Runbooks
SOPs, runbooks, and environment notes form a searchable knowledge base. Triage, investigation, rule generation, and check-up readings cite it automatically.
Runbooks is the retrieval (RAG) knowledge base, available in every edition. Uploaded documents are chunked, embedded, and stored in the .rst_copilot_kb index in Elasticsearch. Before triage scoring, investigation verdicts, detection-rule generation, and platform check-up readings, the gateway searches it, passes the matching passages to the model, and states how many documents were used.
Runbooks needs an embedding model, configured under AI settings. Without one, the page reports that runbooks are off.
What to upload
Environment notes pay off most, for example "10.30.9.5 is the Zabbix node; its port probes are normal". The model has no other way to know which host monitors, or which subnet holds the jump hosts.
| Kind | Example | Used by |
|---|---|---|
| Incident playbooks and SOPs | Ransomware response, compromised-host isolation | Investigation and triage recommendations |
| Environment notes | Monitoring nodes, jump-host subnets, scanner addresses | False-positive assessment in triage and investigation |
| Detection conventions | Rule naming, severity definitions, ATT&CK mapping habits | Detection-rule generation |
| Cluster runbooks | Shard strategy, ILM conventions | Platform health AI reading |
Upload a document
Steps
- Select Upload.
- In Title, enter the name shown in search results and citations.
- In Body, paste Markdown or plain text. 5,000 to 20,000 characters works well; the dialog estimates the chunk count as you type.
- (Optional) Under Metadata (optional), add up to 6 pairs such as
source: internal-wikiorowner: soc-l2. Metadata is stored with each chunk so search results show the origin. - Select Submit and embed.
Embedding runs on the gateway. A local model takes a few minutes for about 1,000 chunks. The document then appears in Library. Deleting a document removes all its chunks.
Test retrieval
On the Search test tab, enter a question to see the matching passages with their score and source document. Use it to check chunking and phrasing.
Low hit rates usually come from long documents without headings, or from wording far from the document's.
Change the embedding model
A model with a different dimension cannot reuse the existing index. The gateway refuses the save and names both dimensions. Switch back to the original model, or delete the .rst_copilot_kb index and upload the documents again.