---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Playbook for User Deleting Bash History - Cloud

# Playbook for User Deleting Bash History - Cloud {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
This playbook provides systematic remediation steps to investigate incidents that indicate if someone was trying to remove the bash history (.bash_history) file from a Linux server.  
Note:  
You need to mitigate this alert cautiously, as this alerts gets rarely triggered and it potentially indicates an insider threat.
* **[Set up the User Deleting Bash History playbook](https://www.servicenow.com/docs/PzPG~QHsIey2gLbwIcieQQ)**   
  Use the following steps to set up the User Deleting Bash History playbook.
* **[Use the User Deleting Bash History playbook](https://www.servicenow.com/docs/9j978IzfqJU0QtdJRszyKw)**   
  Use this playbook to investigate incidents that indicate if someone was trying to remove the bash history file from a Linux server. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the User Deleting the Bash History (.bash_history) playbook.