Multi-prompt blocks for a visual playbook editor

1. A computer-implemented method comprising:

causing display of a graphical user interface (GUI) including a visual playbook editor for a customizable playbook, wherein the customizable playbook represents computer program source code including a collection of related function blocks that define a series of operations to be performed in response to identification of an incident in an information technology (IT) environment, and wherein the collection of related function blocks is represented by a graph displayed in the visual playbook editor;

receiving input via the visual playbook editor, the input including:

first input causing addition to the graph of a node representing a multi-prompt function block to the playbook, the multi-prompt function block associated with a plurality of response prompts to be displayed to a user in a single interface element during execution of the playbook, wherein a value provided by a user in response to at least one of the plurality of response prompts is used by at least one other function block of the playbook, and

second input defining at least one connection between the multi-prompt function block and at least one other function block in the playbook; and

causing display of the multi-prompt function block as part of the graph displayed in the visual playbook editor.

2. The computer-implemented method of claim 1 , the method further comprising:

executing the playbook in response to identification of a particular incident in an IT environment;

generating a multi-prompt interface element responsive to encountering the multi-prompt function block during execution of the playbook; and

receiving a plurality of values from a user via the multi-prompt interface element.

3. The computer-implemented method of claim 1 , the method further comprising:

executing the playbook in response to identification of a particular incident in an IT environment;

generating a multi-prompt interface element responsive to encountering the multi-prompt function block during execution of the playbook;

receiving a plurality of values from a user via the multi-prompt interface element; and

adding at least value of the plurality of values to an activity log associated with execution of the playbook.

4. The computer-implemented method of claim 1 , wherein the multi-prompt function block is connected to a decision block in the playbook, and wherein the decision block uses at least two values obtained via the multi-prompt function block to determine a playbook execution path of a plurality of possible playbook execution paths.

5. The computer-implemented method of claim 1 , wherein the playbook is executed automatically in response to an orchestration, automation, and response (OAR) platform obtaining timestamped event data satisfying one or more criteria.

6. The computer-implemented method of claim 1 , wherein at least one question displayed as part of a multi-prompt interface element generated based on the multi-prompt function block includes at least one dynamic component generated based on a value obtained from another function block of the playbook.

7. The computer-implemented method of claim 1 , wherein the input received via the visual playbook editor further includes third input specifying a variable name to be used to identify a response value received from a user via a multi-prompt interface element generated based on execution of the multi-prompt function block.

8. The computer-implemented method of claim 1 , wherein the input received via the visual playbook editor further includes third input indicating, for at least one question displayed as part of a multi-prompt interface element generated based on the multi-prompt function block, a type of value to be provided by a user in response to the question.

9. The computer-implemented method of claim 1 , wherein the input received via the visual playbook editor further includes third input indicating, for a first question displayed as part of a multi-prompt interface element generated based on the multi-prompt function block, a first type of value to be provided by a user in response to the first question and, for a second question displayed as part the multi-prompt interface element generated based on the multi-prompt function block, a second type of value that is different from the first type of acceptable response value.

10. The computer-implemented method of claim 1 , wherein the input received via the visual playbook editor further includes third input indicating, for at least one question displayed as part of a multi-prompt interface element generated based on the multi-prompt function block, a range of acceptable values to be provided by a user in response to the question.

11. The computer-implemented method of claim 1 , wherein execution of the multi-prompt function block during execution of the playbook causes generation of a notification in a GUI indicating a request for a user to answer the plurality of response prompts.

12. The computer-implemented method of claim 1 , wherein execution of the multi-prompt function block during execution of the playbook causes execution of the playbook to be suspended until a user provides response values to the plurality of response prompts.

13. The computer-implemented method of claim 1 , wherein the input received via the visual playbook editor further includes third input indicating a deadline for a user to respond to a multi-prompt generated based on the multi-prompt function block during execution of the playbook.

14. The computer-implemented method of claim 1 , wherein execution of the multi-prompt function block during execution of the playbook includes causing display in a GUI of the single prompt including the plurality of response prompts and a plurality of interface elements used to provide response values for the plurality of response prompts.

15. The computer-implemented method of claim 1 , wherein the playbook is associated with an orchestration, automation, and response (OAR) platform.

16. A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:

causing display of a graphical user interface (GUI) including a visual playbook editor for a customizable playbook, wherein the customizable playbook represents computer program source code including a collection of related function blocks that define a series of operations to be performed in response to identification of an incident in an information technology (IT) environment, and wherein the collection of related function blocks is represented by a graph displayed in the visual playbook editor;

receiving input via the visual playbook editor, the input including:

first input causing addition to the graph of a node representing a multi-prompt function block to the playbook, the multi-prompt function block associated with a plurality of response prompts to be displayed to a user in a single interface element during execution of the playbook, wherein a value provided by a user in response to at least one of the plurality of response prompts is used by at least one other function block of the playbook, and

second input defining at least one connection between the multi-prompt function block and at least one other function block in the playbook; and

causing display of the multi-prompt function block as part of the graph displayed in the visual playbook editor.

17. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions, when executed by the one or more processors, causes performance of further operations comprising:

executing the playbook in response to identification of a particular incident in an IT environment;

generating a multi-prompt interface element responsive to encountering the multi-prompt function block during execution of the playbook; and

receiving a plurality of values from a user via the multi-prompt interface element.

18. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions, when executed by the one or more processors, causes performance of further operations comprising:

executing the playbook in response to identification of a particular incident in an IT environment;

generating a multi-prompt interface element responsive to encountering the multi-prompt function block during execution of the playbook;

receiving a plurality of values from a user via the multi-prompt interface element; and

adding at least value of the plurality of values to an activity log associated with execution of the playbook.

19. The non-transitory computer-readable storage medium of claim 16 , wherein the multi-prompt function block is connected to a decision block in the playbook, and wherein the decision block uses at least two values obtained via the multi-prompt function block to determine a playbook execution path of a plurality of possible playbook execution paths.

20. The non-transitory computer-readable storage medium of claim 16 , wherein the playbook is executed automatically in response to an orchestration, automation, and response (OAR) platform obtaining timestamped event data satisfying one or more criteria.

21. The non-transitory computer-readable storage medium of claim 16 , wherein at least one question displayed as part of a multi-prompt interface element generated based on the multi-prompt function block includes at least one dynamic component generated based on a value obtained from another function block of the playbook.

22. The non-transitory computer-readable storage medium of claim 16 , wherein the input received via the visual playbook editor further includes third input specifying a variable name to be used to identify a response value received from a user via a multi-prompt interface element generated based on execution of the multi-prompt function block.

23. The non-transitory computer-readable storage medium of claim 16 , wherein the playbook is associated with an orchestration, automation, and response (OAR) platform.

24. An apparatus, comprising:

one or more processors;

a non-transitory computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to:

cause display of a graphical user interface (GUI) including a visual playbook editor for a customizable playbook, wherein the customizable playbook represents computer program source code including a collection of related function blocks that define a series of operations to be performed in response to identification of an incident in an information technology (IT) environment, and wherein the collection of related function blocks is represented by a graph displayed in the visual playbook editor;

receive input via the visual playbook editor, the input including:

first input causing addition to the graph of a node representing a multi-prompt function block to the playbook, the multi-prompt function block associated with a plurality of response prompts to be displayed to a user in a single interface element during execution of the playbook, wherein a value provided by a user in response to at least one of the plurality of response prompts is used by at least one other function block of the playbook, and

second input defining at least one connection between the multi-prompt function block and at least one other function block in the playbook; and

cause display of the multi-prompt function block as part of the graph displayed in the visual playbook editor.

25. The apparatus of claim 24 , wherein the instructions, when executed by the one or more processors, further cause the apparatus to:

executing the playbook in response to identification of a particular incident in an IT environment;

generating a multi-prompt interface element responsive to encountering the multi-prompt function block during execution of the playbook; and

receiving a plurality of values from a user via the multi-prompt interface element.

26. The apparatus of claim 24 , wherein the instructions, when executed by the one or more processors, further cause the apparatus to:

executing the playbook in response to identification of a particular incident in an IT environment;

generating a multi-prompt interface element responsive to encountering the multi-prompt function block during execution of the playbook;

receiving a plurality of values from a user via the multi-prompt interface element; and

adding at least value of the plurality of values to an activity log associated with execution of the playbook.

27. The apparatus of claim 24 , wherein the multi-prompt function block is connected to a decision block in the playbook, and wherein the decision block uses at least two values obtained via the multi-prompt function block to determine a playbook execution path of a plurality of possible playbook execution paths.

28. The apparatus of claim 24 , wherein the playbook is executed automatically in response to an orchestration, automation, and response (OAR) platform obtaining timestamped event data satisfying one or more criteria.

29. The apparatus of claim 24 , wherein at least one question displayed as part of a multi-prompt interface element generated based on the multi-prompt function block includes at least one dynamic component generated based on a value obtained from another function block of the playbook.

30. The apparatus of claim 24 , wherein the playbook is associated with an orchestration, automation, and response (OAR) platform.