{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44763,"path":"security-management/security-incident-response/playbook-setup-office-malicous-file-detected.md","title":"Set up the Office Malicous File Detected playbook","bundle":null,"doc_type":null,"release":"australia","body":"\n# Set up the Office Malicous File Detected playbook\n\nUse the following steps to set up the Office Malicous File Detected playbook.\n\n## Before you begin\n\nRole required:\n\n-   sn\\_si.admin\n-   flow\\_designer\n\nMake sure you have installed Security Operations Spoke \\(`sn_sec_spoke`\\).\n\n## Procedure\n\n1.  Login as a user with sn\\_si.user and flow\\_designer roles.\n\n2.  Navigate to **All** > **Flow Designer** and select the **Office 365 - Malicious File Detected** playbook.\n\n3.  You can create a copy of the Office 365 - Malicious File Detected playbook flow and make the necessary modifications.\n\n    To create a copy of the playbook's flow, select the \\[Omitted image \"more-action-menu.png\"\\] Alt text: More actions menu icon and select **Copy flow**. Perform this step only if you plan to customize or make specific changes to the flow.\n\n4.  Activate the playbooks.\n\n    -   Activate the main flow to use the playbook available in the base system.\n    -   Activate the copied flows after making the required changes.\n5.  Set a **Trigger Condition** for the playbook.\n\n    This playbook is triggered and associated with the security incident when the **Category** is **Malicious code activity**.\n\n\n**Parent Topic:**[Playbook for Office 365 - Malicious File Detected](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-office-malicious-file-detected-.md)\n\n**Related topics**  \n\n\n[Use the Office 365 Malicious File Detected playbook]()\n\n"}}