--- title: Customize a skill description: Customize some of the input fields of a generative AI skill to suit the requirements of your environment. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/cust-now-assist-security-incident-skill.html release: australia product: Security Incident Response classification: security-incident-response topic_type: task last_updated: "2026-03-12" reading_time_minutes: 3 keywords: [Now Assist Security Operations] breadcrumb: [Configure ServiceNow Otto for Security Incident Response \(SIR\), Configure, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Customize a skill Customize some of the input fields of a generative AI skill to suit the requirements of your environment. ## Before you begin **Note:** Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/ai-native-sku-overview.md). Roles required: sn\_si.admin ## Procedure 1. Navigate to **Admin** > **AI Admin Hub** > **AI Skills**. 2. Select **Technology** > **Security Operations**. These Security Incident Response skills are displayed: - Security incident recommended actions The AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to **All** > **AI Search** > **AI Search Status**. Contact support if the page indicates AI Search is not enabled. - Post incident analysis - Security operations metrics analysis This skill is activated for use with an AI agent. See [Analyze security operations metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/assess-metrics-sir-aiagent.md) for more information. - Correlation insights generation - Security incident summarization - Resolution notes generation - Security operations metrics analysis - Generate content for shift handover - Security Incident Quality Assessment 3. Create a copy of a skill and customize the input fields. 1. Select **\[Omitted image "cj-sir-flow-more-icon.png"\] Alt text: More actions icon.** > **Make a copy**. 2. Confirm your choice in the modal. The guided setup is displayed. 3. In **General details**, enter a unique name and description for the skill. 4. Proceed to the next step by selecting **Save and continue**. 5. Select **Choose input**. **Note:** Some skills don't require all the configuration steps listed below. Select the only tasks that are displayed in the left panel and follow the prompts. After you have completed all the tasks, activate the skill. If **Choose input** is selected, these input templates for the skill are listed: Work In Progress, Review, and Closed. The Work In Progress template is selected. You can configure some of the base input table fields, the conditions, and the related lists for the templates. Select only from the related tables supported on the lists for your input data. You can’t modify the base input table \[sn\_si\_incident\] or add a data source for your copy of the security incident summarization skill. 6. Continue to modify the editable fields in the Work In Progress template with the condition builder and filtering conditions. 7. Select **Save template** to save your changes to a template. 8. Proceed to the next step in the Guided Setup for the Work In Progress template by selecting **Save and continue**. - **Customize prompt**: Edit the prompt by reordering or removing the predefined sections. You can review and test the prompt on a security incident record for each input template configuration. - **Define availability**:
Option Description
Skill is always available The skill is always available to users.
Customize skill availability The skill is available only when the conditions are met \(Default\).Use the condition builder to set your conditions.
- **Select display**:
Option Description
In-product Show security incident summarization in all Security products. ServiceNow Otto skills are displayed on forms and workspaces.
User roles Select the expand icon \(\[Omitted image "icon-expand.png"\] Alt text: Expand icon.\)
ServiceNow Otto panel ServiceNow Otto skills are available in the panel. **Note:** If you don't see this option, you must activate the ServiceNow Otto panel. For more information, see [Activate the ServiceNow Otto panel standard chat](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/activate-now-assist-panel.md).
Conversational experiences Verify where the skill is displayed and add roles for who can view it.Select **ServiceNow Otto Panel** in the Conversational experiences field to display the skill in the panel.
9. Select **Save template** to save your changes to the Work In Progress template. 10. Select the Review template. 11. Continue to modify the editable fields in the Review and Closed templates with filtering conditions as described in the previous steps. 12. Select **Save and continue** to proceed to the next step in the Guided Setup. 13. Select **Save template** to save your changes to a template. 14. Select **Review and Activate** to review your skill and make any additional modifications. 4. Select **Activate**. Your skill is displayed on the Security Incident page in the All available Security Incident skills section. 5. Select **Activate skill**. **Parent Topic:**[Configuring ServiceNow Otto for Security Incident Response \(SIR\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/configuring-now-assist-for-security-operations.md)