Operational runbooks

Identifies operational, maintenance and on-call runbooks, operations manuals and troubleshooting guides containing numbered steps, shell/admin commands or internal hosts. Titles alone are discovery-only. Substantially overlaps global-it-runbook-playbook (same structures); candidate for merge.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: titles are discovery-only; enforcement requires numbered steps, commands or hosts, and 85 adds a second structure and operational context.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:operational\s+runbooks?|operations\s+runbooks?|runbook\s+procedures?|maintenance\s+runbooks?|on[\s-]call\s+(?:playbook|runbook|handbook)s?|operations\s+manual|troubleshooting\s+guide|escalation\s+procedures?)\b

Corroborative evidence keywords

rollback, expected output, health check, escalate, maintenance window

Proximity: 300 characters

Should match

Operational runbook - nightly batch failure (payments) Host: batch01.example.internal Step 1: Check the job log in /var/log/batch/settlement.log. Step 2: Rerun with sudo systemctl restart settlement-batch. If the rerun fails, escalate to the payments on-call lead; rollback is not required. — High tier (85) - host, numbered steps and command with escalation/rollback wording
Maintenance runbook for the badge readers: controller acs-ctl01.corp at 10.9.1.5 must be rebooted after firmware loads. — Medium tier (75) - host structure only
Troubleshooting guide - Step 3: clear the print spooler queue before restarting the service. — Medium tier (75) - numbered step only
The operations manual for the new call centre is still in draft. — Discovery tier (65) - title only

Should not match

Guidance note: an operational runbook should list numbered steps and an escalation path; teams should review them yearly. — Guidance text
Operational runbook template Host: ______ Step 1: ______ Escalation: ______ — Blank template
Training course: the troubleshooting guide for the demo lab uses kubectl get pods to show pod status. — Training framing with a command must not enforce
The incident response team met on Monday. — Incident response wording no longer part of this primary

Known false positives

Runbook-writing guidance, ITSM training material and vendor documentation describe steps and commands generically. Mitigation: Titles are discovery-only; enforcement needs populated steps, commands or internal hosts, and guidance/training/template framing is excluded.
Overlap with global-it-runbook-playbook, which uses the same structures. Mitigation: Deploy one of the two; merge recommended.