{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44737,"path":"security-management/security-incident-response/playbook-credential-sniffing.md","title":"Playbook for Credential Sniffing","bundle":null,"doc_type":null,"release":"australia","body":"\n# Playbook for Credential Sniffing\n\nThis playbook provides system remediation steps to investigate an incident involving credential sniffing activities performed through the **sys\\_installation\\_exit** table in a ServiceNow instance.\n\nThe Credential Sniffing playbook provides a script field to process the Database \\(DB\\) logins, Single sign-on \\(SSO\\), and LDAP \\(Lightweight Directory Access Protocol\\) by using the records on the **sys\\_installation\\_exit** table. These privileged scripting fields enable listening of user requests and parameters to the instances during login, including user credentials such as username and password.\n\nA malicious user may create a script to listen to the user requests and log these requests on the instance. The **sys\\_installation\\_exit** table on an instance defines the rules of processing the login and logout activities of all users on that instance.\n\n-   **[Set up the Credential Sniffing playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-setup-credential-sniffing.md)**  \nUse the following steps to set up the Credential Sniffing playbook.\n-   **[Use the Credential Sniffing playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-using-credential-sniffing.md)**  \nUse this playbook to investigate an incident involving credential sniffing activities performed through the **sys\\_installation\\_exit** table in a ServiceNow instance. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Credential Sniffing playbook.\n\n**Parent Topic:**[Flow-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-flow-based.md)\n\n"}}