Playbook for Possible Password Spray
concept australia Updated Sep 10, 2026 1 min read playbook-possible-password-spray.md
This playbook provides systematic remediation steps to investigate password spray alerts triggered by multiple failed logins (too many authentication failures from more than one IP address for the same user).
- Set up the Possible Password Spray playbook
Use the following steps to set up the Possible Password Spray playbook. - Use the Possible Password Spray playbook
Use this playbook to investigate password spray alerts triggered by multiple failed logins (too many authentication failures from more than one IP address for the same user). The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Possible Password Spray playbook.
Parent Topic:Flow-based Playbooks
26 lines · 2.1 KB
--- title: Playbook for Possible Password Spray description: This playbook provides systematic remediation steps to investigate password spray alerts triggered by multiple failed logins \(too many authentication failures from more than one IP address for the same user\). locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/playbook-possible-password-spray.html release: australia product: Security Incident Response classification: security-incident-response topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 1 breadcrumb: [Flow-based Playbooks, Security Incident Response playbooks, Playbook Resources, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Playbook for Possible Password Spray This playbook provides systematic remediation steps to investigate password spray alerts triggered by multiple failed logins \(too many authentication failures from more than one IP address for the same user\). - **[Set up the Possible Password Spray playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-setup-possible-password-spray.md)** Use the following steps to set up the Possible Password Spray playbook. - **[Use the Possible Password Spray playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-using-possible-password-spray.md)** Use this playbook to investigate password spray alerts triggered by multiple failed logins \(too many authentication failures from more than one IP address for the same user\). The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Possible Password Spray playbook. **Parent Topic:**[Flow-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-flow-based.md)
| title | Playbook for Possible Password Spray |
| description | This playbook provides systematic remediation steps to investigate password spray alerts triggered by multiple failed logins \(too many authentication failures from more than one IP address for the same user\). |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/playbook-possible-password-spray.html |
| release | australia |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| breadcrumb | Flow-based PlaybooksSecurity Incident Response playbooksPlaybook ResourcesSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |