---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Security Incident Response playbooks

# Security Incident Response playbooks {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

You can invoke the security incident playbook flow automatically or manually.

A Playbook is visible only if at least one playbook is associated with a security incident. The playbook component works only for the Process Automation Designer (PAD) built processes and not for the flow designer-built flows. For
the existing flow designer enabled flows, it will continue to work, and the activities will be continuing to be rendered as response tasks.  
Security Incident Response supports two types of Playbooks:

* [Process-based Playbooks](https://servicenow-prod.fluidtopics.net/LkZduuZBVFhMT6HG3e~MUg "The playbook component works only for playbooks built in Workflow Studio and not for flows. However, existing flow-based playbooks will continue to work and the activities will be continuing to be rendered as response tasks.")
* [Flow-based Playbooks](https://servicenow-prod.fluidtopics.net/Qa8wU41p3~~e0e0kflu_5g "Using the Flow Designer, security administrators and flow design authors can more easily transition from manual or undocumented playbooks to automated and repeatable playbooks. The drag-and-drop feature provides flexibility in moving objects, condition checks, parallel branching, decision tables, and more.")
{#cj-sir-about-flows__ul_mf2_bry_gzb}

In addition to the listed playbooks, there are also subflows in Security Operations Spoke that
can be called from the flows playbook. Ransomware is one of that subflows.

Activate these flows before you use them. For more information, see [Activate a Security Incident Response
flow](https://servicenow-prod.fluidtopics.net/zd8dhEwVzoxKo5rJ_GDPIg "Security administrators and flow designers can use the Security Incident Response flows to automate the process of resolving security incidents in the organization.").
* **[Process-based Playbooks](https://servicenow-prod.fluidtopics.net/LkZduuZBVFhMT6HG3e~MUg)**   
  The playbook component works only for playbooks built in Workflow Studio and not for flows. However, existing flow-based playbooks will continue to work and the activities will be continuing to be rendered as response tasks.
* **[Flow-based Playbooks](https://servicenow-prod.fluidtopics.net/Qa8wU41p3~~e0e0kflu_5g)**   
  Using the Flow Designer, security administrators and flow design authors can more easily transition from manual or undocumented playbooks to automated and repeatable playbooks. The drag-and-drop feature provides flexibility in moving objects, condition checks, parallel branching, decision tables, and more.