Using the Manual Malware playbook

task brazil Updated Sep 10, 2026 1 min read using-manual-malware-playbook.md

Raw file servicenow.com

Use these steps to learn how you can use the Manual Malware playbook in the SIR Analyst Workspace and its capabilities.

Before you begin

Role required: sn_si.admin or sn_si.manager or sn_si.analyst

Procedure

In the SIR workspace, open a security incident.
Select the Playbook tab.

You can view the playbooks that have been enabled for the security incident. You can also see details like the category of the security incident, risk score.

Note: If you don’t see any playbooks listed, then you need to go to PAD and enable them to see it in the Playbook tab.
Select the Manual Malware Playbook.

For manual malware, the tasks are automatically performed for the security incident.
Select each stage to know what tasks have been performed by this playbook.
Select Analysis to see the list of activities performed in the Analysis phase.

You have the option to change it as per your requirements.
Similarly, you can select Contain, Eradicate, and Review to view the list of activities that have been performed in the respective phase.

You have the option to change them as per your requirements. If there’s any remaining activity or user action that you need to perform, it’s displayed in the respective phase.
If there’s any remaining activity or user action required in any of the phases, select the respective phase and perform the action to complete the activity.

Parent Topic:Playbook for Manual Malware

52 lines · 2.4 KB Wrap lines

---
title: Using the Manual Malware playbook
description: Use these steps to learn how you can use the Manual Malware playbook in the SIR Analyst Workspace and its capabilities.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/using-manual-malware-playbook.html
release: brazil
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Playbook for Manual Malware, Process-based Playbooks, Security Incident Response playbooks, Playbook Resources, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Using the Manual Malware playbook

Use these steps to learn how you can use the Manual Malware playbook in the SIR Analyst Workspace and its capabilities.

## Before you begin

Role required: sn\_si.admin or sn\_si.manager or sn\_si.analyst

## Procedure

1. In the SIR workspace, open a security incident.

2. Select the **Playbook** tab.

You can view the playbooks that have been enabled for the security incident. You can also see details like the category of the security incident, risk score.

**Note:** If you don’t see any playbooks listed, then you need to go to PAD and enable them to see it in the **Playbook** tab.

3. Select the **Manual Malware Playbook**.

For manual malware, the tasks are automatically performed for the security incident.

4. Select each stage to know what tasks have been performed by this playbook.

5. Select **Analysis** to see the list of activities performed in the Analysis phase.

You have the option to change it as per your requirements.

6. Similarly, you can select Contain, Eradicate, and Review to view the list of activities that have been performed in the respective phase.

You have the option to change them as per your requirements. If there’s any remaining activity or user action that you need to perform, it’s displayed in the respective phase.

7. If there’s any remaining activity or user action required in any of the phases, select the respective phase and perform the action to complete the activity.

**Parent Topic:**[Playbook for Manual Malware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/playbook-malware-manual.md)