Runbooks connect Security Incident Response Task and Knowledge Article.

Runbooks connect Security Incident Response Task and Knowledge Article.

• A. Events
• B. Security Incident Response Task and Playbook Task
• C. Alerts
• D. Workflow Trigger and Knowledge Article

Answer: (B)

Runbooks in ServiceNow IRM are designed to guide and automate incident responses by linking the high-level Security Incident Response Task to a concrete Playbook Task. The Playbook Task represents the step that executes or references a playbook, which is typically a Knowledge Article containing the remediation steps and procedures. This arrangement ensures responders follow a standardized, repeatable set of actions, and any automated actions in the runbook draw from the playbook’s guidance. Other options don’t fit because events and alerts are inputs from monitoring systems, not the pairing the runbook creates. A workflow trigger is a general starting mechanism, not the specific connection between an incident task and the procedural playbook that the runbook establishes.

Runbooks in ServiceNow IRM are designed to guide and automate incident responses by linking the high-level Security Incident Response Task to a concrete Playbook Task. The Playbook Task represents the step that executes or references a playbook, which is typically a Knowledge Article containing the remediation steps and procedures. This arrangement ensures responders follow a standardized, repeatable set of actions, and any automated actions in the runbook draw from the playbook’s guidance.

Other options don’t fit because events and alerts are inputs from monitoring systems, not the pairing the runbook creates. A workflow trigger is a general starting mechanism, not the specific connection between an incident task and the procedural playbook that the runbook establishes.