Playbooks

Playbooks are reusable investigation templates that standardize and accelerate network analysis workflows. You can create a playbook by saving an existing investigation as a template, then use that playbook to create new investigations with the same structure. A playbook contains the investigation setup only, without analysis result data.

Why use Playbooks?

Playbooks address the challenge of repetitive, manual investigation steps. Without playbooks, network analysts must:

• Rebuild the same investigation structure for recurring analysis tasks.
• Manually configure filters, statistics, and steps for each investigation, instead of using variables to simplify repeated setup.
• Risk inconsistency in investigation methodology across team members.

With playbooks, you can:

• Save time by reusing proven investigation workflows.
• Ensure consistency across investigations and analysts.
• Standardize best practices for common analysis scenarios.
• Train new team members by providing ready-to-use investigation templates.

Key concepts

• A playbook can be created by saving an existing investigation as a playbook using Create playbook in the investigation menu.
• A playbook is an investigation template without analysis result data.
• There is no separate playbook builder. Create investigations and save them as playbooks.
• When you create an investigation from a playbook, the playbook content is copied into a new, independent investigation.
• Changes to the new investigation do not affect the original playbook (and vice versa).

For information about investigation fundamentals, refer to Investigation.

Creating a playbook

To create a playbook, you must first prepare an investigation and then save it as a playbook.

Step 1: Prepare the investigation

Create or load the investigation in Monitoring Center > Analysis, then configure the steps, filters, and variables you want to reuse.

For details about creating and managing investigation steps, refer to Investigation.

Step 2: Save as playbook

You can configure variables before saving the playbook. For details, refer to Variables.

1. Click the investigation dropdown menu.
2. Select Create playbook.
3. Enter the playbook details:
   • Name - A descriptive name for the playbook.
   • Description - Explanation of what the playbook investigates.
   • Share - Whether to share with other users in the tenant.
4. Select default data sources and variable values in the next dialog tabs.
5. Click Create.

The investigation is now saved as a playbook and available for reuse.

Variables

Playbooks reuse variables defined in the source investigation.

Create and edit variables in the investigation before you save it as a playbook.

For variable types, configuration fields, and filter syntax, refer to Variables.

When you create an investigation from a playbook, variable definitions and values are copied to the new investigation.

Intervals

Playbooks support configurable time intervals that define the analysis time range.

Relative intervals

You can configure intervals using relative time ranges such as:

• Last 1 hour.
• Last 24 hours.
• Last 7 days.

When you create an investigation from a playbook with a relative interval, the system automatically translates the relative interval to a concrete from/to timestamp. This interval is based on the investigation creation time and is fixed. It is not a rolling time window.

Example

If a playbook is configured with "Last 24 hours" and you create an investigation from it at 2:00 p.m. on January 15th:

• The investigation interval becomes January 14th, 2:00 p.m. to January 15th, 2:00 p.m.
• This concrete interval is fixed in the investigation and does not change.

Creating an investigation from a playbook

When you create an investigation from a playbook, the system creates a new, independent investigation based on the playbook template.

How deployment works

1. The playbook content (steps, variables, filters) is copied into a new investigation.
2. The new investigation is fully editable.
3. Any changes you make to the investigation do not affect the original playbook.
4. The investigation does not maintain any reference to the source playbook.

Important considerations

• Each investigation created from a playbook is a standalone copy.
• If you edit the playbook later, existing investigations created from it are not affected.
• Only new investigations created after the edit will include the changes.
• You can further customize the investigation after creating it from a playbook.

To create an investigation from a playbook

1. Go to Flowmon Dashboards and Reports > Investigations.
2. Locate the playbook you want to use.
3. Right-click the playbook row or click the three dots icon.
4. Select Open playbook.
5. The new investigation opens in the Monitoring Center Analysis view.

You can also open a playbook directly from the Investigation panel in Analysis by clicking Open playbook in Investigations dropdown and selecting the playbook.

Working with playbook-derived investigations

After you create an investigation from a playbook, the investigation behaves exactly like any other investigation.

What carries over from the playbook

• Investigation structure and steps.
• Filter configurations.
• Variable definitions and values.
• Time interval settings (translated to concrete timestamps).
• Step relationships (parent-child hierarchy).

What you can modify

Since the investigation is independent from the playbook, you can:

• Add, remove, or reorder steps.
• Modify filters and statistics.
• Change variable values.
• Update the time interval.
• Rename the investigation.
• Add or remove variables.

Saving modified investigations

If you modify an investigation derived from a playbook and want to save those modifications as a new playbook:

1. Make your changes to the investigation.
2. Click the investigation menu.
3. Select Create playbook and provide a new name.

This creates a new playbook with your modifications while preserving the original playbook unchanged.

Import and export

You can export playbooks for backup or sharing. You can also import playbooks from other sources.

Exporting a playbook

1. Go to Flowmon Dashboards and Reports > Investigations > Playbooks.
2. Locate the playbook you want to export.
3. Right-click the playbook row or click the three dots icon.
4. Select Export.
5. Save the JSON file to your computer.

You can also export multiple playbooks at once:

1. Select the checkbox next to each playbook you want to export.
2. Click the Export button above the table.
3. Save the JSON file containing all selected playbooks.

Importing a playbook

1. Go to Flowmon Dashboards and Reports > Investigations.
2. Click the Import button above the table.
3. Select the JSON file containing the playbook.
4. The playbook is added to the list.

JSON structure

Exported playbooks use a JSON format containing:

• version - Schema version for compatibility
• metadata - playbook name, description, and tags
• variables - Variable definitions and values
• nodes - Investigation steps and their relationships