{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45015,"path":"security-management/security-incident-response/submit-to-csf-x-sandbox.md","title":"Submit to CSF X Sandbox","bundle":null,"doc_type":null,"release":"australia","body":"\n# Submit to CSF X Sandbox\n\nSubmit to CSF X Sandbox is an example of an activity definition process.\n\n## Basic\n\nThe basic details captures the name \\(label\\), application, description, Table, and from which all applications it is accessible from.\n\nAdd the Automation plan, Activity experience and submit. Once submitted, edit the document to add more details against each tab.\n\n## Automation Plan\n\nThe Automation Plan associates the backend action/subflow built using the flow designer. This example uses the **Submit to Sandbox - ESCM Activity** sub-flow.\n\n\\[Omitted image \"sandbox.png\"\\] Alt text: Activity definitions\n\n\\[Omitted image \"sandbox-auto-plan.png\"\\] Alt text: Activity Definition - Submit to CSF Sandbox\n\nThis sub-flow enables submitting the malicious observables to sandbox. It has all the input fields and output fields defined.\n\nSecurity incident is the input field.\n\n## Activity Experience\n\nIn this example, **Record** type is selected.\n\n## Associated Record\n\nAssociated record is to store the associated data pertaining to the current activity. This would capture the run time data, as well the status of the experience.\n\n-   Associated table: Flow Data\n-   Associated Record: VL\n-   Experience status table: Flow Data\n-   Experience Status record: VL\n\n## Details\n\n-   Tag Line: Send Email\n-   Icon: Envelope outline\n-   Title: **Activity** > **Activity Instance** > **Label**. Here we have selected the activity instance’s label. This dot walking will replace the label value as the title dynamically at run time.\n-   Description: VL \\(Sub-flow output is mapped\\)\n-   Pending State Title: blank\n-   Pending State Description: blank\n-   Record Fields\n-   Footer\n\n## Form\n\n-   Form View: blank\n-   Form Fields: blank\n\n## Attachments\n\nIn this example:\n\n-   Attachment Source - None\n-   Attachment Read only - Unchecked\n\n1.  Attachment Source - This is a drop down. What attachments to show on the card: those attached to the Parent Record, the Associated Record, or none.\n2.  Attachment Read only - This is a True / False. Prevent the user from renaming or deleting the existing attachments.\n\n## Features\n\nIn this example,\n\n-   Show SLA - Unchecked\n-   Show Checklist - Unchecked\n-   Is Automated - Unchecked\n\n## Playbook Actions in Activity Definition\n\nThis section has the actions that will be rendered on the activity card.\n\nThis example has Skip, View Sandbox Results, Submit to Sandbox, and Restart actions.\n\nTo add a new action to the activity card, you need to create a new record in the Playbook Actions related list present at the bottom of the page.\n\n## Playbook override\n\nNo Playbook overrides for this example.\n\n**Parent Topic:**[Activity Definitions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/build-activities.md)\n\n"}}