Work with playbooks in Perception

The Playbooks page lists all playbooks available to your organization. Use it to browse available playbooks, review what each one does and what agents it uses, and start new sessions.

Access the Playbooks page

1. Sign in to the Microsoft Defender portal.
2. Select Perception in the navigation pane.
3. Select Playbooks.

The page displays a flat list of playbooks.

Browse the playbooks list

Each row in the list shows:

Filter the list

• Use the Search playbooks bar to find a playbook by name.
• Use the Agents filter to narrow the list to playbooks that use a specific agent.

View playbook details

Select any row in the list to open the playbook detail pane on the right side of the screen. The pane shows the playbook name and the following sections:

Automation

If the playbook supports automation, any existing automation rules or an option to enable a new rule are displayed at the top.

Description

A full description of what the playbook does and what output it produces.

Required inputs

The input the playbook needs to run. For example, a playbook might require a threat intelligence article or an incident. Provide this input when you start a session.

Agents

The agents that execute this playbook, listed as cards. Each card shows:

• Agent name and publisher
• A short description of what the agent does in the context of this playbook
• A View details link to open the agent detail page

Start a session from a playbook

1. Select a playbook row to open its detail pane.
2. Review the Required inputs and Agents sections to confirm the playbook meets your needs.
3. Select New session at the top of the detail pane.
4. Provide the required input (for example, select a threat intelligence article or enter an incident ID).
5. Select Start session.

The session appears in the Sessions list with an In progress status.

View, add, or modify automation rules for a playbook

1. Select a playbook row to open its detail pane.
2. Locate the Automation section. If a playbook does not have one, that means this playbook does not currently support automatic triggering.
3. If there an existing rule already active, it will appear in that section with the option to edit it or toggle its status to off. All users may view rules, but only users with the security admin role may edit or create them. If no rule is active, you may also see a "Recommended" rule that you can toggle on. This is typically a very broad rule. You may toggle the recommended rule on and use it as-is, optionally edit the logic, or you can use the plus icon to add a new rule from scratch.
4. When you edit or create a rule, you must give the rule a name (this rule name will show up in the "Initiated By" field within the session metadata when it causes a session to run automatically). For playbooks that require an input to start, you must also choose a trigger event that relates to this input (for example, if the playbook requires an incident ID as its input, then a possible triggering event would be incident updated, but not some other event unrelated to incidents). Playbooks that do not have any inputs may be scheduled instead of triggered by an event.
5. Only one automation rule may be active at a given time per playbook. When a rule is active, that playbook will run automatically anytime the trigger event or schedule occurs.

Related content

• View and manage sessions
• Work with agents
• Run playbooks from incidents and threat intelligence