What makes a playbook appear for a Security Incident if using Flow Designer?

In ServiceNow Security Incident Response (SIR), playbooks built using Flow Designer are made available for a specific security incident based on trigger conditions. A trigger initiates a flow (the playbook) when a record, such as a security incident, is created or updated and its field values match the conditions defined in that trigger. For example, a playbook for phishing can be configured with a trigger that runs only when a security incident's 'Category' is 'Phishing'. If the incident's data matches the trigger's conditions, the associated playbook is displayed and can be executed.

A. Actions are the individual steps or operations within a playbook, such as creating tasks or enriching data; they do not determine the playbook's initial visibility.
C. The term "Runbook" is generally associated with automated procedures but is not a specific property in Flow Designer that controls playbook association via triggers.
D. Service Criticality being 'High' is an example of a specific condition that could be used within a trigger, but it is not the underlying mechanism itself, which is the trigger.

1. ServiceNow Product Documentation - Playbooks for Security Incident Response: "You can configure a playbook to run based on conditions in the security incident. For example, you can configure a playbook to run when the incident category is Phishing and the priority is High." This directly links playbook availability to conditions on the incident record. (ServiceNow Docs: Security Incident Response > Playbooks for Security Incident Response > Use playbooks).

2. ServiceNow Product Documentation - Flow Designer triggers: "A trigger starts a flow when a record is created or updated, a schedule is met, or an application is called... For record-based triggers, specify a table and a set of filter conditions. When a record on the specified table is created or updated to match the filter conditions, the system runs the flow." This explains the fundamental mechanism. (ServiceNow Docs: Flow Designer > Triggers > Flow Designer triggers).