Selecting a custom function from available custom functions to be added into a playbook
Techniques are described for enabling users of an information technology (IT) and security operations application to create highly reusable custom functions for playbooks. The creation and execution of playbooks using an IT and security operations application generally enables users to automate operations related to an IT environment responsive to the identification of various types of incidents or other triggering conditions. Users can create playbooks to automate operations such as, for example, modifying firewall settings, quarantining devices, restarting servers, etc., to improve users' ability to efficiently respond to various types of incidents operational issues that arise from time to time in IT environments.
1 . A method comprising:
receiving a first input defining a custom function block;
wherein the first input includes a specification of one or more input parameters to the custom function block, and user-provided executable source code defining functionality of the custom function block;
adding the custom function block to a first playbook in response to user input; and
executing, by a security operations application, the first playbook including the custom function block to perform security operations.
2 . The method of claim 1 further comprising adding the custom function block to a second playbook in response to a new user input, and executing, by the security operations application, the second playbook including the custom function block to perform one or more security operations.
3 . The method of claim 1 wherein the method further comprises saving the custom function block in a repository separate from any playbooks.
4 . The method of claim 1 wherein the one or more input parameters to the custom function block are received from the first playbook during execution of the first playbook.
5 . The method of claim 1 wherein adding the custom function block to the first playbook in response to the user input is performed using a playbook configuration tool.
6 . The method of claim 1 further comprising returning outputs from the custom function block to the first playbook.
7 . A system comprising:
one or more computers each including a processor and a memory, wherein the one or more computers are operable to execute instructions which cause the system to perform operations including:
receiving a first input defining a custom function block;
wherein the first input includes a specification of one or more input parameters to the custom function block, and user-provided executable source code defining functionality of the custom function block;
adding the custom function block to a first playbook in response to user input; and
executing, by a security operations application, the first playbook including the custom function block to perform security operations.
8 . The system of claim 7 wherein the operations further comprise adding the custom function block to a second playbook in response to a new user input, and executing, by the security operations application, the second playbook including the custom function block to perform one or more security operations.
9 . The system of claim 7 wherein the operations further comprise saving the custom function block in a repository separate from any playbooks.
10 . The system of claim 7 wherein the one or more input parameters to the custom function block are received from the first playbook during execution of the first playbook.
11 . The system of claim 7 wherein adding the custom function block to the first playbook in response to the user input is performed using a playbook configuration tool.
12 . The system of claim 7 wherein the operations further comprise returning outputs from the custom function block to the first playbook.
13 . A non-volatile computer-readable media including instructions, which when executed by one or more computers each including a processor and a memory, cause the one or more computers to perform operations including:
receiving a first input defining a custom function block;
wherein the first input includes a specification of one or more input parameters to the custom function block, and user-provided executable source code defining functionality of the custom function block;
adding the custom function block to a first playbook in response to user input; and
executing, by a security operations application, the first playbook including the custom function block to perform security operations.
14 . The non-volatile computer-readable media of claim 13 wherein the operations further comprise adding the custom function block to a second playbook in response to a new user input, and executing, by the security operations application, the second playbook including the custom function block to perform one or more security operations.
15 . The non-volatile computer-readable media of claim 13 wherein the operations further comprise saving the custom function block in a repository separate from any playbooks.
16 . The non-volatile computer-readable media of claim 13 wherein the one or more input parameters to the custom function block are received from the first playbook during execution of the first playbook.
17 . The non-volatile computer-readable media of claim 13 wherein adding the custom function block to the first playbook in response to the user input is performed using a playbook configuration tool.
18 . The non-volatile computer-readable media of claim 13 wherein the operations further comprise returning outputs from the custom function block to the first playbook.