{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44894,"path":"security-management/security-incident-response/security-incident-playbook.md","title":"Security Incident Playbook","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Incident Playbook\n\nInvoke the security incident playbook flow automatically or manually.\n\nA Playbook is visible only if at least one playbook is associated with a security incident. The playbook component works only for the Process Automation Designer \\(PAD\\) built processes and not for the flow designer-built flows. For the existing flow designer enabled flows, it will continue to work, and the activities will be continuing to be rendered as response tasks.\n\nThere are two ways of associating playbook with the security incident:\n\n-   Automatically invoke playbook\n-   Manually add playbook\n\n## Invoke playbook automatically\n\nFor a Playbook to be invoked automatically, a process needs to be defined using **Process Automation Designer \\(PAD\\)**, and when the trigger condition is met then automatically the playbook tab is rendered with the playbook activities being displayed.\n\n## Add playbook manually\n\nFor a Playbook to be invoked manually, navigate to the Form UI action drop down and select **Add Playbook**. For more information see, [Add Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/security-incident-playbook.md)\n\n**Note:** If there is already a playbook available then the new playbooks added will run in parallel to the existing playbooks.\n\n-   Within the playbook, the analyst can filter the playbook cards by status.\n-   The analyst can cancel a playbook by selecting it from the ellipse icon.\n-   Within each activity, the analyst will be able to perform the actions defined within the activity cards such as Skip, Mark as complete, Cancel, or Orchestration actions such as Submit to sandbox, Search Emails and so on.\n-   Each of these actions are defined within the activity definition, and the complete card visible is customizable at the time of building the activity definition itself.\n\n**Note:** All the future activity definitions and the next steps to be performed are displayed with a lock icon and are in read-only mode to the user. The playbook display mode is controlled by a configuration as explained below.\n\n1.  Navigate to **All** > **Playbook Experiences**.\n2.  In the Playbook Experiences page, select an **SIR Playbook Experience**.\n\n    \\[Omitted image \"playbook-experience.png\"\\] Alt text: The Security Incident Playbook experience\n\n    The **Playbook Experience SIR Playbook Experience** page is displayed.\n\n    \\[Omitted image \"playbook-expereince-record.png\"\\] Alt text: Editing the SIR Playbook Experience record\n\n3.  Select the **Configuration** record.\n4.  In the Configuration tab, select the SIR Playbook Experience Configuration.\n\n    \\[Omitted image \"playbook-config-record.png\"\\] Alt text: Edit the Playbook Configuration\n\n5.  Navigate to the **Pending Item Visibility** field's drop down list, select the desired option and save the record. Choose from the following options:\n    -   **Hide pending activities**: Select this option to hide the pending activities that you would like to see on the playbook section of the workspace.\n\n        \\[Omitted image \"playbook-hide-pending-activities.png\"\\] Alt text: Hide pending activities in Phishing Manual playbook.\n\n    -   **Show pending stages and activities**: Select this option to show pending stages and activities that you would to like to see on the playbook section of the workspace.\n\n        \\[Omitted image \"playbook-show-pending-stages.png\"\\] Alt text: Show pending stages and activities in Phishing Manual playbook\n\n    -   **Hide pending activities and stages**: Select this option to hide pending activities and stages,that you would like to see on the playbook section of the workspace.\n\n        \\[Omitted image \"playbook-hide-pending-activities-stages.png\"\\] Alt text: Hide pending activities and stages in Phishing Manual playbook\n\n6.  On the Playbook section, use the filter option to filter the activities by Playbook card status \\(activity definition\\).\n\n    \\[Omitted image \"playbook-card-status-filters.png\"\\] Alt text: Playbook card status\n\n\n**Parent Topic:**[Using SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/using-sir-workspace.md)\n\n**Related topics**  \n\n\n[Using ServiceNow Otto for Security Incident Response \\(SIR\\) generative AI skills]()\n\n[Using agentic AI workflows]()\n\n[Working with Security Incident Records]()\n\n[Prerequisites for the Playbooks]()\n\n[Rebuilding existing playbooks in Workflow Studio]()\n\n[Activity Definitions]()\n\n[Sample Playbooks for SIR Workspace]()\n\n[Working with MSI Records]()\n\n[Working with Form UI actions]()\n\n[Security Incident Closure workflow]()\n\n[Handle security incidents using Advanced Work Assignment]()\n\n## Add Playbook\n\nUse this section to add playbook manually.\n\n### Before you begin\n\nRole required: sn\\_si.analyst\n\n### Procedure\n\n1.  Navigate to **All** > **Security Incident** > **Security Analyst Workspace**.\n\n2.  Open an incident record.\n\n3.  Select **Add Playbook**.\n\n    \\[Omitted image \"manually-invoke-playbook.png\"\\] Alt text: Add a playbook manually\n\n    The **Add Playbook** dialogue box is displayed.\n\n    \\[Omitted image \"manually-invoke-playbook1.png\"\\] Alt text: Add playbook\n\n4.  Select the playbook template.\n\n5.  Select **Add Playbook**.\n\n    A confirmation message dialogue box is displayed for you to confirm.\n\n6.  Select **Add Anyway**.\n\n    \\[Omitted image \"addanyway-button.png\"\\] Alt text: Confirmation message\n\n7.  The **Playbook** gets added next to the **Details** tab.\n\n    \\[Omitted image \"playbook-attached.png\"\\] Alt text: Playbook confirmation message\n\n8.  Select the **Playbook** tab.\n\n    \\[Omitted image \"playbook-tasks.png\"\\] Alt text: Playbook activities\n\n9.  Perform the series of activities as listed to move to the next level.\n\n    **Note:** If a Security incident is associated with a playbook, until the associated playbook gets closed or cancelled the user cannot again associate the same playbook to the same security incident.\n\n\n"}}