How is data populated in the Security Incident Response Workspace ?

manojsubramanya
Tera Contributor

4 weeks ago

I do see incidents listed under Security Incident -> Incidents -> All Incidents but my SIR workspace shows nothing and all dashboards are blank. What am i missing ?

0 Helpfuls
  • 660 Views
2 REPLIES 2

Tanushree Maiti
Tera Patron

4 weeks ago

Hi @manojsubramanya 

 

1. Ensure Plugin :sn_sir_analytics has been installed from stored app: https://store.servicenow.com/store/app/1e9d23661b646a50a85b16db234bcbdf

 

2. Navigate to Performance Analytics > Data Collectors > Jobs (or search in your navigator).

  • Locate the jobs related to your Security Incident metrics
  • Execute Now

Refer:https://www.servicenow.com/community/itsm-forum/getting-quot-pa-appsec-daily-data-collection-complet...

Please Accept the solution if it assisted you with your question & Mark this response as Helpful.
Regards
Tanushree Maiti
ServiceNow Technical Architect
LinkedIn: https://www.linkedin.com/in/tanushreemaiti
0 Helpfuls

manojsubramanya
Tera Contributor
In response to Tanushree Maiti

4 weeks ago

Hi @Tanushree Maiti Thanks for the pointer. I'll give you a shot and confirm if it worked. Just curious, i understand the above mentioned plugin is related to dashboards and metrics but why the security incidents didn't even show up inside SIR workspace when i could see them in SIR -> Incidents. What's the fundamental difference between both the views ?

0 Helpfuls