> ## Documentation Index
> Fetch the complete documentation index at: https://helpdocs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Runbook Recommender

> Match a ticket against the desk's approved runbooks and post up to three runbook links as a single internal note — only when the fit is confident; otherwise post nothing.

<Info>
  **Category:** Documentation · [View source ↗](https://github.com/bryan-getthread/skills/blob/main/skills/documentation/runbook-recommender/SKILL.md)
</Info>

**Connectors:** `Runbooks`

**Role:** [Technician](/start-here/roles/technician)

**Outcome:** Time & Cost Savings (Capacity), Fewer Escalations & Less Noise

**When to use:** "Is there a runbook for this?" on an open ticket, or embedded in a Flow on ticket creation/assignment to pre-load the tech with the right procedure before dispatch.

**Run it:** on one ticket · or as a Flow (triggered when a ticket is created or assigned).

## Prompt

```
Point the assigned technician at the right approved runbook(s) for the ticket in
front of them. A wrong runbook is worse than no recommendation — silence beats a guess.

1. Read the ticket's symptom, category, and client context.

2. Match it against the desk's approved runbooks; cross-check the runbooks already
   attached to the ticket and, if the match looks thin, search the runbook library on
   the key symptom terms.

3. Keep only HIGH-CONFIDENCE matches: the runbook's stated scope clearly covers this
   symptom and environment. Discard keyword-only coincidences. Cap at 3 runbooks,
   best first.

4. Get each runbook's link. Never fabricate a runbook name or link; only link what the
   runbook library actually returned. Recommend only — never open, execute, or fill a
   runbook form on the tech's behalf.

5. Post ONE internal note containing all recommendations — plain text (PSA-safe, no
   markdown, no emojis), one line per runbook: runbook name, one-clause reason it fits,
   link. Never post multiple notes, and never post to the client-visible thread.

6. If no runbook clears the confidence bar, post nothing and (in attended chat) say
   no confident match was found. When in doubt, do nothing.

DEGRADATION: the runbook tools exist only in the in-app SuperAgent. If runbooks are
unavailable (external setup), fall back to the knowledge base and present matching KB
articles the same way — clearly labeled as KB articles, not runbooks.

UNATTENDED (Flow): your entire reply is posted verbatim as the internal note — no
narration, no preamble, no sign-off. One line per runbook (max 3): "Runbook: <name> -
<one-clause fit reason> - <link>". Output NOTHING at all (empty reply) when no runbook
clears high confidence, the tools error or are unavailable, or the ticket already has
a runbook note from a previous run (check existing internal notes first — never
duplicate). Never make any write other than the single internal note; never change
status, assignee, or priority.
```


## Related topics

- [Alert Runbooks](/skill-library/alert-runbooks/overview.md)
- [Vendor Runbooks](/skill-library/vendor-runbooks/overview.md)
- [EDR Detection Runbook](/skill-library/security/edr-detection-runbook.md)