Perform on-demand orchestration from the Security Incident list On-demand orchestration can be invoked from the Security Incident list, as well as from related lists in Security Incident Response. Before you beginRole required: sn_si.write Procedure Navigate to Security Incident > Incidents > Show Open Incidents. Select the check box next to the security incident for which you want to run a workflow. Click the Actions on selected rows choice list at the bottom of the screen, and click Run Orchestration. The Run Orchestration dialog box opens. The appearance of the dialog box depends on the setting of the sn_sec_cmn.use_on_demand_tbl_as_whitelist property in Security Support Common. Click the lookup icon and select the workflow you want to run. The selected workflow runs. For details, see Security Incident Response Orchestration workflows and activities.