Step 1: From the Runbooks module home page (the Engagements tab), click Start New Engagement.
Step 2: Select the client from the Client pulldown menu.
Step 3: Select if the engagement is new or to be modified from an existing test plan.
Existing test plans are greyed out unless "Start from an existing Test Plan" is selected. These plans can be leveraged as a starting point by clicking Select next to the test plan.
To reduce the list of test plans provided, filter by tactic or test plan title in the search box.
Step 4: Click Next.
Step 5: On the Engagement Details tab, enter a title (required), a description, and any required tags. If an existing test plan was selected in the previous step, information in that test plan is populated by default and can be edited.
Click Continue.
Step 6: On the Select Procedures tab, select the procedures for this engagement by clicking the Select button next to the procedure to add. If leveraging an existing test plan, all procedures from that template are displayed in the right-hand column.
This list can be reduced by clicking the x button of the procedure to remove at the right of the box.
The procedure sequence can be adjusted by clicking and dragging the procedure to its desired line.
The list of procedures displayed on the screen can be adjusted using the provided filter options.
If required procedures have not yet been created, the engagement can be completed and procedures added later, but it is recommended to create the procedures first in RunbooksDB.
Step 7: Click Add X Procedures when finished.
Step 8: View a summary of the engagement from the Finalize Engagement tab. The title, description, tags, engagement coverage, and assigned procedures are displayed.
Click Create Engagement.
The engagement is now active and ready to be executed.
It also is now listed on the Engagements tab.
Step 1: Click View under the "Actions" column of an engagement.
Step 2: Click Submit Engagement.
Clicking Submit Engagement cannot be reversed.
The engagement is now a report, and PlexTrac redirects to the Procedures tab of the Reports module.
Submitted engagements will still be displayed in the Runbooks module, but the engagement can no longer be viewed or edited, and the link provided under the "Actions" column will open the Reports module.
Deleting a submitted engagement in Runbooks does not delete the report.
Engagements are displayed on the Engagements tab of the Runbooks module.
This view shows the engagement title, associated test plan, associated client, date the engagement was last updated, and engagement progress. Engagements can also be viewed, edited or deleted from the "Actions" column.
Engagements are identified as submitted, not submitted, or in progress.
Progress is based on the completion of contained procedures, and progress is displayed in two locations:
On the Engagements tab as a progress bar:
Within the top toolbar of the engagement's home page:
Engagements completed but not submitted will display "Not Submitted" under the 100% progress bar.
Engagements submitted become reports and are identified with a green checkmark and label and will remain listed in Runbooks until deleted.
Only engagements that are in progress can be edited. Once an engagement is submitted and becomes a report, it cannot be edited.
Step 1: Click View under the "Actions" column of an in-progress engagement.
Step 2: The engagement overview page provides information about the engagement and all included procedures.
Step 3: Click View under the "Actions" column of the procedure to update.
Step 4: Update the procedure status and finding severity by selecting the desired values from the pulldown menus.
Step 5: Add operators by clicking Managing operators. These names appear on the test plan when the runbook is submitted and becomes a report.
Step 6: Assign an operator(s) for the red and blue teams. Click Save.
Step 7: Run the execution steps for the procedure, and when completed, identify the outcomes for blue and red teams from the provided options and enter an attack source in the provided box.
Step 8: Add assets, procedure logs, attachments, and notes as needed to provide additional support and context.
Step 9: Scroll to the top of the page and click Save.
Step 10: Continue to the next procedure in the engagement by clicking the page navigation aid at the top of the page.
Procedures can be viewed and edited without leaving this page using the navigation icons at the top of the screen.
All engagement sections are contained in containers that can be collapsed or expanded for usability.
