A method and program product for receiving an indication of a particular root cause associated with an error condition in an information technology (IT) system, electronically capturing activity of an operator for the IT system, automatically generating a workflow portion for a generic runbook, and storing the generic runbook in a manner that allows retrieval of the generic runbook.