---
title: Security Incident Response AI agents
description: The following AI agents are available for Security Incident Response.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/intelligent-experiences/sir-ai-agents-overview.html
release: australia
topic_type: concept
last_updated: "2026-08-04"
reading_time_minutes: 2
breadcrumb: [Security Incident Response, AI agents library, AI assets, Enable AI experiences]
---

# Security Incident Response AI agents

The following AI agents are available for Security Incident Response.

-   **[EDR AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/sir-edr-agent-ai-agent.md)**  
This Security Incident Response agent retrieves host details or isolates a host associated with a security incident.
-   **[Exchange online integration handling AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/sir-exchange-online-integration-handling-ai-agent.md)**  
This Security Incident Response agent searches for and deletes emails related to a security incident.
-   **[Observable analysis AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/sir-observable-analysis-ai-agent.md)**  
This Security Incident Response agent performs threat lookups, observable enrichment, sighting searches, and block requests against observables in a security incident.
-   **[Security incident activities handling AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/sir-security-incident-activities-handling-ai-agent.md)**  
This Security Incident Response agent manages security incident core activities, ensuring efficient and effective handling of incidents, problems, change requests, and security incident response tasks. It is intended for use by security incident management teams.
-   **[Security incident resolution AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/sir-security-incident-resolution-ai-agent.md)**  
This Security Incident Response agent walks the user through resolving a security incident by generating and executing a resolution plan.
-   **[Security incident retrieval AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/sir-security-incident-retrieval-ai-agent.md)**  
This Security Incident Response agent searches for security incidents using filters and optionally summarizes individual incidents.
-   **[Security incident shift handover AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/sir-security-incident-shift-handover-ai-agent.md)**  
This Security Incident Response agent adds a security incident to a shift handover report, walking the user through each section for review.
-   **[Security incident wrap up generator AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/sir-security-incident-wrap-up-generator-ai-agent.md)**  
This Security Incident Response agent can close a security incident by performing all pre-closure validations. It can also generate close notes, generate post incident analysis, post work note, and update the state of the security incident to close it.
-   **[Security metrics analysis AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/sir-security-metrics-analysis-ai-agent.md)**  
This Security Incident Response agent calculates and analyzes security incident response metrics for an individual analyst or a team over a specified time range.

**Parent Topic:**[ServiceNow AI agents library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/ai-agent-landing-page.md)