Playbook for OSquery of External Address in /etc/hosts file
concept brazil Updated Sep 10, 2026 1 min read playbook-osquery-external-address.md
This playbook provides systematic remediation steps to investigate incidents that indicate that an internal hostname or domain has been assigned to an external IP address on the local DNS(/etc/hosts) of a Linux server.
- Set up the OSquery of External Address in the /etc/hosts file playbook
Use the following steps to set up the OSquery of External Address in the /etc/hosts file playbook. - Use the OSquery of External Address in the /etc/hosts file playbook
Use this playbook to investigate incidents that indicate that an internal hostname or domain has been assigned to an external IP address on the local DNS(/etc/hosts) of a Linux server. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the OSquery of external address in the /etc/hosts file playbook.
Parent Topic:Flow-based Playbooks
26 lines · 2.2 KB
--- title: Playbook for OSquery of External Address in /etc/hosts file description: This playbook provides systematic remediation steps to investigate incidents that indicate that an internal hostname or domain has been assigned to an external IP address on the local DNS\(/etc/hosts\) of a Linux server. locale: en-US canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/playbook-osquery-external-address.html release: brazil product: Security Incident Response classification: security-incident-response topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 1 breadcrumb: [Flow-based Playbooks, Security Incident Response playbooks, Playbook Resources, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Playbook for OSquery of External Address in /etc/hosts file This playbook provides systematic remediation steps to investigate incidents that indicate that an internal hostname or domain has been assigned to an external IP address on the local DNS\(/etc/hosts\) of a Linux server. - **[Set up the OSquery of External Address in the /etc/hosts file playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/playbook-setup-osquery-external-address.md)** Use the following steps to set up the OSquery of External Address in the /etc/hosts file playbook. - **[Use the OSquery of External Address in the /etc/hosts file playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/playbook-using-osquery-external-address.md)** Use this playbook to investigate incidents that indicate that an internal hostname or domain has been assigned to an external IP address on the local DNS\(/etc/hosts\) of a Linux server. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the OSquery of external address in the /etc/hosts file playbook. **Parent Topic:**[Flow-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/playbook-flow-based.md)
| title | Playbook for OSquery of External Address in /etc/hosts file |
| description | This playbook provides systematic remediation steps to investigate incidents that indicate that an internal hostname or domain has been assigned to an external IP address on the local DNS\(/etc/hosts\) of a Linux server. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/security-management/security-incident-response/playbook-osquery-external-address.html |
| release | brazil |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| breadcrumb | Flow-based PlaybooksSecurity Incident Response playbooksPlaybook ResourcesSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |