--- sourceDocument: Australia Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Use agentic workflows # Using agentic AI workflows {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Using agentic AI workflows Agentic AI workflows within Security Incident Response (SIR) automate and assist with security incident tasks by leveraging AI agents. These workflows use role masking to control user access, ensuring only users with the appropriate roles can interact with them. Roles are predefined with the application, but if you select "Users with specific roles," you must configure security controls accordingly. Show full answer Show less Access to agentic workflows, AI agents, and generative AI skills depends on your ServiceNow license and product tier. Some AI features are enabled by default for new and upgraded customers to streamline adoption. ## Key Features * **Wrap up security incident:** Helps security analysts close incidents using natural language through the ServiceNow Otto panel. * **Analyze security operations metrics:** Assists SOC managers in evaluating team performance metrics, such as case volume, mean time to assign (MTTA), and mean time to resolve (MTTR). * **Resolve security incident:** Guides analysts to identify resolution paths and close incidents using natural language interactions. * **Generate SIR Shift Handover Report:** Populates shift handover reports with detailed security incident information automatically. * **Security incident data analysis:** Enables querying and gaining insights from security incident data via conversational AI in the Otto panel. All agentic workflows and AI agents are read-only by default; to customize, you must duplicate the workflows first. You can also add triggers for automatic invocation. ## Practical Use for ServiceNow Customers * **Security analysts** can efficiently close and resolve security incidents using conversational AI guidance. * **SOC managers** can analyze operational metrics to monitor and improve team performance. * **Shift handovers** are streamlined by automatically generating detailed incident reports. * Natural language queries in the Otto panel make it easier to explore and analyze security data. ## Additional Information To modify workflows or configure security controls, consult the related instructions for defining security controls and duplicating workflows. Some AI agents may be present but unused in workflows; you can view all available AI agents for your instance as needed. This capability integrates with other ServiceNow features such as Security Incident Playbooks, Advanced Work Assignment, and Workflow Studio for comprehensive incident management. Use the Security Incident Response AI agentic workflows to complete security incident tasks. Agentic workflows and their AI agents use [role masking](https://www.servicenow.com/docs/access?context=implement-aias-security-new&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see [Define security controls for an agentic workflow](https://www.servicenow.com/docs/access?context=define-sec-controls-aw&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). Note: Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). Important: Some generative AI skills, agents, and agentic workflows are turned on by default. The default behavior works as follows: New customers : When you install an AI product, designated generative AI skills, AI agents, or agentic workflows are turned on automatically. Existing customers who are upgrading (starting with Zurich Patch 4) : There is no change to skills, agents, or agentic workflows that are currently enabled and customized.An AI asset is turned on if: * The AI plugin is installed, but the asset was never turned on. * An admin has never adjusted roles for the skill. {#using-now-assist-ai-agents-sir__ul_yvc_bvq_g3c} An AI asset is not turned on if: * The asset was previously turned on, and then turned off again. * An admin has adjusted roles for the asset. {#using-now-assist-ai-agents-sir__ul_zvc_bvq_g3c} For more information, see [AI agents, skills, and agentic workflows on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). {#using-now-assist-ai-agents-sir__table_fsq_52h_m2c__entry__3} | Agentic workflow name | Description | Available AI agents | |-|-|-| | Wrap up security incident | This agentic workflow helps security analysts close a security incident using natural language in the ServiceNow Otto panel. | Security incident wrap-up generator AI agent | | Analyze security operations metrics | This agentic workflow helps a security operations center (SOC) manager analyze their security analysts' performance. Metrics are generated for security incident response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR). | * Security incident retrieval AI agent * Security metrics analysis AI agent {#using-now-assist-ai-agents-sir__ul_nxz_v3m_w2c} | | Resolve security incident | This agentic workflow helps security analysts identify a security incident resolution path. This workflow also helps security analysts close a security incident using natural language in the ServiceNow Otto panel. | * Security incident resolution AI agent * Exchange Online integration handling AI agent * Security incident wrap-up generator AI agent * Observable analysis AI agent * Security incident activities handling AI agent * Endpoint detection and response (EDR) AI agent {#using-now-assist-ai-agents-sir__ul_nx5_2ty_1fc} | | Generate SIR Shift Handover Report | This agentic workflow adds details of a security incident to the shift handover report. The AI agent populates the different sections of the shift handover with details identified from the security incident. | Security incident shift handover AI agent | | | This agentic workflow helps security analysts and managers ask questions about security incident data in natural language in the ServiceNow Otto panel. The AI agent returns insights with links to the source records, and answers follow-up questions within the same chat. | Security incident data analysis AI agent | [Table 1. Available agentic workflows for Security Incident Response] {#using-now-assist-ai-agents-sir__table_fsq_52h_m2c} Important: By default, all agentic workflows and AI agent records are read-only. To modify an agentic workflow, you must first [duplicate the agentic workflow](https://www.servicenow.com/docs/access?context=clone-aia-usecase&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). If required, you can add a trigger to invoke the workflow automatically. There might be AI agents installed on your instance that are not used in agentic workflows. To learn how to see all agents that are available to you, see [Find AI agents](https://www.servicenow.com/docs/access?context=find-ai-agents&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). * **[Close security incidents](https://www.servicenow.com/docs/tLZF90p3hy4AyDggsH~peQ)** The Wrap up security incident agentic workflow enables security analysts to close a security incident. * **[Resolve security incidents](https://www.servicenow.com/docs/a0fSF74Wkyt2u0b3ZKusJA)** Chat with an AI agent in the ServiceNow Otto panel to help you create a resolution plan for a security incident and to resolve it. * **[Analyze security incident data](https://www.servicenow.com/docs/DfDsqW5C2CksLImPvGFe6g)** Analyze and get insights into your security incident data using available prompts or natural language queries from the ServiceNow Otto panel. * **[Analyze security operations](https://www.servicenow.com/docs/2_iG5ugOktw_4rTzYejAFA)** The Analyze security operations metrics agentic workflow helps security operations center managers analyze the performance of their security teams. * **[Generate SIR Shift Handover Report](https://www.servicenow.com/docs/hFuhV4GFd2wh0_nS3ix1zw#add-incidents-shifthandover-ai-agent)** Chat with an AI agent in the ServiceNow Otto panel to use the Generate SIR Shift Handover Report agentic workflow to help you add a security incident's detail to a shift handover report. **Related concepts** * [Using ServiceNow Otto for Security Incident Response (SIR) generative AI skills](https://www.servicenow.com/docs/keNxLjwWIyUYjkgP6gn9AQ "Security analysts can close security incidents quickly from within their flow of work with the generative AI skills supported by ServiceNow Otto for Security Incident Response (SIR).") * [Working with Security Incident Records](https://www.servicenow.com/docs/TFUzgIYau3h8zmc3_FkDEA "The Security Incident Record consists of the following.") * [Security Incident Playbook](https://www.servicenow.com/docs/Or37s267AkF~R9MUgzRYiQ#security-incident-playbook "Invoke the security incident playbook flow automatically or manually.") * [Prerequisites for the Playbooks](https://www.servicenow.com/docs/POSOIYPbrf55BhB5oZj_Tw "You need the following roles and plugins to build the Playbooks.") * [Rebuilding existing playbooks in Workflow Studio](https://www.servicenow.com/docs/Gxrs6Kmn6bmfB680yQYz3A "You can’t convert existing flows directly into playbooks in Workflow Studio. Each flow designer step that creates a response task to guide the analyst must be broken down into separate actions or subflows.") * [Activity Definitions](https://www.servicenow.com/docs/IMGNwpKoJREVXgsdWM6BEg "The ServiceNow AI Platform provides a few activity definitions within the base system. In addition, for the playbooks that SIR Workspace base system, there are a few activity definitions defined in the base system under Enterprise Security Case Management PAD Commons application.") * [Sample Playbooks for SIR Workspace](https://www.servicenow.com/docs/LJZS56n6O87_ZQicnhxpTw "You can create or configure playbooks for SIR Workspace quickly and easily without writing complicated code. You can use these playbooks to resolve security threats in a step-by-step manner. You can invoke the security incident playbook flow automatically or manually.") * [Working with MSI Records](https://www.servicenow.com/docs/EzBRz3gfWLnRuxl~O9DXuA "Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization.") * [Working with Form UI actions](https://www.servicenow.com/docs/BiVNOVqIU5VY5t0VA35xHg "Following are the UI actions that are displayed on the security incident form.") **Related tasks** * [Security Incident Closure workflow](https://www.servicenow.com/docs/eUcWbP2pHl3bZk_3cBQ5EA "Close the security incident by updating the incident state.") * [Handle security incidents using Advanced Work Assignment](https://www.servicenow.com/docs/T3UyVFGugN7M9V4Ol1CCLg "Handle security incidents assigned to you in SIR Workspace using Advanced Work Assignment.")