Skip to content
Playbook for Attempted Access to Deactivated Accounts › Flow-based Playbooks › Security Incident Response playbooks › Playbook Resources › Security Incident Response › Enterprise security case management applications › Security Operations
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Set up the Attempted Access Deactivated Account playbook

Use the following steps to set up the Attempted Access Deactivated Account playbook.

Before you begin

Role required:

  • sn_si.admin
  • flow_designer

Make sure you have installed Security Operations Spoke (sn_sec_spoke).

Procedure

  1. Login as a user with sn_si.user and flow_designer roles.

  2. Navigate to All > Flow Designer and select the Attempted Access Deactivated Account playbook.

  3. Create a copy of the Attempted Access Deactivated Account playbook flow and make the necessary modifications.

    To create a copy of the playbook's flow, select the

Image omitted: more-action-menu.png
More actions menu icon and select **Copy flow**. Perform this step only if you plan to customize or make specific changes to the flow.
Image omitted: playbook-attempted-access-deactivated-overview.png
Overview of the Attempted Access to Deactivated Accounts playbook.

  1. Activate the playbooks.

    1. Activate the main flow to use the playbook available in the base system.

    2. Activate the copied flows after making the required changes.

  2. Set a Trigger Condition for the playbook.

    This playbook is triggered when the security incident is created or updated based on your required conditions. For example, when Category is Insider Breach

Image omitted: playbook-attempted-access-deactivated-trigger.png
Trigger condition for Attempted Access to Deactivated Accounts playbook.

Parent Topic:Playbook for Attempted Access to Deactivated Accounts