Chapter 3. Working with Runbooks
Runbooks created with Zeppelin consist of a note that is divided into paragraphs. Each paragraph consists of two sections: the code section and the result section. A runbook containing a recreatable investigation is already populated with the code and visualization choices that you will need to analyze data. You will need to choose or provide information if the runbook contains dynamic forms and run each paragraph to view and analyze the data provided in each results section. Dynamic fields that allow you to choose or enter information such as an IP address, allow you to reuse the runbook multiple times with different variables. For more information on using notes, see Working with Notes.
To use a runbook, complete the following steps:
Find the runbook note that you want to use.
Zeppelin lists available notes on the left side of the welcome screen and in the Notebook menu.
Clone the note.
Zeppelin displays a Clone note dialog box:
Enter the new name for the note in the Note Name field, then click Clone Note.
Now you can start to use the runbook. For each paragraph in the note, enter or choose any relevant information, then run the paragraph by clicking the triangle button in the cell that contains the code:
Review the results for any suspicious behavior.
If you find suspicious issues that you would like to share, you can save the current version of the note.
From the Zeppelin toolbar, click the Export the notebook icon.
By default, Zeppelin downloads the notebook as a JSON file that you can then share .
