---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Playbook for successful VPN attempts from service accounts

# Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
This playbook provides systematic remediation steps to investigate incidents that track successful login attempts from service accounts through VPN. Service accounts aren't supposed to have login events from a VPN, and such
events could be indicators of either brute force or possible exposure of the account's credentials.
* **[Set up the Successful VPN Attempts from the Service Accounts playbook](https://www.servicenow.com/docs/DmflS7NwZ_gfk~2WLWHxIg)**   
  Use the following steps to set up the Successful VPN Attempts from the Service Accounts playbook.
* **[Use the Successful VPN Attempts from the Service Accounts playbook](https://www.servicenow.com/docs/kOXdcMkLsVbpxJNXSgRlvA)**   
  Use this playbook to investigate incidents that track successful login attempts from service accounts through VPN. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Successful VPN Attempts from the Service Accounts playbook.