---
title: SIR Workspace Investigation Canvas
description: Security Incident Response Workspace allows the Security Analysts to view the key information associated with the security incident during the incident remediation process. The key information also includes the related lists such as Observables, Threat Lookup Results, Sighting Search, Observable Enrichment, and so on.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/security-incident-response-investigation-canvas.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [SIR Workspace Orchestration, Working with Security Incident Records, Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# SIR Workspace Investigation Canvas

Security Incident Response Workspace allows the Security Analysts to view the key information associated with the security incident during the incident remediation process. The key information also includes the related lists such as Observables, Threat Lookup Results, Sighting Search, Observable Enrichment, and so on.

In the classic UI, most of the orchestration actions associated with the out of the box integrations are available against the related lists. For example, Run Threat Lookup, Run Observable Enrichment, etc. are present against Associated Observables related list. Similarly Get Host Details, Get Network Statistics and so on, are available against Configuration Items related list.

When a Security Analyst performs these actions, results are populated in a different related list. For example, when a user performs Run Threat Lookup, the results are available in Threat Lookup Results table. Sometimes, results are available in multiple different tables. During this process, the Security Analysts has a disjointed and unorganized user experience in co-relating the information from multiple places.

In the re-imagined new SIR Workspace, the **Investigation** canvas \(tab\) provides all the necessary information grouped logically in one place for the Analyst to perform the investigation.

-   **[Explore Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/explore-investigation-in-sir-workspace.md)**  
The primary objective of the investigation canvas is to present the necessary security incident data in one common place.

**Parent Topic:**[SIR Workspace Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/security-incident-response-workspace-orchestration-activities.md)

**Related topics**  


[Unified experience framework for integrations powered by Capability Framework]()