{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44768,"path":"security-management/security-incident-response/playbook-setup-spoofed-emails.md","title":"Set up the Spoofed Emails playbook","bundle":null,"doc_type":null,"release":"australia","body":"\n# Set up the Spoofed Emails playbook\n\nUse the following steps to set up the Spoofed Emails playbook.\n\n## Before you begin\n\nRole required:\n\n-   sn\\_si.admin\n-   flow\\_designer\n\nMake sure you have installed Security Operations Spoke \\(`sn_sec_spoke`\\).\n\n## Procedure\n\n1.  Login as a user with sn\\_si.user and flow\\_designer roles.\n\n2.  Navigate to **All** > **Flow Designer** and select the **Spoofed Emails \\(using the same Display name\\)** playbook.\n\n3.  You can create a copy of the Repeat Detection playbook flow and make the necessary modifications.\n\n    To create a copy of the playbook's flow, select the \\[Omitted image \"more-action-menu.png\"\\] Alt text: More actions menu icon and select **Copy flow**. Perform this step only if you plan to customize or make specific changes to the flow.\n\n4.  Activate the playbooks.\n\n    -   Activate the main flow to use the playbook available in the base system.\n    -   Activate the copied flows after making the required changes.\n5.  Set a **Trigger Condition** for the playbook.\n\n    This playbook is triggered and associated with the security incident when the **Category** is **Phishing**.\n\n\n**Parent Topic:**[Playbook for Spoofed Emails \\(using the same Display name\\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-spoofed-emails-display-name.md)\n\n"}}