---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/security-management

 Release :

    - australia

ft:locale :

    - pt-BR

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Playbook for successful VPN attempts from service accounts

# Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud {#ariaid-title1}

* Versão de lançamento: Australia
* 
* Atualizado 12 de mar. de 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 min. de leitura

This playbook provides systematic remediation steps to investigate incidents that track successful login attempts from service accounts through VPN. Service accounts aren't supposed to have login events from a VPN, and such
events could be indicators of either brute force or possible exposure of the account's credentials.
* **[Set up the Successful VPN Attempts from the Service Accounts playbook](https://servicenow-prod.fluidtopics.net/Mtvn1Qy3_ilBy_A6sIDatQ)**   
  Use the following steps to set up the Successful VPN Attempts from the Service Accounts playbook.
* **[Use the Successful VPN Attempts from the Service Accounts playbook](https://servicenow-prod.fluidtopics.net/3fhg7obALjCSrMS4ON6iZg)**   
  Use this playbook to investigate incidents that track successful login attempts from service accounts through VPN. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Successful VPN Attempts from the Service Accounts playbook.