On-demand orchestration can be invoked from a choice list at the bottom of the
Security Incident form.
Role required: sn_si.write
Select the record (security incident, observable, or CI) for which you want to
run a workflow.
Click the Run Orchestration related link.
Click the lookup icon and select the workflow you want to run.