Using AI agentic workflows in Now Assist for Security Incident Response

Use the Security Incident Response AI agents to complete your tasks autonomously.

Table 1. Available agentic workflows for AI agents for Security Incident Response

Agentic workflow name	Description	Available AI agents
Close security incident	This agentic workflow helps the security analysts to close a security incident using natural language in the Now Assist panel.	Security incident wrap-up generator
Analyze security operations metrics	This agentic workflow helps a security operations center (SOC) manager analyze their security analysts' performance. Metrics are generated for security incident response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR).	Security incident retrieval AI agent Security metrics analysis AI agent
Security incident resolution	This agentic workflow helps the security analysts to identify a security incident resolution path. This workflow also assist the security analysts to close a security incident using natural language in the Now Assist panel.	Security incident resolution AI agent Exchange online integration handling AI agent Security incident wrap up generator AI agent Observable analysis AI agent Security incident activities handling AI agent

Important:

By default, all agentic workflows and AI agent records are read-only.

To modify an agentic workflow, you must first Duplicate an agentic workflow, and then proceed with the following steps:

• Activate the workflow.
• Activate all the AI agents within the workflow.
• If required, you can add a trigger to invoke the workflow automatically.

Looking for an AI agent?

• There might be AI agents installed with the Now Assist application that are not used in agentic workflows. To learn how to see all agents that are available on your instance, see Find AI agents.
• To find agents that might not be installed on your instance, visit the AI Agent Marketplace on the ServiceNow Store.