe | Probe a set of monitors and send a report to a channel — triage context. |
| Send Webhook | Safe | POST to a URL (method, headers, body template) to trigger your own automation. |
| CDN Provider 01 Blacklist | Destructive | Block source IPs at the CDN edge for a duration. Blocks live traffic — effectively irreversible for its duration. |
| CDN Provider 02 Blacklist | Destructive | Apply a region-scoped block at the CDN provider's edge. |
The two blacklist actions are marked in red in the picker because they act on live traffic.
The arm / disarm safety model
Because playbooks can take destructive edge actions automatically, they ship with guardrails:
- Created disarmed. A new playbook never runs until you arm it from its detail page.
- No live simulation. There is no dry-run — arming is the go-live gate, so review every action's config before you arm.
- Attach to an alarm. A playbook only runs when a linked alarm fires; wire it up in the alarm's Auto-remediation section.
A playbook containing CDN Provider 01 Blacklist or CDN Provider 02 Blacklist will block real traffic the moment its alarm fires. Keep it disarmed until you've confirmed the alarm's conditions and thresholds won't trigger on false positives — a noisy alarm plus an armed blocking playbook can take down legitimate users.