What is runbook?

What is a runbook?

A runbook is a written procedure that tells an operator exactly how to carry out one operational task on one system: restart a stuck service, fail a database over to its replica, revoke a leaked key, renew a certificate. It lists the trigger, the prerequisites, the commands, the expected result, how to roll back and when to escalate, in order, so the task comes out the same whether the person on call built the system or joined last week. Plenty of runbooks are scripted end to end, and one document can serve both as a checklist for people and as the definition an automation platform executes.

Example: revoking a leaked cloud access key

A secrets-scanning alert reports an AWS access key committed to a public repository. The runbook for that alert reads:

1. Confirm the key ID and its owning account from the alert, and open a ticket.
2. Disable the key: aws iam update-access-key --user-name svc-build --access-key-id AKIAIOSFODNN7EXAMPLE --status Inactive
3. Create a replacement key, store it in the secrets vault and update the pipeline that uses it.
4. Search the audit trail for activity by the old key: aws cloudtrail lookup-events --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIAIOSFODNN7EXAMPLE
5. If any call came from an unfamiliar address, stop and escalate under the incident response playbook for compromised cloud credentials.
6. Delete the old key with aws iam delete-access-key and record the time of every step in the ticket.

Step 5 is the handoff: the runbook handles the routine fix and tells the operator when the situation has become an incident.

Runbook automation

Runbooks make good automation candidates because their steps are already precise. Some cloud platforms call their automation documents runbooks, and SOAR and IT automation tools run them on a trigger. An automated runbook keeps the discipline of the written one: it validates its inputs, runs under a narrowly scoped account, waits for a person before destructive steps and logs every run. A runbook nobody has used recently is an assumption, since servers get renamed and commands change, so teams test runbooks on a schedule and update them after each use.

Runbook vs. playbook vs. SOP

• Runbook: operational steps for one task on one system, often alert-driven and often automated.
• Playbook: the response to a whole type of incident, with roles, decision points and escalation; a playbook step may call a runbook.
• Standard operating procedure (SOP): the approved way to do a routine, recurring task, such as onboarding a user or running a monthly report.

Organizations and vendors use these words loosely, and some treat runbook and playbook as synonyms, so judge a question by what the document describes.

Runbook on the CompTIA Security+ exam

SY0-801 names runbooks in objective 5.1, among the procedures that sit beneath security policy, and the automation material in objective 4.6 uses them as the exact steps that automation tools carry out. Wording such as detailed instructions for one operational task on a specific system, a procedure triggered by a monitoring alert, or steps an automation platform executes points to a runbook. Distractors are the playbook, which covers an incident type with roles and decisions; the SOP, for routine business and IT tasks; the policy, which states requirements rather than steps; and the guideline, which recommends without requiring.