--- sourceDocument: Australia Enable AI sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences Release : - australia ft:locale : - en-US ft:publication_title : - Australia Enable AI ft:clusterId : - platai bundleId : - platai workflow : - Platform --- # Security incident wrap up generator AI agent # Security incident wrap up generator AI agent {#ariaid-title1} Release version: Australia Updated August 14, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Security Incident Wrap Up Generator AI Agent The Security Incident Wrap Up Generator AI agent streamlines the closure of security incidents within ServiceNow by automating pre-closure validations, generating closure documentation, and updating incident status. It ensures a thorough and compliant incident closure process by prompting for necessary approvals and producing key closure notes and post-incident analyses. Show full answer Show less ## Workflow * If the incident is already closed or cancelled, the agent notifies the user and stops further action. * If the user explicitly requests closure as a false positive, the agent immediately closes the incident. * Otherwise, it checks for open response tasks or mandatory assessments that might be impacted and requests user approval to continue. * The agent generates post-incident analysis, close notes, and recommends a close code, which the user reviews and can revise before finalizing. * Upon user approval, the agent writes the approved information to the incident record and confirms closure. ## Configuration and Access * **Third-Party Access:** Can be enabled to allow third-party AI agents to utilize this agent, off by default. * **AI Specialist Access:** Enables AI specialists to access advanced configuration options, including input-output mapping, off by default. * **Long-Term Memory:** When enabled, the agent uses previous user interactions as context for improved responses; this is off by default. * **User Roles:** Access is restricted to users with the `snsi.analyst` role, controlling both agent access and data permissions. * **Triggers and Channels:** No default triggers are defined, but administrators can configure them. The agent is enabled for use in the ServiceNow Otto AI panel and can be included in agentic workflows such as "Wrap up security incident." ## Key Outcomes for ServiceNow Customers * Automates and enforces a consistent, compliant security incident closure process. * Reduces manual effort by generating closure notes and post-incident analyses for user review. * Improves accuracy and auditability of incident closure by validating open tasks and assessments before closing. * Supports flexible closure paths, including immediate closure for false positives. * Enhances collaboration by requiring user approvals for generated content before finalizing closure. This Security Incident Response agent can close a security incident by performing all pre-closure validations. It can also generate close notes, generate post incident analysis, post work note, and update the state of the security incident to close it. ## Workflow {#sir-security-incident-wrap-up-generator-ai-agent__zsmdlwierhjt} 1. If the user explicitly requests closing as a false positive, follow the short path. Otherwise, follow the full closure path. 2. Retrieve the incident details. If already closed or cancelled, inform the user and end. 3. If the user explicitly requests closing as a false positive, close the incident immediately and end. 4. If the user doesn't explicitly requests closing as a false positive, warn the user if open response tasks or mandatory assessments will be affected. Get approval before continuing. 5. Produce a post-incident analysis, close notes, and a suggested close code. The user reviews and approves or revises each before proceeding. 6. Write the approved content to the record and confirm closure. {#sir-security-incident-wrap-up-generator-ai-agent__ol_t2z_5d2_1kc} {#sir-security-incident-wrap-up-generator-ai-agent__zsmdlwierhjt__entry__2} | Field | Description | |-|-| | Allow third party to access this AI agent | When enabled, third-party AI agents can use this agent. This value is off (false) by default. This setting is defined in the AI Agent configs \[sn_aia_agent_config\] table on the External discoverable field. | | Allow AI specialists to access this AI agent | When enabled, AI specialists can use this agent. This value is off (false) by default. When set to true, more configuration options for tools become available so that an AI specialist can map inputs and response templates to tool outputs. This setting is defined in the AI Agent configs \[sn_aia_agent_config\] table on the Specialist enabled field. | | Manage long-term memory | When enabled, all previous user interactions are used as context for the LLM. This value is off (false) by default. This setting is defined by the sn_aia.ltm.enable_long_term_memory system property. For more information, see [ServiceNow Otto AI agents reference](https://www.servicenow.com/docs/MUqSU8rHp3ao~q3QEWgHkA "Find more information about user roles, tables, and the different properties that are installed in ServiceNow Otto AI agents."). | | Tools | Scripts : Close security incident as false positive : Fetch security incident details : Generate close notes for security incident : Generate post incident analysis for security incident : Update security incident closure information | | Allowed user roles The specific user roles that can access this AI agent. | sn_si.analyst | | Data access roles The specific user identity roles that determine which data the AI agent can access and what actions it can take. | sn_si.analyst | | Triggers | Optional. None defined by default. An admin can specify triggers if desired. For more information, see [Add a trigger to an AI agent](https://www.servicenow.com/docs/NXqRJBQV_Vw00FEzklcAJw "In the guided setup for an AI agent, add triggers to run the AI agent automatically when certain conditions are met."). | | Channels | Enable the AI agent for the ServiceNow Otto panel. | | Used in agentic workflows | Wrap up security incident | [Table 1. Configuration] Learn more about Security Incident Response at [Security Incident Response](https://www.servicenow.com/docs/access?context=sir-landing-page&version=australia&pubname=australia-security-management&ft:locale=en-US).