--- title: Security Incident Response Post Incident Review description: Post incident review appears when an incident is moved to a Review state. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/security-incident-response-post-incident-review.html release: australia product: Security Incident Response classification: security-incident-response topic_type: concept last_updated: "2026-03-12" reading_time_minutes: 2 breadcrumb: [Working with Security Incident Records, Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Security Incident Response Post Incident Review Post incident review appears when an incident is moved to a Review state. For more detailed information on the conducting the post incident activities, see [Post incident review report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/new-post-incident-review-report.md) The Post incident review consists of the following sections: 1. Assessments 2. Reports From the Security Incident Response workspace, you will be able to request and take assessments using these new two UI actions.

Name	Description
Assessments	Assessment displays all the assessments that are associated with the security incident other assessments. The analyst will be able to take assessments and request assessments.- Take assessments: Click on Take assessments to take the assessments \(if applicable\) and complete the assessment. Before completing the assessment, the security incident state is Ready to take and Due date of the incident is indicated in Red. - Request assessments: Click on Request assessment for any additional assessments and you can add the new users whom you want to request. Note: Users who had already requested will not appear in this section. Any assessment for this incident has been configured based on the conditions set on the Post Incident Review, it be either mandatory or optional.
Reports	Modify the runtime configurations and generate the report. Select the Report instance, modify the filters and save the report. The analyst can preview and download the PIR report.

Name

Description

Assessments

Assessment displays all the assessments that are associated with the security incident other assessments. The analyst will be able to take assessments and request assessments.- **Take assessments**: Click on **Take assessments** to take the assessments \(if applicable\) and complete the assessment. Before completing the assessment, the security incident state is Ready to take and Due date of the incident is indicated in Red. - Request assessments: Click on **Request assessment** for any additional assessments and you can add the new users whom you want to request. **Note:** Users who had already requested will not appear in this section. Any assessment for this incident has been configured based on the conditions set on the Post Incident Review, it be either mandatory or optional.

Reports

Modify the runtime configurations and generate the report. Select the Report instance, modify the filters and save the report. The analyst can preview and download the PIR report.

**Parent Topic:**[Working with Security Incident Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/using-analyst-workspace.md) **Related topics** [Security Incident Overview section]() [Security Incident Details section]() [SIR Workspace Orchestration]() [Security Incident Response Tasks]() [Security Incident Response Other Records]() [Update information in security incident related records]() [TISC integration within SIR Workspace]() [Reports in Security Incident Response]() [Collaborate using conference call or chat in Security Incident Response]() [Viewing incident details with a relationship graph]() [MITRE attack and defend technique graph]() [View and filter the incident timeline]()