Views:

Use Companion to efficiently create playbooks with natural‑language prompts and automatically generated steps.

Note
Note
This feature is not available in all regions.
Security Playbooks uses Companion to quickly generate customized playbooks using natural‑language prompts. Companion automates playbook creation by suggesting steps, actions, and logic based on your input, facilitating the creation and refinement of playbooks without starting from scratch.
Before you can create playbooks with Companion, you must opt in to using Companion and enable generative AI in Companion settings.
Companion can generate the following types of playbooks:
  • Automated Response Playbooks
  • Workbench Insight Progression Update
  • Endpoint Response

Procedure

  1. Go to Workflow and Automation → Security Playbooks.
  2. On the Playbooks tab, click Add and select Create with Companion from the drop-down menu.
  3. In the Companion dialog that appears, enter a natural‑language prompt describing the playbook you want to create.
    Write prompts that include relevant context to get better recommendations:
    Prompt suggestions
    Description
    Be specific
    Help Companion understand your exact needs
    Mention data sources
    Enable Companion to generate playbook steps using telemetry from your solutions
    Provide context
    Clarify your environment and constraints
    Use natural language
    Improve AI understanding
    For example:
    Create a playbook that runs the previously uploaded PowerShell script on servers whose hostnames match the fin-* or finance-* patterns, across both Windows and Linux platforms.
  4. Wait for Companion to generate intelligent playbook recommendation with suggested steps, actions, and logic.
  5. When the recommendation is ready, click Review to examine the generated playbook, customize steps and actions as needed, and adjust logic to match your environment.
  6. Click Save to create the playbook.
  7. Click View playbook to view playbook details.
    Note
    Note
    If a playbook ID is generated, you are redirected to the playbook details. If a playbook ID is not generated, you can return to the Playbooks tab and select a playbook.