---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Set up the playbook

# Set up the OSquery of External Address in the /etc/hosts file playbook {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Use the following steps to set up the OSquery of External Address in the /etc/hosts file playbook.

## Before you begin

Role required:

* sn_si.admin
* flow_designer
{#playbook-setup-osquery-external-address__ul_ub3_m35_xzb}

Make sure you have installed Security Operations Spoke (sn_sec_spoke).

## Procedure

1. Login as a user with sn_si.user and flow_designer roles.
2. Navigate to AllFlow Designer and select the OSquery External Address in /etc/hosts playbook.
3. **Optional:** Create a copy of the OSquery External Address in /etc/hosts playbook flow and make the necessary modifications.  
   To create a copy of the playbook's flow, select the ![More actions menu]() icon and select Copy flow. Perform this step only if you plan to customize or make specific changes to the flow.
4. Activate the playbooks.
   1. Activate the main flow to use the playbook available in the base system.
   2. Activate the copied flows after making the required changes.
   {#playbook-setup-osquery-external-address__substeps_szx_rp1_f1c}
5. Set a Trigger Condition for the playbook.  
   This playbook is triggered and associated with the security incident when the Category is Insider Breach.

*[\>]: and then