Playbook for Endpoint Detection
concept australia Updated Sep 10, 2026 1 min read playbook-endpoint-detection.md
This playbook provides systematic remediation steps to investigate malware alerts triggered on a host or endpoint (For example, a malicious file detection).
When CrowdStrike alerts are triggered on a host or endpoint, you can use the Endpoint Detection playbook in the Flow Designer for guidance and help optimize the investigation of these malicious files.
- Set up the Endpoint Detection playbook
Use the following steps to set up the Endpoint Detection playbook. - Use the Endpoint Detection playbook
Use this playbook to investigate malware alerts triggered on a host or endpoint. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Endpoint Detection playbook.
Parent Topic:Flow-based Playbooks
28 lines · 2.0 KB
--- title: Playbook for Endpoint Detection description: This playbook provides systematic remediation steps to investigate malware alerts triggered on a host or endpoint \(For example, a malicious file detection\). locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/playbook-endpoint-detection.html release: australia product: Security Incident Response classification: security-incident-response topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 1 breadcrumb: [Flow-based Playbooks, Security Incident Response playbooks, Playbook Resources, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Playbook for Endpoint Detection This playbook provides systematic remediation steps to investigate malware alerts triggered on a host or endpoint \(For example, a malicious file detection\). When CrowdStrike alerts are triggered on a host or endpoint, you can use the Endpoint Detection playbook in the Flow Designer for guidance and help optimize the investigation of these malicious files. - **[Set up the Endpoint Detection playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-setup-endpoint-detection.md)** Use the following steps to set up the Endpoint Detection playbook. - **[Use the Endpoint Detection playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-using-endpoint-detection.md)** Use this playbook to investigate malware alerts triggered on a host or endpoint. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Endpoint Detection playbook. **Parent Topic:**[Flow-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-flow-based.md)
| title | Playbook for Endpoint Detection |
| description | This playbook provides systematic remediation steps to investigate malware alerts triggered on a host or endpoint \(For example, a malicious file detection\). |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/playbook-endpoint-detection.html |
| release | australia |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| breadcrumb | Flow-based PlaybooksSecurity Incident Response playbooksPlaybook ResourcesSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |