Gamebooks vs Playbooks vs Runbooks in Security Operations
Reviewed by ContraForce Security Operations Team ยท Updated 2026-08-12
Runbooks document what an operator should do. Playbooks execute predefined automation logic. ContraForce Gamebooks govern how Security Delivery Agents reason and act, including evidence requirements, permitted tools, confidence thresholds, approval gates, and escalation rules.
The terms are often used interchangeably, so buyers should evaluate the artifact and its enforcement behavior rather than its name.
Direct comparison
| Characteristic | Runbook | Microsoft Sentinel playbook | ContraForce Gamebook |
|---|---|---|---|
| Primary purpose | Document a procedure | Automate a response workflow | Govern agent investigation and response |
| Typical format | Document or checklist | Azure Logic Apps workflow | Versioned policy and operating procedure |
| Execution | Human | Deterministic workflow | Agent within defined constraints |
| Handles novel evidence | Human judgment required | Only through authored branches and services | Agent can adapt its investigation within policy |
| Approval control | Manual instruction | Workflow step or external approval | Native approval gate tied to action authority |
| Audit evidence | Depends on operator notes | Logic App and incident run history | Investigation evidence, decisions, actions, and approvals |
| Best use | Training and manual response | Repeatable orchestration across connected systems | Consistent multi-tenant security delivery |
When to use a runbook
Use a runbook when human judgment is central, the procedure is infrequent, or automation access is not available. A good runbook still identifies evidence, decision points, action owners, escalation paths, and completion criteria.
When to use a playbook
Use a playbook when the inputs, branches, and actions are sufficiently deterministic. Common examples include enriching an indicator, assigning an incident, sending a notification, or calling a remote remediation API.
When to use a Gamebook
Use a Gamebook when an agent must investigate variable evidence but remain inside a provider's operating procedure. A Gamebook should answer:
- Which evidence sources may the agent query?
- What must be proven before reaching a verdict?
- Which actions may run automatically?
- Which actions require a named approval?
- When must the agent stop and escalate?
- What must be written to the ticket and audit record?
How the three work together
An MSSP does not have to choose only one artifact. A runbook can express policy for humans, a Sentinel playbook can execute a deterministic action, and a Gamebook can govern when a Security Delivery Agent is allowed to invoke that action. The durable design is a hierarchy: policy defines authority, the Gamebook governs decisions, and integrations or playbooks execute specific operations.
Review checklist
- Give every procedure an owner and version.
- Test the failure path, not only the happy path.
- Separate investigation confidence from action authority.
- Preserve customer-specific exceptions without forking every shared procedure.
- Record the evidence and approval behind consequential actions.
- Revalidate procedures after integration, permission, or portal changes.
Sources and review method
Product capabilities were reviewed against primary sources on 2026-08-12. ContraForce performance figures are product telemetry, not independent industry benchmarks.