Collaborative runbook execution

A method comprising:

• detecting, by a runbook execution engine, an occurrence of an event associated with a monitored system;
• initiating by a first instance of the runbook execution engine executing on a first computing device, a runbook session for executing a set of operations specified in a runbook for remediating the event;
• presenting, by the first instance of the runbook execution engine to a first entity accessing the first computing device, a runbook execution interface for executing one or more operations among the set of operations specified in the runbook;
• receiving, by the first instance of the runbook execution engine executing on the first computing device, a first set of results corresponding to executing a first runbook operation specified in the runbook by the first entity;
• detecting, by the first instance of the runbook execution engine, a trigger to identify an alternate entity to perform a second operation of the runbook, wherein detecting the trigger comprises:
• analyzing runbook metadata stored with the first runbook to determine the first entity is prevented from performing the second operation among the set of operations specified in the runbook;
• based on detecting the trigger:
• analyzing, by the first instance of the runbook execution engine executing on the first computing device, the runbook metadata stored in association with the second operation of the runbook to identify a second entity that is permitted to perform the second operation of specified in the runbook;
• storing, by the first instance of the runbook execution engine, state information associated with execution of the runbook session at a point-in-time subsequent to receiving the first set of results, the state information comprising one or more of:
• an execution status of the one or more operations among the set of operations specified in the runbook session or the first set of results of the first operation;
• transmitting, by the first instance of the runbook execution engine, the state information associated with executing the runbook session to a second instance of the runbook execution engine running on a second computing device;
• and
• based on transmitting the state information to the second instance of the runbook execution engine:
• presenting, by the second instance of the runbook execution engine executing on the second computing device, first information to the second entity necessary to perform the second operation of the runbook session;
• receiving, by the second instance of the runbook execution engine running on the second computing device, a second set of results corresponding to executing the second runbook operation by the second entity;
• and
• updating, by the second instance of the runbook execution engine executing on the second computing device, the state information associated with executing the runbook session to indicate completion of the second operation by the second entity based at least upon receiving the second set of results,
• wherein the runbook execution engine stores authorization data specifying authority for at least one of the first entity and the second entity associated with at least one of the first set of results and the second set of results, and
• wherein the operations further comprise at least one of:
• a first set of operations comprising:
• restricting the second entity from performing a third operation associated with the first set of results based on determining, from the authorization data, that the second entity does not have the authority to perform the third operation;
• transmitting the state data, updated by the second instance of the runbook execution engine, to the first instance of the runbook execution engine;
• and
• based on receiving the state data updated by the second instance of the runbook execution engine, presenting, by the first instance of the runbook execution engine, second information to the first entity necessary to perform the third operation, and
• a second set of operations comprising:
• restricting the first entity from performing a fourth operation associated with the second set of results based on determining, from the authorization data, that the first entity does not have the authority to perform the fourth operation.

A system comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the system to perform operations comprising:
• detecting, by a runbook execution engine, an occurrence of an event associated with a monitored system;
• initiating by a first instance of the runbook execution engine executing on a first computing device, a runbook session for executing a set of operations specified in a runbook for remediating the event;
• presenting, by the first instance of the runbook execution engine to a first entity accessing the first computing device, a runbook execution interface for executing one or more operations among the set of operations specified in the runbook;
• receiving, by the first instance of the runbook execution engine executing on the first computing device, a first set of results corresponding to executing a first runbook operation specified in the runbook by the first entity;
• detecting, by the first instance of the runbook execution engine, a trigger to identify an alternate entity to perform a second operation of the runbook, wherein detecting the trigger comprises:
• analyzing runbook metadata stored with the first runbook to determine the first entity is prevented from performing the second operation among the set of operations specified in the runbook;
• based on detecting the trigger:
• analyzing, by the first instance of the runbook execution engine executing on the first computing device, the runbook metadata stored in association with the second operation of the runbook to identify a second entity that is permitted to perform the second operation specified in the runbook;
• storing, by the first instance of the runbook execution engine, state information associated with execution of the runbook session at a point-in-time subsequent to receiving the first set of results, the state information comprising one or more of:
• an execution status of the one or more operations among the set of operations specified in the runbook or the first set of results of the first operation;
• transmitting, by the first instance of the runbook execution engine, the state information associated with executing the runbook session to a second instance of the runbook execution engine running on a second computing device;
• and
• based on transmitting the state information to the second instance of the runbook execution engine:
• presenting, by the second instance of the runbook execution engine executing on the second computing device, first information to the second entity necessary to perform the second operation of the runbook session;
• receiving, by the second instance of the runbook execution engine running on the second computing device, a second set of results corresponding to executing the second runbook operation by the second entity;
• and
• updating, by the second instance of the runbook execution engine executing on the second computing device, the state information associated with executing the runbook session to indicate completion of the second operation by the second entity based at least upon receiving the second set of results,
• wherein the runbook execution engine stores authorization data specifying authority for at least one of the first entity and the second entity associated with at least one of the first set of results and the second set of results, and
• wherein the operations further comprise at least one of:
• a first set of operations comprising:
• restricting the second entity from performing a third operation associated with the first set of results based on determining, from the authorization data, that the second entity does not have the authority to perform the third operation;
• transmitting the state data, updated by the second instance of the runbook execution engine, to the first instance of the runbook execution engine;
• and
• based on receiving the state data updated by the second instance of the runbook execution engine, presenting, by the first instance of the runbook execution engine, second information to the first entity necessary to perform the third operation, and
• a second set of operations comprising:
• restricting the first entity from performing a fourth operation associated with the second set of results based on determining, from the authorization data, that the first entity does not have the authority to perform the fourth operation.