Playbook for User Deleting Bash History - Cloud
concept australia Updated Sep 10, 2026 1 min read playbook-deleting-bash-history.md
This playbook provides systematic remediation steps to investigate incidents that indicate if someone was trying to remove the bash history (.bash_history) file from a Linux server.
Note: You need to mitigate this alert cautiously, as this alerts gets rarely triggered and it potentially indicates an insider threat.
- Set up the User Deleting Bash History playbook
Use the following steps to set up the User Deleting Bash History playbook. - Use the User Deleting Bash History playbook
Use this playbook to investigate incidents that indicate if someone was trying to remove the bash history file from a Linux server. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the User Deleting the Bash History (.bash_history) playbook.
Parent Topic:Flow-based Playbooks
28 lines · 2.1 KB
--- title: Playbook for User Deleting Bash History - Cloud description: This playbook provides systematic remediation steps to investigate incidents that indicate if someone was trying to remove the bash history \(.bash\_history\) file from a Linux server. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/playbook-deleting-bash-history.html release: australia product: Security Incident Response classification: security-incident-response topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 1 breadcrumb: [Flow-based Playbooks, Security Incident Response playbooks, Playbook Resources, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Playbook for User Deleting Bash History - Cloud This playbook provides systematic remediation steps to investigate incidents that indicate if someone was trying to remove the bash history \(`.bash_history`\) file from a Linux server. **Note:** You need to mitigate this alert cautiously, as this alerts gets rarely triggered and it potentially indicates an insider threat. - **[Set up the User Deleting Bash History playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-setup-deleting-bash-history.md)** Use the following steps to set up the User Deleting Bash History playbook. - **[Use the User Deleting Bash History playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-using-deleting-bash-history.md)** Use this playbook to investigate incidents that indicate if someone was trying to remove the bash history file from a Linux server. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the User Deleting the Bash History \(`.bash_history`\) playbook. **Parent Topic:**[Flow-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-flow-based.md)
| title | Playbook for User Deleting Bash History - Cloud |
| description | This playbook provides systematic remediation steps to investigate incidents that indicate if someone was trying to remove the bash history \(.bash\_history\) file from a Linux server. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/playbook-deleting-bash-history.html |
| release | australia |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| breadcrumb | Flow-based PlaybooksSecurity Incident Response playbooksPlaybook ResourcesSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |