---
title: Use capabilities in SIR Workspace
description: Use the capabilities created using ServiceNow Otto for Security Incident Response \(SIR\) integration Toolkit in the SIR Workspace.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/use-capabilities-sir-workspace.html
release: australia
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Use SIR Integration Builder, LLM-powered SIR integration builder, Security Operations]
---

# Use capabilities in SIR Workspace

Use the capabilities created using ServiceNow Otto for Security Incident Response \(SIR\) integration Toolkit in the SIR Workspace.

## Before you begin

Role required: sn\_si\_int\_kit.integration\_creator or sn\_si.analyst

## Procedure

1.  Navigate to **Workspaces** > **Security Incident Response Workspace**.

2.  From the list view, select any security incident record.

3.  Select the **Investigation** tab.

4.  Select **Associated Observable** or **Configuration Items**.

    The capabilities applicable to observables are available under the **Associated Observable** section. The capabilities applicable to configuration items are available under the **Configuration Items** section.

5.  Select the observables on which you want to execute the capabilities.

6.  Select the **Capability** button.

    A pop-up appears with the list of applications.

    \[Omitted image "select-cap-sir-workspace.png"\] Alt text: Select capability

7.  Select the application to execute the capability.

    The run\(\) method is called from the SIR Workspace.