---
title: Playbook for Office 365 - Malicious File Detected
description: This playbook provides systematic remediation steps for investigating malicious files detected in Office 365.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/playbook-office-malicious-file-detected-.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Flow-based Playbooks, Security Incident Response playbooks, Playbook Resources, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Playbook for Office 365 - Malicious File Detected

This playbook provides systematic remediation steps for investigating malicious files detected in Office 365.

When malicious files are detected in Office 365, you can use the 365 - Malicious File Detected playbook in the Flow Designer for guidance and help optimize the investigation of these malicious files.

-   **[Set up the Office Malicous File Detected playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-setup-office-malicous-file-detected.md)**  
Use the following steps to set up the Office Malicous File Detected playbook.
-   **[Use the Office 365 Malicious File Detected playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-using-office-malicous-file-detected.md)**  
Use this playbook to investigate malicious files detected in Office 365. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Office 365 Malicious File Detected playbook.

**Parent Topic:**[Flow-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-flow-based.md)