---
title: Generate a post-incident analysis
description: Automatically generate a post-incident analysis for a security incident that includes a root cause analysis, impact assessment, and learning and recommendations information.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/generate-pia-report-now-assist-security-incident.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Use generative AI skills, Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Generate a post-incident analysis

Automatically generate a post-incident analysis for a security incident that includes a root cause analysis, impact assessment, and learning and recommendations information.

## Before you begin

You must have the post-incident analysis skill activated if you want a post-incident analysis generated automatically by ServiceNow Otto for Security Incident Response \(SIR\).

If the Close notes are already populated manually before closing the security incident, this content is not over-written by ServiceNow Otto for Security Incident Response \(SIR\) when analysts set the State field to **Closed**.

Roles required: sn\_si.analyst, sn\_si.manager, or sn\_si.basic

## About this task

**Important:** This generative AI skill is turned on by default. The skill will be automatically available to appropriate role users for the application. For more information, see [AI agents, skills, and agentic workflows on by default](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/now-assist-skills-on-by-default.md).

## Procedure

1.  Navigate to **All** > **Security Incident** > **Security Incident Response Workspace** and open a security incident that is assigned to you.

2.  On the **Details** tab, select **Closed** in the State field to close the security incident.

    The Close the security incident modal opens.

3.  Select **Review active tasks** to review any active remediation tasks that are associated with this incident.

    A new tab opens with record\(s\) for your review. Use this option to verify that you're ready to close the security incident, because this action cancels any associated workflows and activities and closes the incident on any associated remediation tasks.

4.  To generate the post-incident analysis select **Next**.

    The post-incident analysis is displayed in the modal with three sections. Note the ServiceNow Otto icon \(\[Omitted image "icon-ai-sparkle.png"\] Alt text: AI Sparkle icon\) indicates the content is generated by ServiceNow Otto for Security Incident Response \(SIR\).

    -   Root Cause Analysis
    -   Impact Assessment
    -   Learnings and Recommendations
    **Note:** You can use the ServiceNow Otto context menu on any of the post-incident analysis options and elaborate or shorten the Root Cause Analysis/Impact Assessment/Learnings and Recommendations and replace the text. **Elaborate** will help you add more information to the existing text. **Shorten** will make the selected text more concise.

    The following screen shot depicts how the context menu are used to elaborate or shorten and replace the desired post-incident analysis text.

    \[Omitted image "NA-PIA-NACM.png"\] Alt text: Post incident analysis using NACM.

5.  Review the report to check for accuracy and make any edits required.

6.  Select **Take assessment** and **Configure/preview report** to perform the post-incident review.

    Any edits you make to the post-incident review are preserved for one hour if you leave this page to take the assessment or perform another action. After one hour, you must set the State to **Closed** again on the incident to regenerate the post-incident analysis and close notes.

7.  Select **Next** to generate the resolution notes.

    The resolution notes are displayed in the Close Notes field.

8.  Select one from the list for the Close Code.

9.  Select **Close Incident**.

    The post-incident analysis is saved in the Post incident analysis field on the Details tab and on the Overview tab on security incidents in Security Incident Response Workspace.


**Parent Topic:**[Using ServiceNow Otto for Security Incident Response \(SIR\) generative AI skills](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/using-now-assist-for-security.md)