diff --git a/README.rst b/README.rst
index 97420bc..a0a415a 100644
--- a/README.rst
+++ b/README.rst
@@ -601,6 +601,21 @@
               printf "This is [company name] network.\n"
               printf "Unauthorized access strictly prohibited.\n"
 
+Services
+~~~~~~~~
+
+Stop and disable linux service:
+
+.. code-block:: yaml
+
+    linux:
+      system:
+        service:
+          apt-daily.timer:
+            status: dead
+
+Possible status is dead (disable service by default), running (enable service by default), enabled, disabled.
+
 RHEL / CentOS
 ^^^^^^^^^^^^^