{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44766,"path":"security-management/security-incident-response/playbook-setup-possible-password-spray.md","title":"Set up the Possible Password Spray playbook","bundle":null,"doc_type":null,"release":"australia","body":"\n# Set up the Possible Password Spray playbook\n\nUse the following steps to set up the Possible Password Spray playbook.\n\n## Before you begin\n\nRole required:\n\n-   sn\\_si.admin\n-   flow\\_designer\n\nMake sure you have installed Security Operations Spoke \\(`sn_sec_spoke`\\).\n\n## Procedure\n\n1.  Login as a user with sn\\_si.user and flow\\_designer roles.\n\n2.  Navigate to **All** > **Flow Designer** and select the **Possible Password Spray** playbook.\n\n3.  You can create a copy of the Possible Password Spray playbook flow and make the necessary modifications.\n\n    To create a copy of the playbook's flow, select the \\[Omitted image \"more-action-menu.png\"\\] Alt text: More actions menu icon and select **Copy flow**. Perform this step only if you plan to customize or make specific changes to the flow.\n\n4.  Activate the playbooks.\n\n    -   Activate the main flow to use the playbook available in the base system.\n    -   Activate the copied flows after making the required changes.\n5.  Set a **Trigger Condition** for the playbook.\n\n    This playbook is triggered and associated with the security incident when the following conditions are met:\n\n    -   **Category** is **Unauthorized access**.\n    -   **Sub-category** is **Brute force password cracking attempts**.\n\n**Parent Topic:**[Playbook for Possible Password Spray](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-possible-password-spray.md)\n\n"}}