---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Configure ServiceNow Otto for Security Incident Response (SIR)

# Configuring ServiceNow Otto for Security Incident Response (SIR) {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Configuring ServiceNow Otto for Security Incident Response (SIR)

ServiceNow Otto for Security Incident Response (SIR) enhances your Security Incident Response Workspace and legacy Core UI with generative AI capabilities.
Configuration is done via the AI Admin Hub console, which centralizes the installation of applications and setup of AI skills.
This setup enables automation and intelligent insights to improve incident handling and resolution.
Show full answer Show less  

## Key Features

* **Role-Based Access:** AI agents enforce role masking, so only authorized users with specific roles can access them. You must configure security controls accordingly if restricting access.
* **Pre-Activated Skills and Workflows:** Some generative AI skills, agents, and workflows are enabled by default to accelerate adoption.
* **Data Sharing and Privacy:** Sharing data with ServiceNow AI development improves prediction accuracy and user experience. Customers can opt out of data sharing per instance through the AI Admin Hub console.
* **Supported AI Skills for SIR:** Includes incident summarization (for all states except Draft), resolution notes generation, security operations metrics analysis, recommended actions (except Closed or Cancelled incidents), correlation insights, post-incident analysis, shift handover content generation, resolution planning, quality assessment, and data analysis.
* **Dependency Management:** Updating the SIR application automatically updates its dependent applications for seamless maintenance.
* **AI Search Requirement:** The Recommended Actions skill requires the AI Search application to be enabled on your instance.

## Configuration Details

* Install ServiceNow Otto for Security Incident Response (snsecgenai) and Security Incident Response Core (snsi) applications via AI Admin Hub.
* Use Guided Setup within AI Admin Hub to activate, configure, deactivate, or customize generative AI skills and agentic workflows relevant to your environment.
* Customize input fields and triggers of AI skills to control when and how they are applied during incident management.

## Practical Considerations for ServiceNow Customers

* Ensure proper role and security control configuration to manage user access to AI agents effectively.
* Regularly review and update AI skills via Guided Setup to align with evolving security incident response needs.
* Verify AI Search is enabled to fully utilize recommended action capabilities.
* Manage data sharing preferences to comply with your organization's privacy policies.

## Related Configuration and Workflow Areas

To maximize the benefits of Otto for SIR, consider configuring related features such as shift handover processes, incident conference call integration, report templates, on-call scheduling, and incident category management. Also, review and update system properties, risk score calculators, and quick filters for efficient incident tracking and response.  
The ServiceNow Otto for Security Incident Response (SIR) application is supported in the Security Incident Response Workspace and in the legacy Core UI (UI16). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR).

## Configuration overview {#configuring-now-assist-for-security-operations__cf-config-parent-checklist}

AI agents use [role masking](https://www.servicenow.com/docs/access?context=implement-aias-security-new&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select
Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see [Define security controls for an AI agent](https://www.servicenow.com/docs/access?context=define-sec-controls-aia&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).  
Important:  
Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).

By sharing data with the ServiceNow® AI development program, you provide relevant data to help improve prediction accuracy, user experience, tailor products to your business needs, and reduce hallucinations for your activated ServiceNow Otto skills.

You can opt out of a ServiceNow instance from sharing data from the AI Admin Hub console. See [Opt out of data sharing for Now Assist](https://www.servicenow.com/docs/access?context=opt-out-of-data-sharing-for-now-assist&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). Repeat the opt-out process for all instances that use the ServiceNow Otto functionality.  
Use the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR). This console contains everything to install the applications and configure the generative AI skills. For additional information, see [Configuring plugins and skills in AI Admin Hub](https://www.servicenow.com/docs/access?context=configuring-na-landing&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).  
Note:  
When you update the ServiceNow Otto for Security Incident Response (SIR) applications, its dependency applications are automatically updated.

The following table lists the features and skills that you can access from the AI Admin Hub console.  
Note:  
Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).
{#configuring-now-assist-for-security-operations__table_igy_kpc_1cc__entry__2}

| ServiceNow Otto product | Security incident skills |
|-|-|
| ServiceNow Otto for Security Incident Response (SIR) | Security incident summarization Note: The incident summarization supports security incidents in any state other than Draft. |
| ServiceNow Otto for Security Incident Response (SIR) | Resolution notes generation. |
| ServiceNow Otto for Security Incident Response (SIR) | Security operations metrics analysis |
| ServiceNow Otto for Security Incident Response (SIR) | Security incident recommended actions The security incident recommended actions skill supports security incidents in any state other than Closed and Cancelled. Note: The AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to AllAI SearchAI Search Status. Contact support if the page indicates that AI Search is not enabled. Correlation insights support security incidents in all states. |
| ServiceNow Otto for Security Incident Response (SIR) | Post-incident analysis |
| ServiceNow Otto for Security Incident Response (SIR) | Generate content for shift handover |
| ServiceNow Otto for Security Incident Response (SIR) | Security incident resolution plan |
| ServiceNow Otto for Security Incident Response (SIR) | Security incident quality assessment |
| ServiceNow Otto for Security Incident Response (SIR) | SIR data analysis |
[Table 1. ServiceNow Otto for Security Incident Response (SIR) features and skills in the AI Admin Hub console]

{#configuring-now-assist-for-security-operations__table_igy_kpc_1cc}

1. [Install AI plugins in AI Admin Hub](https://www.servicenow.com/docs/access?context=install-now-assist-feature-plugins&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).

   Install the ServiceNow Otto for Security Incident Response (SIR) application (sn_sec_gen_ai) and Security Incident Response Core \[sn_si\] applications.  
   Note:  
   When you update the ServiceNow Otto for Security Incident Response (SIR) application, its dependency applications are automatically updated.
2. [Configure a skill for ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/Zjz34BOxk~DWUWDZi~BQjg "Configure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup.")

   You can deactivate, configure, and reactivate generative AI skills and agentic workflows in the Guided Setup.
{#configuring-now-assist-for-security-operations__cf-config-parent-tasks-ol}
* **[Configure a skill for ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/Zjz34BOxk~DWUWDZi~BQjg)**   
  Configure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup.
* **[Customize a skill](https://www.servicenow.com/docs/XvdhCh9aFeSYEcFb~07g7Q)**   
  Customize some of the input fields of a generative AI skill to suit the requirements of your environment.
* **[Inputs and triggers](https://www.servicenow.com/docs/6Fdtf1Nj_I7P2zylXhB0Ag)**   
  You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.

**Related concepts**   

* [Set up view of SIR Records](https://www.servicenow.com/docs/p99YPRJHUz3SrQBoAXW8UA "This section describes how the related lists are grouped and presented on the SIR Related Records tab for easy navigation.")
* [Configure SI design time investigation](https://www.servicenow.com/docs/KsFsXg8CHBvaYTkUnuEOpQ "Use this section to configure security incident design time investigation page to add multiple entry points and its associated records within the Security Incident Response Workspace.")
* [SIR Workspace Related Records](https://www.servicenow.com/docs/gsDO~PbQk8zzmwnZXCwg6Q#sir-records "This section consists of the related lists items that are grouped into sections such as associated observables and configuration items.")
* [Configure Shift Handover](https://www.servicenow.com/docs/Q04QzNU1caN3mjs4rEUNGg "Configure Shift Handover settings to provide complete shift information to the next shift analysts.")
* [Security Incident Response conference call integration](https://www.servicenow.com/docs/88P4jTtlgisR6XEYl1fsMA "The Security Incident Response Conference Call integration enables you to manage and initiate conference call and chat for analysts, managers and affected users.")
* [Configure report templates in Security Incident Response](https://www.servicenow.com/docs/VKFCEyFnJHSOxoVttZW0gg "You can create report templates that can be used to generate an incident summary or an executive summary for analysis and sharing.")
* [On-Call scheduling in Security Incident Response](https://www.servicenow.com/docs/sPKhH7CGbUOINSD8C3fVaQ "Use On-Call Scheduling in Security Incident Response to view and manage shifts for your analysts.")
* [Category management in Security Incident Response](https://www.servicenow.com/docs/zKvvJ~woONAARtQWDnLzkQ "Configure security incident categories and subcategories for granular classification of incidents, which helps you accurately route security incidents.")
* [View and update Security Incident Response system properties](https://www.servicenow.com/docs/dQgedytB1~M7u70FoX9_oA "View and update the Security Incident Response Workspace system properties from the Security Incident Response Workspace administration panel to access and update the required properties.")
* [Timeline in Security Incident Response Workspace](https://www.servicenow.com/docs/U3c3lwBFolisJEn2MEJSmg "The timeline provides a chronological view of events related to a security incident. Events appear as point events or range events. Administrators can configure which events appear on the timeline and what details are shown in event popovers.")  
**Related tasks**   

* [Define the new Risk Score Calculator Rules](https://www.servicenow.com/docs/ccv9hx8vlS4KWyZ44meslQ "Use the new Risk Score Calculator to define and calculate the risk score of security incidents based on the user-defined criteria, which provide a transparent intelligence scoring of security incidents. The risk score is auto-calculated for the security incident records.")
* [Create quick filters for Security Incidents and Response Tasks lists](https://www.servicenow.com/docs/SzkWp6I2kcU8DCTa3RrrTw "Create quick filters to create reusable, predefined filters that appear on the security incidents and response tasks list pages enabling security analysts to filter the list items without adding the filter conditions each time.")

*[\>]: and then