--- title: Exploring ServiceNow Otto for Security Incident Response \(SIR\) description: Security analysts can use intelligent workflows and ServiceNow generative AI skills to triage, investigate, and close security incidents with ServiceNow Otto for Security Incident Response \(SIR\). locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/now-assist-for-security-incident-response-sir/exploring-now-assist-security-incident.html release: australia product: Now Assist for Security Incident Response \(SIR\) classification: now-assist-for-security-incident-response-sir topic_type: concept last_updated: "2026-03-12" reading_time_minutes: 5 breadcrumb: [ServiceNow Otto for Security Incident Response \(SIR\), Security Operations] --- # Exploring ServiceNow Otto for Security Incident Response \(SIR\) Security analysts can use intelligent workflows and ServiceNow generative AI skills to triage, investigate, and close security incidents with ServiceNow Otto for Security Incident Response \(SIR\). ## ServiceNow Otto for Security Incident Response \(SIR\) overview With generative AI skills and agentic workflows, security analysts can complete the following tasks: - Summarize security incident details and review the context quickly in a concise, easy-to-read format. - Generate recommended next steps for a security incident. - Generate post-incident analysis data. - Generate performance metrics for your remediation teams with an agentic workflow. For this feature, the Security operations metrics analysis skill is activated for use with an AI agent. See [Analyze security operations metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/assess-metrics-sir-aiagent.md) for more information. - Generate a resolution plan. - Generate closure notes. - Generate correlation insights. - Generate shift handover reports. - Generate a quality assessment report for a security incident. - Ask questions about security incident data in natural language and get insights with an agentic workflow. Security analysts can share findings, incident details, and closure notes with other analysts, managers, and key stakeholders. ## Users

User	Description
Security analysts and managers	Preview security incident details, see their potential impact, and view the key remediation actions already taken with security incident summaries using generative AI. Summaries and recommended next steps \(actions\) give analysts and managers a head start with their investigations and help with closing security incidents.Automatically generate a draft of closure notes using generative AI. Closure notes for security incidents are created based on remediation and containment activities, and other details related to their closure.

User

Description

Security analysts and managers

Preview security incident details, see their potential impact, and view the key remediation actions already taken with security incident summaries using generative AI. Summaries and recommended next steps \(actions\) give analysts and managers a head start with their investigations and help with closing security incidents.Automatically generate a draft of closure notes using generative AI. Closure notes for security incidents are created based on remediation and containment activities, and other details related to their closure.

## Benefits

Benefit	Feature	Users
Expedite triaging of security incidents with long activity streams by reviewing work notes and contextual information in a concise format.	Generate summaries for security incidents that include the following information:- Issue - Details - Observations - Key actions taken - Closure details	- Security analysts - Security managers
Automatically generate a draft of closure notes for a security incident when it’s ready for closure. You can modify any content generated by the AI skill by editing it, removing it, or adding your own notes before you close the security incident.	Generate security incident closure notes	- Security analysts - Security managers
Generate recommended next steps within the workflow upon request to help you close a security incident.	Generate security incident recommended actions	- Security analysts - Security managers
Generate a post-incident analysis that includes a root cause analysis, impact assessment, and lessons learned within the workflow of closing a security incident.	Generate post-incident analysis	- Security analysts - Security managers
Connect current incidents to past events that involve the same affected users, configuration items \(CIs\), or observables.	Generate correlation insights	- Security analysts - Security managers
Gain insight into how efficiently your security analysts are working with security incidents by using an AI agent.	Generate a Security Operations Center \(SOC\) performance analysis and get suggestions for improvement from an AI agent.Note: You must activate the Security operations metrics analysis skill to use the Analyze security operations metrics agentic workflow.	Security managers
Learn about the details of a security incident by accessing summaries and closure notes from the ServiceNow Otto panel.	Access the generative AI summary and closure notes from the ServiceNow Otto panel. Enter requests for more information about security incidents in the panel.	- Security analysts - Security managers
Generate a quality assessment report for a security incident.	Generate Quality Assessment report	Security managers
Get answers about your security incident data without composing queries or knowing the underlying report structure.	SIR data analysis	- Security analysts - Security managers
Customize the generative AI skills for summaries and closure notes to suit your needs.	Copy a skill and modify select related table fields, define the availability of the skill, and choose where the skill is displayed.	Admin users

## What to explore next To learn more about configuring and using ServiceNow Otto for Security Incident Response \(SIR\), see: - [Configuring ServiceNow Otto for Security Incident Response \(SIR\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/configuring-now-assist-for-security-operations.md) - [Summarize a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/summarize-security-incident-now-assist-sec-incident.md) - [Generate closure notes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/generate-closure-notes-si-now-assist-sec-incident.md) - [Generate correlation insights](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/generating-insights-for-now-assist-for-security.md) - [Generate recommended actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/generate-recommended-actions-now-assist-for-security.md) - [Generate a post-incident analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/generate-pia-report-now-assist-security-incident.md) - [Analyze security operations metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/assess-metrics-sir-aiagent.md) - [Analyze security incident data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/analyze-data-sir.md) - [Inputs and triggers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/input-triggers-now-assist-security-incident.md)