---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Add the Threat Hunting Playbook to a Case

# Add the Threat Hunting Playbook to a Case {#ariaid-title1}

* Release version: Australia
* 
* Updated May 20, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

If a Case does not meet the auto-trigger conditions for the Threat Hunting playbook, you can attach the playbook to the Case manually.

## Before you begin

Role required: sn_sec_tisc.analyst

The Case must be open. You can't add the Threat Hunting playbook to a closed Case.

## About this task

Use this procedure when the Threat Hunting playbook doesn't auto-trigger but you still want to run a threat hunt. For example, you want to run it when the Case Type is not Threat Hunting.

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security Center.
2. Select the Threat Analyst Workbench icon.
3. Go to Case ManagementAll Cases.  
   All the cases are displayed.
4. Open a Case record and select ![More actions]()Add Playbook.
5. Select Threat Hunting from the list of available playbooks.
6. Review the confirmation dialog and confirm the addition.  
   Important:  
   Adding a playbook can result in repetition of the activities completed on the Case, for example, MITRE techniques associated or scenarios entered.

## Result

The Threat Hunt Playbook is attached to the Case and initiates the Intake stage. For details on each stage, see [Use the Threat Hunting Playbook](https://servicenow-prod.fluidtopics.net/n2yAquNl9roiQ0pbDZmnNg "Run threat hunt on a Case record — from capturing the hunt hypothesis through to creating a Security incident or reporting.").
**Related concepts**   

* [Threat Hunting Playbook](https://servicenow-prod.fluidtopics.net/GtI0yd~gKqu7478zSss2aQ "The Threat Hunting playbook is a guided workflow for a TISC Case record that helps analysts move a threat hunt from an initial hypothesis to a final outcome.")

*[\>]: and then