Perform on-demand orchestration from the Security Incident form On-demand orchestration can be invoked from a choice list at the bottom of the Security Incident form. Before you beginRole required: sn_si.write Procedure Navigate to Security Incident > Incidents > Show Open Incidents. Select the record (security incident, observable, or CI) for which you want to run a workflow. Click the Run Orchestration related link. The Run Orchestration dialog box opens. The appearance of the dialog box depends on the setting of the sn_sec_cmn.use_on_demand_tbl_as_whitelist property in Security Support Common. Click the lookup icon and select the workflow you want to run. The selected workflow runs. For details, see Security Incident Response Orchestration workflows and activities.