{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44339,"path":"security-management/security-incident-response/cj-sir-about-flows.md","title":"Security Incident Response playbooks","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Incident Response playbooks\n\nYou can invoke the security incident playbook flow automatically or manually.\n\nA Playbook is visible only if at least one playbook is associated with a security incident. The playbook component works only for the Process Automation Designer \\(PAD\\) built processes and not for the flow designer-built flows. For the existing flow designer enabled flows, it will continue to work, and the activities will be continuing to be rendered as response tasks.\n\nSecurity Incident Response supports two types of Playbooks:\n\n-   [Process-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbooks-process-based.md)\n-   [Flow-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-flow-based.md)\n\nIn addition to the listed playbooks, there are also subflows in Security Operations Spoke that can be called from the flows playbook. Ransomware is one of that subflows.\n\nActivate these flows before you use them. For more information, see [Activate a Security Incident Response flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/getting-started-phishing-playbook.md).\n\n-   **[Process-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbooks-process-based.md)**  \nThe playbook component works only for playbooks built in Workflow Studio and not for flows. However, existing flow-based playbooks will continue to work and the activities will be continuing to be rendered as response tasks.\n-   **[Flow-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-flow-based.md)**  \nUsing the Flow Designer, security administrators and flow design authors can more easily transition from manual or undocumented playbooks to automated and repeatable playbooks. The drag-and-drop feature provides flexibility in moving objects, condition checks, parallel branching, decision tables, and more.\n\n**Parent Topic:**[Playbook Resources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/cj-sir-flow-library.md)\n\n"}}