Case playbook
A case playbook runs across a whole case rather than a single alert. It suits steps that depend on everything in the case, such as a final review or a customer notice. Run history for it may be handled differently from alert playbooks, so check exports.
What Case playbook means
Google SecOps separates alert playbooks from case playbooks, and the two share one name space.
If you audit automation from exported data, confirm the case playbook runs are in the export.
Case playbook in Google Security Operations's own words
Google SecOps case playbooks run across a whole case container, their executions are excluded from Legacy Monitoring dashboards and SOAR data exports, and their names must be unique across alert and case playbooks. Google Security Operations documentation, read 2026-11-04