--- sourceDocument: australia Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/australia/delta-yokohama-australia Release : - australia ft:locale : - en-US ft:publication_title : - australia Combined Product Files ft:clusterId : - delta3ay bundleId : - delta3ay --- # Combined ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes for upgrades from Yokohama to Australia # Combined ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes for upgrades from Yokohama to Australia {#ariaid-title1} Release version: Australia Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 14 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined ServiceNow Otto for Security Incident Response (SIR) Release Notes: Yokohama to Australia This consolidated release notes document outlines the key updates, new features, changes, and important upgrade information for ServiceNow Otto for Security Incident Response (SIR) from the Yokohama release through to Australia. It is designed to assist ServiceNow customers in preparing for and understanding the enhancements across these versions, ensuring smooth upgrades and optimal use of the product's AI-driven security incident management capabilities. Show full answer Show less ## Important Upgrade Guidance * Before upgrading to Australia, customers should review and complete pre- and post-upgrade tasks. * Upgrading the ServiceNow Otto for SIR application automatically updates its dependent applications. * The AI Search application must be enabled for recommended actions to function properly within security incidents. * Now Assist plugins activate certain designated AI skills by default during upgrades if they were previously unconfigured. * Role-based security configurations are essential for agentic workflows and AI agents to function correctly; customers must assign appropriate roles to users accessing these features. ## New Features and Enhancements * **Default Activation of AI Skills:** Some Now Assist skills, such as security incident summarization, resolution notes generation, post incident analysis, recommended actions, correlation insights, and quality assessment, are now turned on by default for new customers and certain upgrading customers. * **Generative AI Reports:** Customers can generate quality assessment reports and shift handover reports using generative AI, which produces natural language summaries and detailed assessments to streamline reporting and handoffs between shifts. * **Agentic Workflows:** New workflows allow security managers to analyze operational metrics (case volume, MTTA, MTTR) and receive improvement suggestions. The security incident resolution workflow enables analysts to chat with AI agents in natural language to plan and execute incident resolution using existing runbooks, knowledge articles, and historical incidents. * **Correlation Insights:** These insights can now be generated from multiple configuration items, observables, and affected users within the Security Incident Response Workspace, enhancing incident triage by linking related incidents and entities. * **Expanded AI Model Providers:** Integration with Google Gemini and AWS Claude expands the AI model options beyond Now LLM Service and Azure OpenAI, offering customers flexibility in AI capabilities. * **UI Improvements:** Introduction of a "Show More" UI card in recommended actions provides analysts with greater context and additional investigative steps. ## Changes Affecting Usage and Configuration * Now Assist usage measurement shifted to a 365-day burn-down model resetting at the contract anniversary, replacing the previous look-back model, improving usage tracking accuracy. * Access control lists (ACLs) must be configured for AI agents and agentic workflows to control discovery and execution privileges, allowing administrators to define availability at user or public levels. * The application name changed from Now Assist for Security Operations to ServiceNow Otto for Security Incident Response starting version 2.0.1. ## Functionality Removed or Deprecated No features or functionality were removed or deprecated between Yokohama and Australia releases. ## Activation and Additional Requirements * ServiceNow Otto for Security Incident Response (SIR) is available through the ServiceNow Store; customers must request installation from the store. * No new additional system or browser requirements were introduced across these releases. * Accessibility and localization information remained unchanged during this period. ## Key Outcomes for Customers * Enhanced automation and AI-driven assistance reduce manual effort in incident summarization, resolution planning, and reporting. * Improved security operations metrics analysis enables data-driven performance improvements. * Expanded AI model options and improved UI elements support more effective and efficient incident response workflows. * Clear upgrade guidance and security role configurations help maintain control over AI feature usage and access. * Integration of multiple insights sources improves incident correlation and triage speed. Consolidated page of all release notes for ServiceNow Otto for Security Incident Response (SIR) (SIR) from Yokohama to Australia. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Australia. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading ServiceNow Otto for Security Incident Response (SIR) (SIR) to Australia Before you upgrade to Australia, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__2} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | Upgrade information : Note: The following Now Assist skills, agents, and agentic workflows for ServiceNow Otto for Security Incident Response (SIR) are activated by default: Skills * Security incident summarization * Resolution notes generation * Post incident analysis * Security incident recommended actions * Correlation insights generation * Security incident quality assessment * Natural language condition evaluator * Generate content for shift handover * Quality assessment report NACM * Security incident resolution plan * Security operations metrics analysis Agentic workflows * Wrap up security incident * Resolve security incident * Generate SIR shift handover report * Analyze security operations metrics Agents * EDR AI agent * Exchange online integration handling AI agent * Observable analysis AI agent * Security incident activities handling AI agent * Security incident resolution AI agent * Security incident retrieval AI agent * Security incident shift handover AI agent * Security incident wrap up generator AI agent * Security metrics analysis AI agent For more information, see [AI assets on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=zurich&ft:locale=en-US) Note: Upgrading the Now Assist plugins activates any designated skills that were previously untouched by the customer. * If you installed the plugins for a skill but never configured it, meaning you never activated it nor adjusted associated roles, any skill on by default is activated on a per skill basis when upgrade. * If you previously toggled a skill from active and then back to inactive, or updated any roles for that skill, that skill remains inactive when upgrading. * You maintain full control over deactivating individual skills at any time after activation. When you update the ServiceNow Otto for Security Incident Response (SIR) (SIR) application, the dependency applications are automatically updated. For more information about required applications for ServiceNow Otto for Security Incident Response (SIR), see [Supporting information](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-security-incident&family=zurich&ft:locale=en-US). The AI Search application must be enabled so that the recommended actions skill works for security incidents with ServiceNow Otto for Security Incident Response (SIR). To verify that AI Search is enabled on your instance, navigate to AllAI SearchAI Search Status. Contact support if the page indicates that AI Search isn't enabled. | | Australia | No updates for this release. | [ ] ## New features Between your current release family and Australia, new features were introduced for ServiceNow Otto for Security Incident Response (SIR) (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__10} | Release | Release notes | |-|-| | Yokohama | [Role configuration required for agentic workflows and AI agents](https://www.servicenow.com/docs/access?context=aia-role-masking&family=yokohama&ft:locale=en-US) : Agentic workflows and AI agents included with Now Assist applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they will not execute. Data access settings must also include these roles. See the documentation for the agentic workflow or AI agent for the specific roles you must add. [Some Now Assist skills are turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Generate a quality assessment report](https://www.servicenow.com/docs/access?context=na-sir-quality-assessment&family=yokohama&ft:locale=en-US) : Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules. [Generate SIR Shift Handover Report](https://www.servicenow.com/docs/access?context=add-incidents-shifthandover-ai-agent&family=yokohama&ft:locale=en-US) : The AI Agent helps add security incident details to a shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. The AI agent can fetch details of the security incident and identify if the analyst has access to the shift handover record. The AI agent can generate content for each section of the shift handover record and asks for analysts feedback on the content. The AI agent refines the content based on the feedback and saves the content to the records on approval. [New third-party AI model provider options available for all Now Assist applications](https://www.servicenow.com/docs/access?context=exploring-large-language-models&family=yokohama&ft:locale=en-US) : Google Gemini and AWS Claude are available for Now Assist skills and AI agents in addition to Now LLM Service and Azure OpenAI. [Use agentic workflows](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=yokohama&ft:locale=en-US) : The Analyze security operations metrics agentic workflow enables security managers to analyze their teams' performance. * Generate metrics for Security Incident Response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) for a date range of your choosing. * Request suggestions for how to improve MTTR, MTTA, and volume based on your metrics. [Enhancements to correlation insights in Now Assist for Security Incident Response](https://www.servicenow.com/docs/access?context=generating-insights-for-now-assist-for-security&family=yokohama&ft:locale=en-US) : You can generate and view results for correlation insights in the Security Incident Response Workspace. * Correlation insights are not limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident. * You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace. * You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users. * Results are displayed in a modeless dialog that you can size and move. [Using Security incident resolution agentic workflow](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=yokohama&ft:locale=en-US) : Use the Security incident resolution agentic workflow to close your security incidents. Analysts can chat with the AI agents in natural language to resolve the security incidents. The AI agent analyzes the incident details, existing runbooks, knowledge articles, and past similar security incidents as inputs, and provides a resolution plan. The AI agent also assists the analysts to resolve the security incident. [Using Security Incident Response AI agents](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=yokohama&ft:locale=en-US) : Yokohama Patch 1: Use the Close security incident use case to close your security incidents: * Analysts can chat with the AI agents in natural language to close the security incidents. The AI agent can cancel the associated response tasks, generate resolution notes, close code, or close notes and post incident analysis (PIA) during incident closure. Analysts can provide feedback on the content and the AI agent can refine the content based on the feedback. * Analysts can also close false positive security incidents with minimal user intervention. [Yokohama Early Availability](https://www.servicenow.com/docs/access?context=now-assist-security-incident-landing&family=yokohama&ft:locale=en-US) : * [Generate correlation insights](https://www.servicenow.com/docs/access?context=generate-correlation-insights-now-assist-for-security&family=yokohama&ft:locale=en-US) Generate correlation insights to connect current security incidents to past events. You can identify the affected users, configuration items (CI)s, or observables (IP addresses and file hashes) from existing incidents and records to help you more quickly triage your new security incidents. Correlation insights are supported in Workspace, the Core UI, and from the Now Assist panel. * Enhancements to [closure (resolution) notes](https://www.servicenow.com/docs/access?context=generate-closure-notes-si-now-assist-sec-incident&family=yokohama&ft:locale=en-US) and [post incident analysis](https://www.servicenow.com/docs/access?context=generate-pia-report-now-assist-security-incident&family=yokohama&ft:locale=en-US) generation Generate resolution notes from the Close the security incident modal or the Now Assist context menu on a security incident record (SIR). You can also generate resolution notes from the Now Assist panel. If you choose the Now Assist context menu, you have the following options to help you refine the generated text: * Shorten: Select the text to remove details. * Elaborate: Generate more details about the context of a security incident. Note: Generating resolution notes is supported in Workspace and Core UI. Generating a post incident analysis is supported from the Close the security incident modal in Workspace. | | Zurich | [Resolve a security incident](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Help enhance incident resolution plan generation by adding your existing runbooks to the AI runbooks section within the Security incident resolution plan skill. The existing runbooks provide additional context to the skill. [Role configuration required for agentic workflows and AI agents](https://www.servicenow.com/docs/access?context=aia-role-masking&family=zurich&ft:locale=en-US) : Agentic workflows and AI agents included with your applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they will not execute. See the documentation for the agentic workflow or AI agent for the specific roles you must add. [Explore Security incident quality assessment](https://www.servicenow.com/docs/access?context=na-sir-quality-assessment&family=zurich&ft:locale=en-US) : Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules. [Generate SIR Shift Handover Report](https://www.servicenow.com/docs/access?context=add-incidents-shifthandover-ai-agent&family=zurich&ft:locale=en-US) : The AI agent helps add security incident details to a shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. The AI agent can fetch details of the security incident and identify if the analyst has access to the shift handover record. The AI agent can generate content for each section of the shift handover record and asks for analysts feedback on the content. The AI agent refines the content based on the feedback and saves the content to the records on approval. [Use agentic workflows](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=zurich&ft:locale=en-US) : The analyze security operations metrics agentic workflow helps security managers to analyze their teams' performance. * Generate metrics for Security Incident Response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) for a date range of your choosing. * Request suggestions for how to improve MTTR, MTTA, and volume based on your metrics. [Enhancements to correlation insights in ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/access?context=generating-insights-for-now-assist-for-security&family=zurich&ft:locale=en-US) : You can generate and view results for correlation insights in the Security Incident Response Workspace. * Correlation insights aren't limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident. * You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace. * You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users. * Results are displayed in a modeless dialog that you can size and move. [Using the security incident resolution agentic workflow](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Use the security incident resolution agentic workflow to close your security incidents. Analysts can chat with AI agents in natural language to resolve the security incidents. The AI agent analyzes the incident details, existing runbooks, Knowledge articles, and past similar security incidents as inputs, and provides a resolution plan. The AI agent also assists the analysts to resolve the security incident. | | Australia | No updates for this release. | [ ] ## Changes Between your current release family and Australia, some changes were made to existing ServiceNow Otto for Security Incident Response (SIR) (SIR) features. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__18} | Release | Release notes | |-|-| | Yokohama | [Changes to Now Assist usage measurement](https://www.servicenow.com/docs/access?context=monitoring-now-assist-usage&family=yokohama&ft:locale=en-US) : Starting with Yokohama Patch 5, Now Assist usage measurement is transitioning from a 365-day look-back model to a 365-day burn-down model, with usage resetting at the contract anniversary date. For more information, refer to [KB KB2704710: Now Assist Usage - Overview \& New Measurement Logic](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2704710). [Some Now Assist skills are now turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The following Now Assist skills for ServiceNow Otto for Security Incident Response (SIR) and ServiceNow Otto for Unified Security Exposure Management are activated by default. * Security incident summarization (SIR) * Resolution notes generation (SIR) * Post incident analysis (SIR) * Security incident recommended actions (SIR) * Correlation insights generation (SIR) * Security incident quality assessment (SIR) The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Configure ACLs for AI agents and agentic workflows](https://www.servicenow.com/docs/access?context=aia-security-implementation&family=yokohama&ft:locale=en-US) : Configure the access control lists for who can discover and trigger AI agents and agentic workflows in their guided setups in AI Agent Studio. You can determine whether an AI agent or agentic workflow behaves as a dynamic user or as an AI user. You can also specify if an AI agent or agentic workflow can be available to all authenticated users or publicly available. [Generate recommended actions](https://www.servicenow.com/docs/access?context=generate-recommended-actions-now-assist-for-security&family=yokohama&ft:locale=en-US) : Introduced a new UI card Show More to enhance the visibility of recommended actions. As a security analyst, you can now access additional context along with further recommended steps to assist in the analysis and investigation of security incidents. [Now Assist for Security Incident Response application name change](https://www.servicenow.com/docs/access?context=activate-skills-for-now-assist-security-incident&family=yokohama&ft:locale=en-US) : Starting with version 2.0.1, the Now Assist for Security Operations application in the ServiceNow® Store and in your ServiceNow AI Platform® instance has changed to the ServiceNow Otto for Security Incident Response (SIR) application. | | Zurich | [Resolve a security incident](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Use the Sightings search and Isolate host capabilities in the Resolve security incident workflow to help resolve security incidents. [Generate recommended actions](https://www.servicenow.com/docs/access?context=generate-recommended-actions-now-assist-for-security&family=zurich&ft:locale=en-US) : A new Show More UI card has been introduced to enhance the visibility of recommended actions. As a security analyst, you can now access additional context along with further recommended steps to assist in the analysis and investigation of security incidents. | | Australia | No updates for this release. | [ ] ## Removed Between your current release family and Australia, some ServiceNow Otto for Security Incident Response (SIR) (SIR) features or functionality were removed. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__26} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Deprecations Between your current release family and Australia, some ServiceNow Otto for Security Incident Response (SIR) (SIR) features or functionality were deprecated. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__34} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Activation information Review information on how to activate ServiceNow Otto for Security Incident Response (SIR) (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__42} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | Activation information : Install ServiceNow Otto for Security Incident Response (SIR) by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: ServiceNow Otto for Security Incident Response (SIR) is available in ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Australia | No updates for this release. | [ ] ## Additional requirements If any additional requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__50} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__58} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for ServiceNow Otto for Security Incident Response (SIR) (SIR), such as specific requirements or compliance levels. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__66} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__74} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__82} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | [Zurich Patch 7](https://www.servicenow.com/docs/access?context=zurich-patch-7&family=zurich&ft:locale=en-US) * Help enhance incident resolution plan generation by adding your existing runbooks to the AI runbooks section within the Security incident resolution plan skill. The existing runbooks provide additional context to the skill. * Use the Sightings search and Isolate host capabilities in the Resolve security incident workflow to help resolve security incidents. [Zurich Patch 5](https://www.servicenow.com/docs/access?context=zurich-patch-5&family=zurich&ft:locale=en-US) * Review changes to Now Assist usage measurement. [Zurich Patch 4](https://www.servicenow.com/docs/access?context=zurich-patch-4&family=zurich&ft:locale=en-US) * Some Now Assist skills are now turned on by default. * Use generative AI to create a quality assessment report of a security incident. * Additional role configuration required for agentic workflows and AI agents included with your applications. [Zurich Patch 1](https://www.servicenow.com/docs/access?context=zurich-patch-1&family=zurich&ft:locale=en-US) * Help analysts to add security incidents details to the Shift Handover report by chatting with AI agents in the Now Assist panel. Zurich Early Availability * Help your analysts to gain insight into security incident record metrics with an agentic workflow. Chat with AI agents in natural language from the Now Assist panel. * Help your analysts to resolve security incidents by chatting with AI agents in the Now Assist panel where the AI agent can assist in providing a resolution plan. | | Australia | No updates for this release. | [ ] *[\>]: and then