Which statement best describes the relationship Runbooks have with components?

Which statement best describes the relationship Runbooks have with components?

• A. Runbooks establish a relationship between Events and Alerts
• B. Runbooks connect Security Incident Response Task and Knowledge Article
• C. Runbooks link Playbook Task and Workflow Trigger
• D. Runbooks relate to Indicator templates and Documents

Answer: (B)

Runbooks in this context act as the guide that ties a Security Incident Response Task to the Knowledge Article that contains the procedures. When a response task is defined, the runbook links to the knowledge article so responders have both the action plan and the authoritative instructions. This pairing supports consistent, repeatable responses and easy access to the documented steps, which is why it’s the strongest description of their relationship. Other options describe relationships that don’t align with how runbooks are typically used in IRM—linking detection components like Events and Alerts, or connecting Playbook Task to a Workflow Trigger, or tying into Indicator templates and Documents. Those associations exist in other parts of the platform, but the direct, most meaningful linkage for runbooks is between a Security Incident Response Task and the Knowledge Article that guides that task.

Runbooks in this context act as the guide that ties a Security Incident Response Task to the Knowledge Article that contains the procedures. When a response task is defined, the runbook links to the knowledge article so responders have both the action plan and the authoritative instructions. This pairing supports consistent, repeatable responses and easy access to the documented steps, which is why it’s the strongest description of their relationship.

Other options describe relationships that don’t align with how runbooks are typically used in IRM—linking detection components like Events and Alerts, or connecting Playbook Task to a Workflow Trigger, or tying into Indicator templates and Documents. Those associations exist in other parts of the platform, but the direct, most meaningful linkage for runbooks is between a Security Incident Response Task and the Knowledge Article that guides that task.