We heard you!!!!
Say bye to the classic UI and the custom new UI. The re-imagined next-gen workspace for the Security Analysts is now available on the store.
Preface
We have been hearing consistent customer feedback that the experience of working on a security incident has not been ideal. There is an imminent need to replace the classic UI experience with an analyst workspace that has a great user experience and has all the power that the ServiceNow platform provides in terms of robustness, customizability, and scalability. That is where the all-new SIR Workspace stands waiting to cater to all our users with a delightful user-experience.
New Security Incident Response Workspace
The new Security Incident Response (SIR) workspace is built using the platform provided UI Builder that is governed by the unified experience framework that ServiceNow aims to provide our customers across platform and all applications. The workspace has been re-imagined for the complete Analyst’s user journey making each touchpoint easy and delightful.
Key Features
Overview (Landing) Page: Analysts can view security incidents and response tasks owned by self, by team and the unassigned that are presented using various visualizations. The overview page also displays security incidents and response tasks that are due SLA immediately. Quick Links provide easy access to third party systems and external websites.
Queues: The queues such as Security Incidents and Response Tasks with pre-applied filters such as Assigned to me, Assigned to team, Open and All along with Quick filters enable faster and efficient triaging.
Incident Overview: Incident Overview captures key snapshots associated with the security incident presenting business impact, threat intelligence, response tasks, child security incidents and similar security incidents.
Details: All the security incident related information/fields are made available under the Details section with a side-by-side view of Activity stream to post worknotes as the Analyst makes edits to these information.
Investigation: The Investigation tab presents different entry points such as Associated Observables, Configuration Items, Affected Users, Phishing Emails, and Email search on which investigation is primarily carried out. All the required information is grouped logically and presented in one place for the Analyst to perform orchestration actions such as Run Threat Lookup, view all the associated information, filter and navigate them with ease.
Playbook: Interactive playbooks with activities where in-line orchestration can be performed and results viewed seamlessly. Analyst can skip and cancel steps, filter activities based on status, and add playbooks manually as might be required.
Related Records: All the SIR related lists are grouped into logical sections and presented in the Related Records tab. The search enables easier navigation to the desired related list.
Other Records: All collaboration records such as IT Incident, Problem, Change Request, Outage and emails are presented here to enable easy communication and collaboration.
Post Incident Review: As the incident progresses to review/closure Post Incident Review becomes enabled to request/take assessments and access the reports to capture learnings.
Right Contextual Pane: Provides access to key utilities such as Activity Stream, Playbook, Analyst Assist (KBs), Runbooks, Templates, and Attachments throughout the incident investigation.
MITRE ATT&CK: Enables quick access to viewing and associating MITRE information to the security incident and other artifacts.
Major Security Incident Management: Analyst will be able to Propose, Promote, Link/Unlink to Major Security Incident, if the incident has a greater impact.
Dashboards: The Analyst Dashboards provides quick overview of how the Security Operations Center is performing.
Note: All Admin configurations will remain in classic UI.
How do I get this exciting feature?
Visit the store and download Security Incident Response Workspace
Plugin Name: Security Incident Response Workspace (sn_si_aw)
What versions of Platform are supported?
The SIR Workspace will be available starting San Diego. The Dashboard functionality will be available starting Tokyo.
Link to Product Documentation
Security Incident Response Workspace Product Documentation
Quick Demo
Frequently Asked Questions
Will migration from Classic UI to the new Workspace be automatic? What happens to the customization?
- Migration will not impact core business logic written using server-side scripts.
- Actual business data will not have any impact post migration.
- Any form customizations made in Classic UI need to be manually ported to the workspace sirw view (Or) the same custom view can be configured in view experience property of SIR Workspace. Any custom client scripts/ UI policies need to be tested and evaluated by the customer post migration.
- Any related list customizations made in classic UI need to be manually ported to workspace
- All SIR provided Classic UI actions have been migrated to the SIR workspace that include all general actions, capability actions, non-capability actions.
- Any custom implemented form, related list actions need to be re-implemented in SIR workspace.
What happens to the existing New UI?
The New UI is currently in the maintenance mode. After the new SIR workspace is fully functional, we would plan the end of life for New UI. Sufficient time and heads up will be given to customers to migrate to the new Workspace from New UI.
Can both Classic and New SIR Workspace co-exist together?
Yes. They both will co-exist together until the complete product functionality is available in the new workspace.
What else in the pipeline?
The following will be supported in future releases:
- Crowdstrike Falcon Insight Integration for Security Operations
- McAfee ePO Integration
- The following dashboards
- Manager Overview Dashboard
- CISO Overview Dashboard
- In the Security Incident Explorer dashboard:
- Security Incident Assignment Heatmap (currently not supported by platform)
- Security Incident Map (currently not supported by platform)
- In the Security Incident Response Premium KPIs dashboard
- Process by state - Workbench not supported by platform
- Process by Age - Workbench not supported by platform
- Security incidents open for more than 30 days by assignment group and state - HeatMap visualisation is not supported by platform.
- Security incidents not updated for more than 30 days by assignment group and state - HeatMap visualisation is not supported by platform.
- Security incidents with assignee that is not active - HeatMap visualisation is not supported by platform.
- In the Security Operations Efficiency dashboard:
- Security Incident stage Analysis - Workbench is not supported by Platform
What are the known limitations?
Please refer KB1278498
Call to Action
If you have feedback that you would like to share with us directly, please feel free to reach us on the following ids:
- Madhumitha Reddy, Principal Product Manager SIR (madhumitha.reddy@servicenow.com)
- Hareesh Namavarapu, Senior Manager -Product Management-SIR (hareesh.namavarapu@servicenow.com)
