Prerequisites
Incident Responder role or higher in the workspace
Gamebook service principals authorized during onboarding
How to Run a Gamebook
Open the incident
From the Command Dashboard, click on the incident you want to respond to. This opens the Workbench.
Select entities in the Entity Context Graph
Click on the entity you want to take action on — device, user, IP, file, URL, or email.
Choose response actions
The Gamebook panel shows available actions for the selected entity type. Select the actions you want. You can select multiple actions across multiple entities.
Review your Gamebook
Before running, review all selected actions. Verify you’re targeting the correct entities.
Click Run
Click Run Gamebook. The IRIS engine executes all actions. You’ll see real-time status updates for each action.
What If an Action Fails?
| Status | Meaning | Next Step |
|---|---|---|
| Success | Action completed | No action needed |
| Failed | Action could not execute | Check Gamebook Failures |
| Pending Approval | High-impact action awaiting approval | Approver needs to review |