--- sourceDocument: Australia Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Use generative AI skills # Using ServiceNow Otto for Security Incident Response (SIR) generative AI skills {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Using ServiceNow Otto for Security Incident Response (SIR) generative AI skills ServiceNow Otto integrates generative AI skills into Security Incident Response (SIR) to help security analysts accelerate incident closure directly within their workflows. These AI-driven skills enable quick summarization, action recommendations, closure note generation, post-incident analysis, correlation insights, and quality assessments of security incidents. The AI capabilities operate securely within domain-separated environments, ensuring data privacy and compliance. Show full answer Show less ## Key Features * **Domain Separation and Security:** AI skills are available in the global domain but respect domain separation, restricting data access to users' domains only. Data remains on the instance, and shared generative AI services do not persist prompts or responses. Role-based access controls regulate user permissions for AI agents and skills. * **Generative AI Skills for Security Incidents:** * Summarize incident details including issues, observables, and key actions. * Automatically generate editable closure notes to document incident resolution. * Produce recommended next steps for remediation based on past incidents and knowledge articles. * Create post-incident analysis reports covering root cause, impact, and recommendations. * Generate correlation insights to identify related incidents or affected assets, speeding investigations. * Provide quality assessment reports using natural language rules to evaluate incident management. * **Access and Usage Locations:** Security managers and analysts can request summaries and closure notes from Security Incident records, the Security Incident Response Workspace, and the ServiceNow Otto panel. Recommended actions and post-incident analysis generation are available within Security Incident records and the Workspace but not the Otto panel. Creation of remediation tasks from recommended actions is supported only in the Workspace. * **Customization and Configuration:** Input fields for AI skills can be tailored to fit organizational requirements. Security controls and data access roles must be configured to enable user access to AI agents and skills. * **License Considerations:** Available AI features depend on the customer's ServiceNow product tier and licensing. ## Practical Benefits for ServiceNow Customers * Accelerate security incident resolution with AI-generated summaries, recommended steps, and closure notes. * Improve incident investigation efficiency through correlation insights and automated analysis. * Maintain data privacy and compliance with domain separation and secure role-based access. * Enhance incident quality and learnings with AI-driven assessment reports and post-incident analyses. * Streamline workflows by integrating generative AI capabilities directly into ServiceNow SIR interfaces. ## Next Steps * Configure security controls and role assignments to enable AI agent access. * Leverage generative AI skills in the Security Incident Response Workspace and ServiceNow Otto panel where supported. * Customize AI skill inputs to align with your organization's incident response processes. * Review licensing terms to understand available AI functionality. * Explore related features such as agentic AI workflows and Security Incident Playbooks to enhance automation. Security analysts can close security incidents quickly from within their flow of work with the generative AI skills supported by ServiceNow Otto for Security Incident Response (SIR). ## Skills in global domain reuse {#using-now-assist-for-security__section_vkh_cpq_mhc} By default, all skills exist in the global domain. When you use AI in a domain-separated environment, users are only able to access data in their domain. For example, if a user uses the summarization skill, AI only uses material that exists in the user's domain when generating that summary. Additionally, there is no co-mingling of data for domain-separated instances when using generative AI skills. The data resides only on the instance, and the shared services used for generative AI do not persist any requests (prompts) and responses. For more information, see [Domain separation in the AI Admin Hub console](https://www.servicenow.com/docs/access?context=domain-separation-in-the-now-assist-admin-console&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). (Note that global domain is not the same as global scope. For more information, see [Exploring Next Experience pickers](https://www.servicenow.com/docs/access?context=next-experience-pickers&version=australia&pubname=australia-platform-user-interface&ft:locale=en-US).){#using-now-assist-for-security__na-skills-global-domain-explanation} AI agents use role masking to determine which users can access them and what data they have access to. Ones installed with ServiceNow Otto applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. Data access settings must also include these roles. For the instructions to change the security controls, see [Define security controls for an AI agent](https://www.servicenow.com/docs/access?context=define-sec-controls-aia&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).{#using-now-assist-for-security__agentic-ai-req-roles-aia} Important: Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). Note: Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). With generative AI skills with ServiceNow Otto for Security Incident Response (SIR), your security analysts have the option to: * Summarize security incident details and review the context quickly in a concise, easy-to-read format. * Generate closure (resolution) notes. * Generate recommended actions for a security incident * Generate post incident analysis data * Generate performance metrics for your remediation teams.This skill is activated for use with an AI agent. See [Analyze security operations metrics](https://www.servicenow.com/docs/Wao_Xg6ufTfhS9eFhsYOFg "Chat with an AI agent from the ServiceNow Otto panel to help you gain insight into how efficiently your security analysts are working with security incidents resolution.") for more information. * Generate correlation insights to speed up incident investigation. * Generate a quality assessment report of a security incident Security managers and analysts can request security incident summaries and closure notes from the following locations: * Security incident records * Security Incident Response Workspace * The ServiceNow Otto panel. Note: The security incident recommended actions and post-incident analysis skills are not available from the ServiceNow Otto panel. {#using-now-assist-for-security__ul_hlb_gb4_bcc} Security managers and analysts can generate recommended next steps and post-incident analysis data from the following locations: * Security incident records * Security Incident Response Workspace {#using-now-assist-for-security__ul_krk_gld_ycc} Security managers and analysts can create remediation tasks from generated recommended actions only from security incidents in the Security Incident Response Workspace. Security managers and analysts can request security incident summaries and closure notes from the following locations: * Security incident records * Security Incident Response Workspace * The ServiceNow Otto panel. Note: The security incident recommended actions and post-incident analysis skills are not available from the ServiceNow Otto panel. Security managers and analysts can generate recommended next steps and post-incident analysis data from the following locations: * Security incident records * Security Incident Response Workspace Security managers and analysts can create remediation tasks from generated recommended actions only from security incidents in the Security Incident Response Workspace. 1. [Summarize a security incident](https://www.servicenow.com/docs/67mJqPIXSt6LJAgndHOkvw "Understand the context of a security incident with the Security Incident summarization generative AI skill.") Generate a summary for a security incident that includes the underlying issue, incident details, related lists data (observables), and key actions already taken. 2. [Generate recommended actions](https://www.servicenow.com/docs/5N86Ug6cr~8OdH8e0~KYyQ "Automatically generate the next steps your analysts can take to help them close a security incident in the Security Incident Response Workspace. The recommended steps are based on existing security incidents and knowledge articles.") 3. [Generate a post-incident analysis](https://www.servicenow.com/docs/c6onH8TcyEFHURO~bW6ltQ "Automatically generate a post-incident analysis for a security incident that includes a root cause analysis, impact assessment, and learning and recommendations information.") 4. [Generate correlation insights in the ServiceNow Otto panel](https://www.servicenow.com/docs/qZzAapJqX7lFbvGXitwk2g "Generate correlation insights from the ServiceNow Otto panel to help you connect past events to the security incident that you're working on.") 5. [Generate a quality assessment report](https://www.servicenow.com/docs/Q2_pW7f_bPvAjJbRHkFNrg "Generate a quality assessment report for a security incident using a predefined rule set.") for a security incident 6. [Generate closure notes](https://www.servicenow.com/docs/pXVAlxhX7GSQFS1O8Rvm5A "Automatically generate a draft of the closure notes for a security incident when you close it. The draft is editable and will be reviewed before closing the security incident, and it can be used or modified as needed. Closure notes provide information about the resolution of a security incident to other analysts, managers, and key stakeholders.") Automatically generate the closure notes for a security incident. 7. [Request generative AI skills](https://www.servicenow.com/docs/UUr36QoktFipn5qz3~iCLg "Request a security incident summary or closure notes from the ServiceNow Otto panel.") Generate summaries and closure notes from the ServiceNow Otto panel. Note: The security incident recommended actions and post-incident analysis skills are not available from the ServiceNow Otto panel. 8. [Customize a skill](https://www.servicenow.com/docs/XvdhCh9aFeSYEcFb~07g7Q "Customize some of the input fields of a generative AI skill to suit the requirements of your environment.") Customize the input fields of a skill to suit the requirements of your environment. {#using-now-assist-for-security__cf-using-parent-steps-ol} * **[Summarize a security incident](https://www.servicenow.com/docs/67mJqPIXSt6LJAgndHOkvw)** Understand the context of a security incident with the Security Incident summarization generative AI skill. * **[Generate closure notes](https://www.servicenow.com/docs/pXVAlxhX7GSQFS1O8Rvm5A)** Automatically generate a draft of the closure notes for a security incident when you close it. The draft is editable and will be reviewed before closing the security incident, and it can be used or modified as needed. Closure notes provide information about the resolution of a security incident to other analysts, managers, and key stakeholders. * **[Generate recommended actions](https://www.servicenow.com/docs/5N86Ug6cr~8OdH8e0~KYyQ)** Automatically generate the next steps your analysts can take to help them close a security incident in the Security Incident Response Workspace. The recommended steps are based on existing security incidents and knowledge articles. * **[Generate a post-incident analysis](https://www.servicenow.com/docs/c6onH8TcyEFHURO~bW6ltQ)** Automatically generate a post-incident analysis for a security incident that includes a root cause analysis, impact assessment, and learning and recommendations information. * **[Exploring correlation insights](https://www.servicenow.com/docs/EQrIE9KnXh_z4QnztNxocg)** Generate correlation insights to avoid duplicating your investigation into affected users, configuration items, and observables and resolve the security incident that you're working on quickly. You select the criteria from a security incident that you want to base the correlation insights on. * **[Exploring Security incident quality assessment](https://www.servicenow.com/docs/TUqRUq8AHgLiJ0RBBHiZpQ)** Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules. * **[Request generative AI skills](https://www.servicenow.com/docs/UUr36QoktFipn5qz3~iCLg)** Request a security incident summary or closure notes from the ServiceNow Otto panel. **Related concepts** * [Using agentic AI workflows](https://www.servicenow.com/docs/dMR7l7qENhmhEiF25iLwrg "Use the Security Incident Response AI agentic workflows to complete security incident tasks.") * [Working with Security Incident Records](https://www.servicenow.com/docs/TFUzgIYau3h8zmc3_FkDEA "The Security Incident Record consists of the following.") * [Security Incident Playbook](https://www.servicenow.com/docs/Or37s267AkF~R9MUgzRYiQ#security-incident-playbook "Invoke the security incident playbook flow automatically or manually.") * [Prerequisites for the Playbooks](https://www.servicenow.com/docs/POSOIYPbrf55BhB5oZj_Tw "You need the following roles and plugins to build the Playbooks.") * [Rebuilding existing playbooks in Workflow Studio](https://www.servicenow.com/docs/Gxrs6Kmn6bmfB680yQYz3A "You can’t convert existing flows directly into playbooks in Workflow Studio. Each flow designer step that creates a response task to guide the analyst must be broken down into separate actions or subflows.") * [Activity Definitions](https://www.servicenow.com/docs/IMGNwpKoJREVXgsdWM6BEg "The ServiceNow AI Platform provides a few activity definitions within the base system. In addition, for the playbooks that SIR Workspace base system, there are a few activity definitions defined in the base system under Enterprise Security Case Management PAD Commons application.") * [Sample Playbooks for SIR Workspace](https://www.servicenow.com/docs/LJZS56n6O87_ZQicnhxpTw "You can create or configure playbooks for SIR Workspace quickly and easily without writing complicated code. You can use these playbooks to resolve security threats in a step-by-step manner. You can invoke the security incident playbook flow automatically or manually.") * [Working with MSI Records](https://www.servicenow.com/docs/EzBRz3gfWLnRuxl~O9DXuA "Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization.") * [Working with Form UI actions](https://www.servicenow.com/docs/BiVNOVqIU5VY5t0VA35xHg "Following are the UI actions that are displayed on the security incident form.") **Related tasks** * [Security Incident Closure workflow](https://www.servicenow.com/docs/eUcWbP2pHl3bZk_3cBQ5EA "Close the security incident by updating the incident state.") * [Handle security incidents using Advanced Work Assignment](https://www.servicenow.com/docs/T3UyVFGugN7M9V4Ol1CCLg "Handle security incidents assigned to you in SIR Workspace using Advanced Work Assignment.")