Gamebooks vs Playbooks vs Runbooks in Security Operations

Understand procedures, executable workflows, and governed agent behavior.

Reviewed by ContraForce team

Runbooks document what an operator should do. Playbooks execute predefined automation logic. ContraForce Gamebooks govern how Security Delivery Agents reason and act, including evidence requirements, permitted tools, confidence thresholds, approval gates, and escalation rules.

The terms are often used interchangeably, so buyers should evaluate the artifact and its enforcement behavior rather than its name.

Direct comparison

Microsoft defines a Sentinel playbook as a collection of response and remediation actions based on Azure Logic Apps. Playbooks can run automatically or on demand and can connect to other systems. See Microsoft Sentinel automation.

When to use a runbook

Use a runbook when human judgment is central, the procedure is infrequent, or automation access is not available. A good runbook still identifies evidence, decision points, action owners, escalation paths, and completion criteria.

When to use a playbook

Use a playbook when the inputs, branches, and actions are sufficiently deterministic. Common examples include enriching an indicator, assigning an incident, sending a notification, or calling a remote remediation API.

When to use a Gamebook

Use a Gamebook when an agent must investigate variable evidence but remain inside a provider's SOPs. A Gamebook should answer:

• Which evidence sources may the agent query?
• What must be proven before reaching a verdict?
• Which actions may run automatically?
• Which actions require a named approval?
• When must the agent stop and escalate?
• What must be written to the ticket and audit record?

How the three work together

An MSSP does not have to choose only one artifact. A runbook can express policy for humans, a Sentinel playbook can execute a deterministic action, and a Gamebook can govern when a Security Delivery Agent is allowed to invoke that action. The durable design is a hierarchy: policy defines authority, the Gamebook governs decisions, and integrations or playbooks execute specific operations.

Review checklist

• Give every SOP an owner and version.
• Test the failure path, not only the happy path.
• Separate investigation confidence from action authority.
• Preserve customer-specific exceptions without forking every shared SOP.
• Record the evidence and approval behind consequential actions.
• Revalidate SOPs after integration, permission, or portal changes.