---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Advanced Work Assignment for SIR

# Advanced Work Assignment for Security Incident Response {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Advanced Work Assignment (AWA) intelligently routes and assigns security incidents to security analysts on the basis on their availability, capacity, and skills.

AWA streamlines the assignment process, ensuring that critical incidents are handled by the most appropriate and available analysts. AWA improves overall response times and efficiency in security operations.

The ability to make configuration changes requires the AWA admin role (awa_admin), which isn't provided by default with SIR Workspace. For more information, see [Components installed with Security Incident Response](https://www.servicenow.com/docs/Ggj2k2A3Ycyj_BpBcgz1tA "Several types of components are installed when you download and activate the Security Incident Response application, including plugin dependencies, user roles, tables, properties, and scheduled jobs.").

## Key features {#awa-for-sir__section_fft_lnx_khc}

* AWA uses service channels to route requests. Security incidents are placed in queues. You can create multiple queues for different priorities or groups. Routing conditions like priority or state determine which queue an incident enters.
* AWA admins must configure assignment eligibility by adding groups and rules. Only eligible analysts receive assignment notifications.
* AWA admins can set how many security incidents a security analyst can handle at once. The default value is 1.
* AWA analysts can set their availability. Based on the AWA configuration, security analysts can either manually accept or reject incoming security incidents or you can choose to have security incidents be auto-assigned to security analysts.
{#awa-for-sir__ul_byv_mnx_khc}  
Note:  
You can't use multiple security incident assignment methods simultaneously. For more information, see [++Assigning security analysts++](https://www.servicenow.com/docs/TwtDZB289oUSK~R1AFOwhQ#r_AgentAssignment "Depending on your settings in the SIR Administration Configuration screen, you can assign security analysts to security incidents manually; automatically by using a workflow; or automatically by using auto-assignment.").