Using SIR Workspace

Security Analysts and managers use SIR Workspace to perform day-to-day operations with an improved user experience, do complete incident investigation, and get an overview.

• Working with Security Incident Records
  The Security Incident Record consists of the following.
• Security Incident Playbook
  Invoke the security incident playbook flow automatically or manually.
• Prerequisites for the Playbooks
  You need the following roles and plugins to build the Playbooks.
• Rebuilding existing playbooks in Workflow Studio
  You can’t convert existing flows directly into playbooks in Workflow Studio. Each flow designer step that creates a response task to guide the analyst must be broken down into separate actions or subflows.
• Activity Definitions
  The ServiceNow AI Platform provides a few activity definitions within the base system. In addition, for the playbooks that SIR Workspace base system, there are a few activity definitions defined in the base system under Enterprise Security Case Management PAD Commons application.
• Sample Playbooks for SIR Workspace
  You can create or configure playbooks for SIR Workspace quickly and easily without writing complicated code. You can use these playbooks to resolve security threats in a step-by-step manner. You can invoke the security incident playbook flow automatically or manually.
• Working with MSI Records
  Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization.
• Working with Form UI actions
  Following are the UI actions that are displayed on the security incident form.
• Security Incident Closure workflow
  Close the security incident by updating the incident state.
• Handle security incidents using AWA
  Using AWA, security analysts can handle the security incidents assigned to them, which are available in the inbox folder of SIR Workspace.