Runbooks
SOPs, runbooks and environment notes as a searchable knowledge base; triage, investigation, rule generation and the check-up read cite it automatically.
Runbooks is the RAG knowledge base. Uploaded documents are chunked, embedded and stored in .rst_copilot_kb in ES; triage scoring, investigation verdicts, rule generation and check-up reads search it first, hand the matching passages to the model, and mark the result "used N runbook documents". Every edition.
An embedding model must be configured under AI models first; without one the page says the knowledge base is not enabled.
Library
Three cards: searchable documents, embedded chunks, most recent upload. Each document shows title, chunk count and upload time; deleting removes its chunks.
Uploading a document
- Title: the name shown in search results and citations.
- Body: Markdown or plain text, 5–20k characters; the page estimates the chunk count live.
- Metadata (optional, up to 6 pairs):
source: internal-wiki,owner: soc-l2and the like, stored with the chunks so search results show where a passage came from.
Embedding runs gateway-side; a local model does about 1,000 chunks in a few minutes.
Search test
Type a question and see which passages it hits, with score and source, to check chunking and phrasing. Low hit rates usually mean long documents without headings, or wording far from the document's.
What to put in
| Kind | Example | Used by |
|---|---|---|
| Incident playbooks / SOPs | Ransomware response, compromised-host isolation | Investigation and triage recommendations |
| Environment notes | "10.30.9.5 is the Zabbix node; its port probes are normal" | False-positive assessment in triage and investigation |
| Detection conventions | Rule naming, severity definitions, ATT&CK mapping habits | Detection-rule generation |
| Cluster runbooks | Shard strategy, ILM conventions | Platform health AI read |
Environment notes pay off most: which host is the monitoring node, which subnet is the jump host. The model has no other way to know.
Changing the embedding model
A model with a different dimension cannot reuse the old index; saving is refused with "the KB index is X dims, the current model is Y". Delete .rst_copilot_kb, rebuild, re-upload.