{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"platform/runbook","url":{"en":"https://atlas.maintz.dev/en/terms/platform/runbook/","da":"https://atlas.maintz.dev/da/terms/platform/runbook/"},"term":{"en":"Runbook","da":"Runbook"},"aka":{"en":[],"da":["driftsvejledning"]},"domain":["platform"],"cluster":"observability","layer":"process","status":"current","summary":{"en":"Written step-by-step instructions for handling one known situation, such as a certain alarm, so anyone on call can act fast.","da":"Skrevne trin-for-trin-instruktioner til at håndtere én kendt situation, fx en bestemt alarm, så enhver på vagt kan handle hurtigt."},"body":{"formal":{"en":"A kept-up-to-date document tied to a specific alarm or task that says how to confirm the problem, which checks and fixes to try in which order, and when and to whom to pass it on; its steps are often turned into scripts over time.","da":"Et løbende opdateret dokument knyttet til en bestemt alarm eller opgave, der beskriver, hvordan man bekræfter problemet, hvilke tjek og rettelser man prøver i hvilken rækkefølge, og hvornår og til hvem sagen sendes videre; trinene bliver ofte med tiden lavet om til scripts."},"plain":{"en":"Like the checklist pilots pull out when a warning light comes on; nobody has to invent the answer under stress.","da":"Som den tjekliste, piloter tager frem, når en advarselslampe tænder; ingen skal finde på svaret under pres."},"inPractice":{"en":"At night an alarm reports that a municipality's letters to citizens' digital post are piling up unsent; the on-call staff member opens the linked runbook and works through its five steps, calling the supplier only at the last one.","da":"Om natten melder en alarm, at kommunens breve til borgernes Digital Post hober sig op uden at blive sendt; den vagthavende medarbejder åbner den tilknyttede runbook og følger dens fem trin og ringer først til leverandøren ved det sidste."},"whyItMatters":{"en":"In a crisis people forget and guess; a good runbook makes the response fast and the same every time, and lets new staff handle problems only experts knew before.","da":"I en krise glemmer folk og gætter; en god runbook gør indsatsen hurtig og ens hver gang og lader nye medarbejdere håndtere problemer, som før kun eksperter kunne klare."}},"deepDive":{"en":"The word comes from mainframe operations, where a run book listed the jobs, parameters and recovery steps operators needed to run a batch schedule. In modern operations a runbook is procedural and narrow: one alert or one routine task, with a precondition, a sequence of diagnostic and remedial steps, verification that the fix worked and an escalation point. The term playbook is often used interchangeably, but many organisations use playbook for the broader, scenario-level response (a ransomware playbook, a data breach playbook covering roles, communications and legal notification), with runbooks as the technical procedures invoked from it. The Google SRE book reports that recording best practices ahead of time in a playbook gives roughly a threefold improvement in mean time to repair compared with improvising.\n\nA well-structured runbook for an alert states what the alert means and its user impact, links to the dashboards and queries needed to confirm it, lists ordered diagnostic commands with expected output, gives mitigations from least to most invasive (drain a node, roll back the last deployment, fail over a region), says when to stop and escalate and to whom, and records owner and last review date. Linking the runbook from the alert itself, for example through a runbook_url annotation on a Prometheus rule, means the responder reaches it in one step from the page.\n\nRunbooks decay: infrastructure changes, commands reference hosts that no longer exist, and steps that were correct become dangerous. Common countermeasures are keeping runbooks in version control next to the service code, reviewing them after every incident that used them, exercising them in game days, and deleting alerts that have no meaningful runbook, since an alert with no documented action is usually one that should not page. Runbooks written as narrative prose rather than executable, checkable steps are harder to follow at 3 a.m.\n\nThe natural evolution is automation. Steps that are fully deterministic can be converted into scripts, then into runbook automation tools or executable notebooks, and finally into self-healing controllers that act without paging anyone, at which point the alert should be downgraded or removed. On the security side SOAR platforms implement the same idea for SOC workflows, executing enrichment and containment steps automatically when a SIEM alert arrives. NIST SP 800-61 Rev. 3 (April 2025) frames incident response within the NIST Cybersecurity Framework 2.0 functions and expects organisations to maintain documented response procedures; runbooks are the most concrete form of such procedures, and for entities under NIS2 or DORA they are part of the evidence that incident handling is actually operational.","da":"Ordet stammer fra mainframe-driften, hvor en run book listede de jobs, parametre og genopretningstrin, som operatørerne skulle bruge for at afvikle en batchplan. I moderne drift er en runbook procedurel og snæver: én alarm eller én rutineopgave, med en forudsætning, en række diagnosticerende og afhjælpende trin, en kontrol af at rettelsen virkede, og et eskaleringspunkt. Ordet playbook bruges ofte i flæng, men mange organisationer bruger playbook om den bredere, scenariebaserede respons (en ransomware-playbook eller en playbook for brud på persondatasikkerheden, der dækker roller, kommunikation og anmeldelse til myndigheder), med runbooks som de tekniske procedurer, der kaldes derfra. Googles SRE-bog oplyser, at det giver cirka en tredobbelt forbedring af den gennemsnitlige tid til genopretning (MTTR) at nedskrive bedste praksis på forhånd i en playbook frem for at improvisere.\n\nEn velstruktureret runbook til en alarm beskriver, hvad alarmen betyder, og hvordan brugerne påvirkes, linker til de dashboards og forespørgsler, der skal bruges til at bekræfte den, oplister diagnostiske kommandoer i rækkefølge med forventet output, angiver afhjælpning fra mindst til mest indgribende (dræn en node, rul den seneste udrulning tilbage, fail over til en anden region), siger, hvornår man skal stoppe og eskalere og til hvem, og registrerer ejer og dato for seneste gennemgang. Når runbooken linkes direkte fra alarmen, fx via en runbook_url-annotation på en Prometheus-regel, kommer den vagthavende frem til den i ét skridt fra opkaldet.\n\nRunbooks forældes: infrastrukturen ændrer sig, kommandoer henviser til hosts, der ikke længere findes, og trin, der var korrekte, bliver farlige. Typiske modtræk er at have runbooks i versionsstyring ved siden af tjenestens kode, gennemgå dem efter hver hændelse, hvor de blev brugt, øve dem på game days og slette alarmer uden en meningsfuld runbook, da en alarm uden dokumenteret handling som regel ikke burde vække nogen. Runbooks skrevet som fortællende prosa frem for eksekverbare, kontrollerbare trin er sværere at følge klokken tre om natten.\n\nDen naturlige udvikling er automatisering. Trin, der er fuldt deterministiske, kan laves om til scripts, dernæst til værktøjer til runbook-automatisering eller eksekverbare notebooks og til sidst til selvhelende controllere, der handler uden at tilkalde nogen, hvorefter alarmen bør nedgraderes eller fjernes. På sikkerhedssiden implementerer SOAR-platforme samme idé for SOC-arbejdsgange og udfører berigelse og inddæmning automatisk, når en SIEM-alarm kommer ind. NIST SP 800-61 Rev. 3 (april 2025) indplacerer hændelseshåndtering i funktionerne i NIST Cybersecurity Framework 2.0 og forventer, at organisationer vedligeholder dokumenterede responsprocedurer; runbooks er den mest konkrete form for sådanne procedurer, og for enheder omfattet af NIS2 eller DORA indgår de i dokumentationen for, at hændelseshåndteringen reelt fungerer."},"howTo":{"steps":{"en":["List the alerts that page people and the routine tasks done by hand, and start with those that fire often or have caused incidents.","Write one runbook per alert or task from a fixed template - what it means and how users are affected, owner, tools and permissions needed, and date of last review.","Describe the diagnostic steps in order, with exact commands, links to the dashboards and queries needed and the expected output.","List mitigations from least to most invasive, how to check that the fix worked, and when to stop and escalate, and to whom.","Keep runbooks in version control next to the service code, and link each one directly from its alert, for example with a runbook_url annotation.","Refer to the runbooks from the IT preparedness plan, so the plan's action plans point to the concrete technical procedures.","Have a colleague who did not write the runbook test it, and rehearse the critical ones in game days or exercises.","Review the runbook after every incident that used it, and delete alerts that have no meaningful action.","Automate steps that are fully deterministic, first as scripts and later as self-healing automation, and then downgrade or remove the alert."],"da":["List de alarmer, der tilkalder folk, og de rutineopgaver, der udføres i hånden, og begynd med dem, der udløses ofte eller har ført til hændelser.","Skriv én runbook pr. alarm eller opgave ud fra en fast skabelon - hvad den betyder, og hvordan brugerne påvirkes, ejer, nødvendige værktøjer og rettigheder samt dato for seneste gennemgang.","Beskriv de diagnosticerende trin i rækkefølge med præcise kommandoer, links til de nødvendige dashboards og forespørgsler og det forventede output.","List afhjælpning fra mindst til mest indgribende, hvordan man tjekker, at rettelsen virkede, og hvornår man skal stoppe og eskalere, og til hvem.","Hold runbooks i versionsstyring ved siden af tjenestens kode, og link hver runbook direkte fra sin alarm, fx via en runbook_url-annotation.","Henvis til runbooks fra it-beredskabsplanen, så planens handlingsplaner peger på de konkrete tekniske procedurer.","Lad en kollega, der ikke har skrevet runbooken, afprøve den, og øv de kritiske på game days eller beredskabsøvelser.","Gennemgå runbooken efter hver hændelse, hvor den blev brugt, og slet alarmer, der ikke har en meningsfuld handling.","Automatisér trin, der er fuldt deterministiske, først som scripts og senere som selvhelende automatisering, og nedgradér eller fjern derefter alarmen."]},"pitfalls":{"en":["Writing runbooks once and never updating them, so commands point at hosts that no longer exist.","Writing long prose instead of short, checkable steps that someone woken at three in the morning can follow.","Keeping runbooks only in a system that is unavailable during the very outage they are meant for.","Automating a runbook before the manual steps have been proven to work."],"da":["At skrive runbooks én gang og aldrig opdatere dem, så kommandoerne peger på hosts, der ikke længere findes.","At skrive lange tekster i stedet for korte, kontrollerbare trin, som en, der er vækket klokken tre om natten, kan følge.","Kun at have runbooks i et system, der er utilgængeligt under netop det nedbrud, de skal bruges til.","At automatisere en runbook, før de manuelle trin er afprøvet og virker."]},"guides":[{"title":"Google SRE Workbook - On-Call","url":"https://sre.google/workbook/on-call/","publisher":"Google","tier":"reference"},{"title":"AWS Well-Architected - OPS07-BP03 Use runbooks to perform procedures","url":"https://docs.aws.amazon.com/wellarchitected/latest/operational-excellence-pillar/ops_ready_to_support_use_runbooks.html","publisher":"AWS","tier":"official-doc"},{"title":"NIST SP 800-61 Rev. 3 - Incident Response Recommendations and Considerations for Cybersecurity Risk Management","url":"https://csrc.nist.gov/pubs/sp/800/61/r3/final","publisher":"NIST","tier":"standard"},{"title":"Vejledning i it-beredskab","url":"https://sikkerdigital.dk/Media/638000655159015474/Vejledning-i-it-beredskab-september-2022.pdf","publisher":"Digitaliseringsstyrelsen","tier":"official-doc","lang":"da"}]},"edges":[{"type":"requires","to":"platform/alerting","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/soar","why":{"en":"SOAR tools turn the steps of written runbooks into automatic actions that run the moment an alarm arrives.","da":"SOAR-værktøjer gør trinene i skrevne runbooks til automatiske handlinger, der kører, i samme øjeblik en alarm kommer ind."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/soc","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Google SRE book - Chapter 11, Being On-Call","url":"https://sre.google/sre-book/being-on-call/","tier":"reference","publisher":"Google"},{"title":"NIST SP 800-61 Rev. 3 - Incident Response Recommendations and Considerations for Cybersecurity Risk Management","url":"https://doi.org/10.6028/NIST.SP.800-61r3","tier":"standard","publisher":"NIST"},{"title":"Google SRE book - Chapter 1, Introduction","url":"https://sre.google/sre-book/introduction/","tier":"reference","publisher":"Google"}],"draft":true}