Use flows in playbooks

Supported in:

This document explains how the Flow component directs the next steps of a playbook by using a branching system to make decisions.

Condition flows are essential for allowing a playbook to automatically make decisions—routing a case down different paths based on incoming alert data, previous action results, or user input.

The following flow options are available:

  • Condition: Complex conditions based on placeholders, existing case data, and the Previous Actions flow.
  • Multi-Choice Question: Questions that analysts must answer manually.
  • Previous Actions Conditions: Data retrieved from previous actions executed in the playbook.

Add Condition flows

This section describes how to use Condition flows to create dynamic, branching logic within your playbooks.

Add a single Condition flow

To add a single Condition flow, follow these steps:

  1. On the Response > Playbooks page, click Open Step Selection.
  2. In Step Selection, select the Flow section.
  3. Drag the condition to the step or between two actions, depending on how you're building your playbook.
  4. Double-click the condition to open the dialog.
  5. Select the required entities.
  6. Decide how many branches you want to create. Each branch has an OR between them.
  7. Select and add parameters for each branch, as follows:
    1. Select the required event/case/alert parameters or enriched data that is in your Google Security Operations platform. For new users, this is empty if you've not yet ingested any alerts.
    2. Select the required operator: Equals to/Does not equal to, Contains/Does not contain, Starts with, or Greater than/Smaller than. 
    3. Choose a value. For this example, choose three branches (where the third branch is the Branch Else Default Branch.)
      • In Branch 1: Blocked alerts or alerts without a threat signature; then do X (the next playbook step).
        Branch 1: Logical Operator set to Or.
        Alert.CategoryOutcome = Blocked
        Alert.ThreatSignature [] Empty
      • In Branch 2: Allowed alerts with a threat signature.
        Branch 2: Logical Operator set to And
        Alert.CategoryOutcome = Allowed
        Alert. ThreatSignature ![] NotEmpty
      • In Branch 3: The default Else branch.
  8. Define a "fallback branch" to avoid failed conditions. If a condition is based on previous actions, and one of those actions failed (and skipped), the condition continues to the fallback branch, instead of stopping. To select a fallback branch, see Define a fallback branch.
  9. Click Save. The playbook now takes three branches: 1, 2, and E (Else).
  10. Set the outcome for (at least) one branch to mark the playbook as complete.

Add a multi-choice question flow

  1. Drag the Multi-Choice Questions condition to the Final Step box.
  2. Click Multi-Choice Questions to open the dialog.
  3. Add a question with as many answers as needed.
  4. Click Save. The playbook opens four branches.
  5. Set the outcome for at least one branch to mark it as complete.

Add a Previous Actions Conditions flow

To add a Previous Actions Conditions flow, follow these steps:

  1. Drag the Previous Actions Conditions to the Final Step box.
  2. Click Previous Actions Conditions to open the dialog.
  3. Decide how many branches to create. Each branch has an OR between them.
  4. Add a parameter: Select the required parameter. The list shows only the action script results from this playbook.
  5. Select the required operator: Equals to/Does not equal to, Contains/Does not contain, Starts with, or Greater than/Smaller than. 
  6. Choose the value (the action result).
  7. You can add more parameters to each branch and choose a logical operator: AND or OR.
  8. Click Save. The playbook opens three branches: 1, 2, and Else.
  9. Set the outcome for at least one branch to complete the playbook.

Define a fallback branch

  1. In one of the flows (Condition or Previous Actions Condition), select the branch to use as a fallback branch. This example uses Branch – not risky.
    You're not required to add a fallback branch.
  2. When the playbook runs, and the previous actions fail, the playbook chooses the fallback branch and continues.

Remove a flow

When removing a flow from within a playbook, the system prompts you to remove the entire branch or just one aspect of it.

Merge branches

You can merge different branches of the playbook into one branch. To do so, drag an action from one of the branches and drop it to the Final Step box of another branch. The playbook can continue after this or end here.

Need more help? Get answers from Community members and Google SecOps professionals.