Skip to content
Flow-based Playbooks › Security Incident Response playbooks › Playbook Resources › Security Incident Response › Enterprise security case management applications › Security Operations
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Playbook for Credential Sniffing

This playbook provides system remediation steps to investigate an incident involving credential sniffing activities performed through the sys_installation_exit table in a ServiceNow instance.

The Credential Sniffing playbook provides a script field to process the Database (DB) logins, Single sign-on (SSO), and LDAP (Lightweight Directory Access Protocol) by using the records on the sys_installation_exit table. These privileged scripting fields enable listening of user requests and parameters to the instances during login, including user credentials such as username and password.

A malicious user may create a script to listen to the user requests and log these requests on the instance. The sys_installation_exit table on an instance defines the rules of processing the login and logout activities of all users on that instance.

  • Set up the Credential Sniffing playbook
    Use the following steps to set up the Credential Sniffing playbook.
  • Use the Credential Sniffing playbook
    Use this playbook to investigate an incident involving credential sniffing activities performed through the sys_installation_exit table in a ServiceNow instance. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Credential Sniffing playbook.

Parent Topic:Flow-based Playbooks