---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Configure AWA for SIR Workspace

# Configure Advanced Work Assignment for SIR Workspace {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Improve security incident routing for the security analysts by configuring the Advanced Work Assignment (AWA) for Security Incident Response Workspace.

## Before you begin

* The AWA \[com.glide.awa\] feature must be installed.
* Other security incident assignment methods should be disabled.
* Certain roles are required to work with AWA that aren't included with the SIR application:
  * Administrators who will be configuring AWA must be assigned the AWA admin (awa_admin) role.
  * Security analysts who are using AWA to manage security incidents must be assigned the awa_agent role.

  {#configure-awa-for-sir__ul_rgf_c2b_f3c}

  For more information, see [Components installed with Security Incident Response](https://www.servicenow.com/docs/Ggj2k2A3Ycyj_BpBcgz1tA "Several types of components are installed when you download and activate the Security Incident Response application, including plugin dependencies, user roles, tables, properties, and scheduled jobs.").
* Role required: awa_admin

{#configure-awa-for-sir__ul_bvp_zdb_f3c}

## Procedure

1. Configure a service channel.
   1. Navigate to AllAdvanced Work AssignmentSettingsService Channels.
   2. Select the Security Incident service channel.  
      This service channel is available in the base system. For information about customizing the channel, see [Create or configure a service channel](https://www.servicenow.com/docs/access?context=awa-create-service-channel&version=australia&pubname=australia-conversational-interfaces&ft:locale=en-US).
   {#configure-awa-for-sir__substeps_fhj_l3y_khc}
2. Configure assignment rules for assigning security incidents.
   1. Navigate to AllAdvanced Work AssignmentSettingsAssignment Rules.
   2. Select Security Incident assignment rule.  
      The Security Incident assignment rule is available in the base system. For information about how to customize assignment rules, see [Configure agent assignment rules](https://www.servicenow.com/docs/access?context=awa-create-assignment-rule&version=australia&pubname=australia-conversational-interfaces&ft:locale=en-US).
   3. **Optional:** Enable auto-assignment of analysts by selecting Enable auto-assign work items.
   4. **Optional:** Enable security analysts to reject a security incident by navigating to the Rejection handling tab and selecting Allow agent to reject.
   {#configure-awa-for-sir__substeps_ybn_y4y_khc}
3. Determine which incidents to route to a particular security analyst through a given service channel by configuring queues.
   1. Navigate to AllAdvanced Work AssignmentSettingsQueues.
   2. Select Security Incident Queue.  
      The Security Incident Queue is available in the base system. You can customize the queue as needed.

      Create additional queues if you need. For each new queue, define Work Item Routing Conditions to ensure that security incidents are directed to the appropriate queue. For more
      information, see [Create a work item queue](https://www.servicenow.com/docs/access?context=awa-create-queue&version=australia&pubname=australia-conversational-interfaces&ft:locale=en-US).
   3. In the Assignment Eligibility section, select New.
   4. On the form, fill in the fields.  
      {#configure-awa-for-sir__table_ecb_1hc_f3c__entry__2}

      | Field | Description |
      |-|-|
      | Agent assignment rule | Assignment rule for the security analysts. Security Incident assignment rule is available in the base system. |
      | Eligible at | The delay before a specific group becomes eligible to receive a work item |
      | Groups | Option to enable security analyst groups to be assigned. |
      [Table 1. Assignment Eligibility New record]

      {#configure-awa-for-sir__table_ecb_1hc_f3c}
   5. Select Submit.
   {#configure-awa-for-sir__substeps_al4_sjy_khc}
4. Configure presence states for security analysts to enable them to indicate whether they're available to receive work.
   1. Navigate to AllAdvanced Work AssignmentSettingsPresence States.
   2. Add or update available presence states for an analyst.  
      By default, the Available state is inactive. If the Available state isn't enabled, AWA doesn't route incidents to security analysts. For more information, see [Configure agent presence states](https://www.servicenow.com/docs/access?context=awa-configure-agent-presence&version=australia&pubname=australia-conversational-interfaces&ft:locale=en-US).
   {#configure-awa-for-sir__substeps_mmb_rpy_khc}
5. Configure reject reasons for an analyst to select when rejecting a security incident.  
   Note:  
   If you don't enable rejection handling, security incidents are auto-assigned to analysts based on the configured service channel, queues, assignment rules, and analyst's availability.
   1. Navigate to AllAdvanced Work AssignmentSettingsReject Reasons.
   2. Add or update rejection reasons available to a security analyst.  
      For more information, see [Configure reasons for rejecting work items](https://www.servicenow.com/docs/access?context=awa-configure-reject-reasons&version=australia&pubname=australia-conversational-interfaces&ft:locale=en-US).
   {#configure-awa-for-sir__substeps_jjs_ywy_khc}

*[\>]: and then