{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44539,"path":"security-management/security-incident-response/getting-started-phishing-playbook.md","title":"Activate a Security Incident Response flow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Activate a Security Incident Response flow\n\nSecurity administrators and flow designers can use the Security Incident Response flows to automate the process of resolving security incidents in the organization.\n\n## Before you begin\n\nRole required: sn\\_si.admin, action\\_designer, and flow\\_designer\n\n## About this task\n\nThe flows provided with the base system are in an inactive state. Activate these flows before you use them.\n\n## Procedure\n\n1.  [Download and install](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/download-app-first-time.md) the Security Operations Spoke application.\n\n    This Spoke application provides security operations actions that you can use while defining Security Incident Response flows.\n\n2.  Navigate to **Flow Designer** > **Designer** and search for the Security Operations Spoke application to view the Security Incident related flows.\n\n    \\[Omitted image \"cj-sir-flow-phishing.png\"\\] Alt text: Security Incident Management SpokesNotice that the flows have a published status and are inactive.\n\n3.  For example, if you want to activate the Automated Malware Playbook flow, select the **Security Incident - Automated Phishing Playbook - Template V1** link to view the flow.\n\n    \\[Omitted image \"cj-sir-flow-auto.png\"\\] Alt text: Automated Phishing Playbook Template\n\n    **Note:** You cannot edit the flows provided with the base system as they are read-only flows. You can use these flows as they are or make a copy and modify them as required.\n\n4.  Select **Activate** to activate the flow.\n\n\n## Result\n\nThe Automated Phishing Playbook flow is active and ready to use.\n\n"}}