---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Playbook for Possible Password Spray

# Playbook for Possible Password Spray {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

This playbook provides systematic remediation steps to investigate password spray alerts triggered by multiple failed logins (too many authentication failures from more than one IP address for the same user).
* **[Set up the Possible Password Spray playbook](https://servicenow-prod.fluidtopics.net/4SlJotlRHMjjN1c4KsdL0A)**   
  Use the following steps to set up the Possible Password Spray playbook.
* **[Use the Possible Password Spray playbook](https://servicenow-prod.fluidtopics.net/xSirTYpQC7aTkI_~GzuVgg)**   
  Use this playbook to investigate password spray alerts triggered by multiple failed logins (too many authentication failures from more than one IP address for the same user). The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Possible Password Spray playbook.