The present invention is directed towards systems and methods for automating runbook documentation. The method according to one embodiment of the present invention comprises receiving a network event and determining whether the event is a known or unknown event. The method comprises executing a policy associated with the event if the event is known event. The method comprises passing the event to the operator for review against a database of existing runbooks if the event is an unknown event. The method comprises executing an existing policy if the operator identifies a runbook for the runbook event. The method comprises requesting a new policy for the event if the operator does not identify an existing runbook for the event.