---
title: Add closure information to a security incident
description: When a security incident is in the Review or Closed state, you can enter closure information.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/add-closure-info-to-si.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-10-09"
reading_time_minutes: 1
breadcrumb: [Close security incidents, Managing security incidents and inbound requests, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Add closure information to a security incident

When a security incident is in the Review or Closed state, you can enter closure information.

## Before you begin

Role required: sn\_si.basic

## Procedure

1.  If it isn’t already open, open the security incident you want to update.

2.  Select the **Related Records** tab.

3.  Fill in the fields, as needed.

    |Field|Description|
    |-----|-----------|
    |Create knowledge article|The option to generate a knowledge article using the contents of the post incident report.|
    |Close code|The close code that best describes the reason for closing the security incident.|
    |Closed by|\[Read only\] Displays the user who closed the security incident.|
    |Closed|\[Read only\] Displays the date and time the security incident was closed.|
    |Close notes|How the security incident has been closed, including lessons learned, resolution, and so on.|

4.  Select any of the following tabs to further update the security incident:

    -   [Incident Details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/add_inc_details_to_si.md)
    -   [Post Incident Review](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/c_PostIncidentReview.md)
5.  Select **Submit**.