---
title: SIR Workspace Orchestration
description: Security Incident Response Workspace orchestration activities will help the security analysts to view the investigation canvas and perform various actions that are applicable.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/security-incident-response-workspace-orchestration-activities.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Working with Security Incident Records, Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# SIR Workspace Orchestration

Security Incident Response Workspace orchestration activities will help the security analysts to view the investigation canvas and perform various actions that are applicable.

-   **[SIR Workspace Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/security-incident-response-investigation-canvas.md)**  
Security Incident Response Workspace allows the Security Analysts to view the key information associated with the security incident during the incident remediation process. The key information also includes the related lists such as Observables, Threat Lookup Results, Sighting Search, Observable Enrichment, and so on.
-   **[Unified experience framework for integrations powered by Capability Framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/security-incident-response-workspace-capability-framework.md)**  
In the classic UI, the experience is disjointed when performing orchestration activities such as running threat look, performing sighting search, and so on. Each capability has its own experience while executing it. In the new workspace, there is unified experience across all capabilities.

**Parent Topic:**[Working with Security Incident Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/using-analyst-workspace.md)

**Related topics**  


[Security Incident Overview section]()

[Security Incident Details section]()

[Security Incident Response Tasks]()

[Security Incident Response Other Records]()

[Security Incident Response Post Incident Review]()

[Update information in security incident related records]()

[TISC integration within SIR Workspace]()

[Reports in Security Incident Response]()

[Collaborate using conference call or chat in Security Incident Response]()

[Viewing incident details with a relationship graph]()

[MITRE attack and defend technique graph]()

[View and filter the incident timeline]()