--- title: Generate closure notes description: Automatically generate a draft of the closure notes for a security incident when you close it. The draft is editable and will be reviewed before closing the security incident, and it can be used or modified as needed. Closure notes provide information about the resolution of a security incident to other analysts, managers, and key stakeholders. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/generate-closure-notes-si-now-assist-sec-incident.html release: australia product: Security Incident Response classification: security-incident-response topic_type: task last_updated: "2026-03-12" reading_time_minutes: 3 keywords: [Now Assist Security Operations] breadcrumb: [Use generative AI skills, Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Generate closure notes Automatically generate a draft of the closure notes for a security incident when you close it. The draft is editable and will be reviewed before closing the security incident, and it can be used or modified as needed. Closure notes provide information about the resolution of a security incident to other analysts, managers, and key stakeholders. ## Before you begin Roles required: sn\_si.analyst, sn\_si.manager, or sn\_si.basic **Note:** If the Close code or Close notes fields are already updated for a security incident, ServiceNow Otto will not modify these fields, regardless of the incident’s current state. To enable ServiceNow Otto to update these fields, verify that both the Close Code and Closure Notes fields are left empty. ## Procedure 1. In the legacy Core UI, navigate to **All** > **Security Incident** > **Incidents** and open a security incident that is assigned to you. 2. Alternatively, navigate to **All** > **Security Incident** > **Security Incident Response Workspace** and open a security incident that is assigned to you. 3. Close the security incident.
Option Description
**Close the security incident in legacy Core UI16** 1. Change the **State** field to **Closed**. The Closure modal is displayed. 2. Click on the **Close notes** section. The close notes will be auto-generated if no text exists, or you can modify the existing text as needed by choosing the required option from NACM. **Note:** You might want to review the generated text and make sure it's accurate before you close the security incident. Edit the notes or delete them to provide your own. You can also **Elaborate** or **Shorten** the generated text. 3. Select the required option from the ServiceNow Otto context menu. **Elaborate** will help you to elaborate the text and replaces the selected resolution text. In case, if you wish to shorten the resolution text you can select **Shorten** option from the Context menu to make the text more concise. 4. Update the Close code and select **Close incident**. The resolution summary is displayed in the Resolution Information section on the security incident record. **Note:** Using the ServiceNow Otto context menu, you can directly add or generate the resolution notes in the **Close notes** section on the incident record itself, when the incident is in the **Review** state. For more information, see the screen shot below.
**Close the security incident from the Security Incident Response Workspace** 1. On the **Details** tab of the workspace, change the **State** field to **Closed**. The stepper modal is displayed. 2. Review each step and select **Next**. 3. Select **Provide resolution details** 4. Click on the **Close notes** section. The close notes will be auto-generated if no text exists, or you can modify the existing text as needed using the NowAssist options. **Note:** You might want to review the generated text and make sure it's accurate before you close the security incident. Edit the notes or delete them to provide your own. You can also **Elaborate** or **Shorten** the generated text. 5. Select the required option from the ServiceNow Otto context menu. **Elaborate** will help you to elaborate the text and replaces the selected resolution text. In case, if you wish to shorten the resolution text you can select **Shorten** option from the context menu to make the text more concise. 6. Update the Close code and select **Close incident**. The resolution summary is displayed on the **Details** tab on the security incident record in the workspace. **Note:** Using the context menu, you can directly add or generate the resolution notes in the **Close notes** section on the incident record itself, when the incident is in the **Review** state. For more information, see the screen shot below.
The following screen shot depicts the resolution notes generated for closing the security incident in Core UI16. \[Omitted image "NA-RN-UI16.png"\] Alt text: Close the security incident - Resolution notes generated in Core UI16. Auto-generated resolution notes from the Security Incident Response Workspace. \[Omitted image "NA-RN-NAPanel.png"\] Alt text: Resolution Notes on the Security Incident Response workspace Edit the resolution notes generated using the ServiceNow Otto context menu on the Security Incident Response workspace. \[Omitted image "NA-R-notes.png"\] Alt text: ServiceNow Otto context menu for the Close notes. **Parent Topic:**[Using ServiceNow Otto for Security Incident Response \(SIR\) generative AI skills](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/using-now-assist-for-security.md)