---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/ja-JP/security-management

 Release :

    - brazil

ft:locale :

    - ja-JP

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Sample Playbooks for SIR Workspace

# Sample Playbooks for SIR Workspace {#ariaid-title1}

リリースバージョン: Brazil  
更新日 2026年09月10日  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 所要時間：1分  
You can create or configure playbooks for SIR Workspace quickly and easily without writing complicated code. You can use these playbooks to resolve security threats in a step-by-step manner. You can invoke the security incident
playbook flow automatically or manually.  
The Security Incident Response provides the following playbooks with the base system:

* [Playbook for Manual Phishing](https://www.servicenow.com/docs/4GPPqjYJd9MAAaiv~loO9Q "The Manual Phishing Playbook provides step-by-step guidance for your analysts on how they can manually resolve specific types of security threats in your phishing activities.")
* [Playbook for Automated Phishing](https://www.servicenow.com/docs/3Eycl5V6uWOcncXfFNScug "The Automated Phishing playbook provides step-by-step guidance for your analysts on how they could resolve specific types of security threats in your Automated Phishing activities.")
* [Playbook for Manual Malware](https://www.servicenow.com/docs/Fp2cdLgnrbBh~1NwZalBWA "The Manual Malware playbook provides step-by-step guidance on how analysts can manually resolve malware alerts more efficiently.")
* [Playbook for Automated Malware](https://www.servicenow.com/docs/~sOaLLu3zdjMG216PGhvYQ "The Automated Malware playbook provides a sequence of automated steps that helps analysts resolve malware alerts more efficiently.")
* [Playbook for Failed Login Manual](https://www.servicenow.com/docs/7QT869agqhuZBTVjDMxu_Q "The Failed Login Manual playbook provides guidance and helps optimize the investigation of failed login security incidents.")
{#sir-workspace-playbooks__ul_tcp_3ly_gzb}
**関連概念**   

* [Using ServiceNow Otto for Security Incident Response (SIR) generative AI skills](https://www.servicenow.com/docs/71QO5KGhh7OVMoBM6TmjkA "Security analysts can close security incidents quickly from within their flow of work with the generative AI skills supported by ServiceNow Otto for Security Incident Response (SIR).")
* [Using agentic AI workflows](https://www.servicenow.com/docs/xnNOAkmjaUJCQkmIOgpaPg "Use the Security Incident Response AI agentic workflows to complete security incident tasks.")
* [Working with Security Incident Records](https://www.servicenow.com/docs/I3HIi7nHjazYpB6C5IuTow "The Security Incident Record consists of the following.")
* [Security Incident Playbook](https://www.servicenow.com/docs/wvCmAKZTRMGnHRg8EOHBLA#security-incident-playbook "Invoke the security incident playbook flow automatically or manually.")
* [Prerequisites for the Playbooks](https://www.servicenow.com/docs/z0W0DrA9MfzrpK0SjGPB8g "You need the following roles and plugins to build the Playbooks.")
* [Rebuilding existing playbooks in Workflow Studio](https://www.servicenow.com/docs/ejmCpesRbqDRr948ANFRDQ "You can’t convert existing flows directly into playbooks in Workflow Studio. Each flow designer step that creates a response task to guide the analyst must be broken down into separate actions or subflows.")
* [Activity Definitions](https://www.servicenow.com/docs/uVSlSvfaQMFxq1ijLz9Xog "The ServiceNow AI Platform provides a few activity definitions within the base system. In addition, for the playbooks that SIR Workspace base system, there are a few activity definitions defined in the base system under Enterprise Security Case Management PAD Commons application.")
* [Working with MSI Records](https://www.servicenow.com/docs/WZDGdQBEQ6ehZFQ4ZQ3WbQ "Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization.")
* [Working with Form UI actions](https://www.servicenow.com/docs/6oXOmWSbzSJyTeIYkEl6ww "Following are the UI actions that are displayed on the security incident form.")  
**関連タスク**   

* [Security Incident Closure workflow](https://www.servicenow.com/docs/dOt6~lBgr8rd7B2ZqVz~KA "Close the security incident by updating the incident state.")
* [Handle security incidents using Advanced Work Assignment](https://www.servicenow.com/docs/1P~Y8kxG5~44d7zCWxqvwA "Handle security incidents assigned to you in SIR Workspace using Advanced Work Assignment.")