---
title: Activate the Threat Hunting Playbook
description: By default, the Threat Hunting playbook is deactivated. Activate it in Workflow Studio to initiate the playbook automatically for the applicable Case records.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/tisc-activate-threat-hunt-playbook.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-05-20"
reading_time_minutes: 1
keywords: [tisc, threat hunting, playbook, activate, workflow studio]
breadcrumb: [Playbooks, Administer, Threat Intelligence Security Center, Security Operations]
---

# Activate the Threat Hunting Playbook

By default, the Threat Hunting playbook is deactivated. Activate it in Workflow Studio to initiate the playbook automatically for the applicable Case records.

## Before you begin

Role required: admin

## About this task

Activate the playbook to initiate it for the applicable Case records.

## Procedure

1.  Navigate to **All** > **Workflow Studio**.

2.  In **Playbooks**, open the **Threat Hunting** playbook.

3.  To test run the playbook, select **Test** and enter a case record.

4.  Select **Activate**.


**Related topics**  


[Threat Hunting Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-threat-hunt-playbook.md)

[Use the Threat Hunting Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-use-threat-hunt-playbook.md)