Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud
concept australia Updated Sep 10, 2026 1 min read playbook-successful-vpn-attempts.md
This playbook provides systematic remediation steps to investigate incidents that track successful login attempts from service accounts through VPN. Service accounts aren’t supposed to have login events from a VPN, and such events could be indicators of either brute force or possible exposure of the account's credentials.
- Set up the Successful VPN Attempts from the Service Accounts playbook
Use the following steps to set up the Successful VPN Attempts from the Service Accounts playbook. - Use the Successful VPN Attempts from the Service Accounts playbook
Use this playbook to investigate incidents that track successful login attempts from service accounts through VPN. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Successful VPN Attempts from the Service Accounts playbook.
Parent Topic:Flow-based Playbooks
26 lines · 2.4 KB
--- title: Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud description: This playbook provides systematic remediation steps to investigate incidents that track successful login attempts from service accounts through VPN. Service accounts aren’t supposed to have login events from a VPN, and such events could be indicators of either brute force or possible exposure of the account's credentials. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/playbook-successful-vpn-attempts.html release: australia product: Security Incident Response classification: security-incident-response topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 1 breadcrumb: [Flow-based Playbooks, Security Incident Response playbooks, Playbook Resources, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud This playbook provides systematic remediation steps to investigate incidents that track successful login attempts from service accounts through VPN. Service accounts aren’t supposed to have login events from a VPN, and such events could be indicators of either brute force or possible exposure of the account's credentials. - **[Set up the Successful VPN Attempts from the Service Accounts playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-setup-successful-vpn-attempts.md)** Use the following steps to set up the Successful VPN Attempts from the Service Accounts playbook. - **[Use the Successful VPN Attempts from the Service Accounts playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-using-successful-vpn-attempts.md)** Use this playbook to investigate incidents that track successful login attempts from service accounts through VPN. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Successful VPN Attempts from the Service Accounts playbook. **Parent Topic:**[Flow-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-flow-based.md)
| title | Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud |
| description | This playbook provides systematic remediation steps to investigate incidents that track successful login attempts from service accounts through VPN. Service accounts aren’t supposed to have login events from a VPN, and such events could be indicators of either brute force or possible exposure of the account's credentials. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/playbook-successful-vpn-attempts.html |
| release | australia |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| breadcrumb | Flow-based PlaybooksSecurity Incident Response playbooksPlaybook ResourcesSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |