---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Playbook for successful VPN attempts from service accounts

# Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

This playbook provides systematic remediation steps to investigate incidents that track successful login attempts from service accounts through VPN. Service accounts aren't supposed to have login events from a VPN, and such
events could be indicators of either brute force or possible exposure of the account's credentials.
* **[Set up the Successful VPN Attempts from the Service Accounts playbook](https://servicenow-prod.fluidtopics.net/FLAZKxBWp3M5wIsfREJ~5Q)**   
  Use the following steps to set up the Successful VPN Attempts from the Service Accounts playbook.
* **[Use the Successful VPN Attempts from the Service Accounts playbook](https://servicenow-prod.fluidtopics.net/PkXej7hCn6jrG~sGfw0ZCQ)**   
  Use this playbook to investigate incidents that track successful login attempts from service accounts through VPN. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Successful VPN Attempts from the Service Accounts playbook.