--- sourceDocument: brazil Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/delta-zurich-brazil Release : - brazil ft:locale : - en-US ft:publication_title : - brazil Combined Product Files ft:clusterId : - delta3bz bundleId : - delta3bz --- # Combined ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes for upgrades from Zurich to Brazil # Combined ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes for upgrades from Zurich to Brazil {#ariaid-title1} Release version: Brazil Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined ServiceNow Otto for Security Incident Response (SIR) Release Notes from Zurich to Brazil This consolidated release notes document covers all updates, new features, changes, and important upgrade information for ServiceNow Otto for Security Incident Response (SIR) between the Zurich and Brazil release families. It assists ServiceNow customers in preparing for upgrades by summarizing enhancements and adjustments across these releases, focusing on AI-driven capabilities and agentic workflows designed to improve security incident management. Show full answer Show less ## Important Upgrade Information * Upon upgrading to Brazil, several Now Assist AI skills, agents, and agentic workflows are activated by default, including those for incident summarization, resolution notes generation, post-incident analysis, and security operations metrics analysis. * Activation of these AI skills occurs on a per-skill basis if previously unconfigured; however, if a skill was manually deactivated or role configurations were altered, it remains inactive post-upgrade. * Dependencies for the SIR application update automatically during the upgrade process. * The AI Search application must be enabled for the recommended actions skill to function correctly. Customers should verify AI Search status and contact support if it is not enabled. * Additional role configuration is required for agentic workflows and AI agents to execute properly. Users must assign the necessary installed roles when setting user access security controls. ## Key Features Introduced (Zurich to Brazil) * **Resolve a Security Incident:** Analysts can enhance incident resolution plans by incorporating existing runbooks into the AI runbooks section, providing richer context for AI-generated plans. * **Security Incident Quality Assessment:** Generative AI produces detailed quality assessment reports based on predefined natural language rules, helping assess incident handling quality. * **Shift Handover Report Generation:** AI agents assist analysts by automatically populating shift handover reports with relevant security incident details, refining content through analyst feedback. * **Agentic Workflow for Security Operations Metrics:** Enables security managers to analyze team performance metrics such as case volume, mean time to assign (MTTA), and mean time to resolve (MTTR), with AI-driven suggestions for improvement. * **Enhanced Correlation Insights:** Correlation insights can be generated for multiple configuration items and affected users beyond the primary CI, accessible from the Investigation tab in the Security Incident Response Workspace. * **Security Incident Resolution Agentic Workflow:** Analysts can interact with AI agents in natural language to generate resolution plans and assist in resolving security incidents by leveraging runbooks, knowledge articles, and past incidents. ## Changes to Existing Features * The Resolve Security Incident workflow now includes Sightings search and Isolate host capabilities to support incident resolution. * A new "Show More" UI card improves visibility and context for recommended actions, aiding analysts in investigation and analysis. ## Removed and Deprecated Features No features or functionality were removed or deprecated between Zurich and Brazil releases. ## Activation and Additional Requirements * ServiceNow Otto for Security Incident Response (SIR) is available via the ServiceNow Store and requires installation through this channel. * No additional requirements, browser changes, accessibility updates, or localization considerations were introduced between Zurich and Brazil releases. ## Practical Impact for ServiceNow Customers Upgrading to the Brazil release enhances your security incident response capabilities with AI-powered automation and analytics. The default activation of AI skills and workflows accelerates incident resolution and quality assessment, while agentic workflows provide actionable insights and assist in managing security operations metrics. Proper role configuration and enabling AI Search are critical steps to fully leverage these capabilities. This consolidated upgrade ensures a smoother transition by automating dependencies and providing clear guidance on new features and changes. Consolidated page of all release notes for ServiceNow Otto for Security Incident Response (SIR) (SIR) from Zurich to Brazil. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Zurich to Brazil. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading ServiceNow Otto for Security Incident Response (SIR) (SIR) to Brazil Before you upgrade to Brazil, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__2} | Release | Release notes | |-|-| | Zurich | Upgrade information : Note: The following Now Assist skills, agents, and agentic workflows for ServiceNow Otto for Security Incident Response (SIR) are activated by default: Skills * Security incident summarization * Resolution notes generation * Post incident analysis * Security incident recommended actions * Correlation insights generation * Security incident quality assessment * Natural language condition evaluator * Generate content for shift handover * Quality assessment report NACM * Security incident resolution plan * Security operations metrics analysis Agentic workflows * Wrap up security incident * Resolve security incident * Generate SIR shift handover report * Analyze security operations metrics Agents * EDR AI agent * Exchange online integration handling AI agent * Observable analysis AI agent * Security incident activities handling AI agent * Security incident resolution AI agent * Security incident retrieval AI agent * Security incident shift handover AI agent * Security incident wrap up generator AI agent * Security metrics analysis AI agent For more information, see [AI assets on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=zurich&ft:locale=en-US) Note: Upgrading the Now Assist plugins activates any designated skills that were previously untouched by the customer. * If you installed the plugins for a skill but never configured it, meaning you never activated it nor adjusted associated roles, any skill on by default is activated on a per skill basis when upgrade. * If you previously toggled a skill from active and then back to inactive, or updated any roles for that skill, that skill remains inactive when upgrading. * You maintain full control over deactivating individual skills at any time after activation. When you update the ServiceNow Otto for Security Incident Response (SIR) (SIR) application, the dependency applications are automatically updated. For more information about required applications for ServiceNow Otto for Security Incident Response (SIR), see [Supporting information](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-security-incident&family=zurich&ft:locale=en-US). The AI Search application must be enabled so that the recommended actions skill works for security incidents with ServiceNow Otto for Security Incident Response (SIR). To verify that AI Search is enabled on your instance, navigate to AllAI SearchAI Search Status. Contact support if the page indicates that AI Search isn't enabled. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## New features Between your current release family and Brazil, new features were introduced for ServiceNow Otto for Security Incident Response (SIR) (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__10} | Release | Release notes | |-|-| | Zurich | [Resolve a security incident](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Help enhance incident resolution plan generation by adding your existing runbooks to the AI runbooks section within the Security incident resolution plan skill. The existing runbooks provide additional context to the skill. [Role configuration required for agentic workflows and AI agents](https://www.servicenow.com/docs/access?context=aia-role-masking&family=zurich&ft:locale=en-US) : Agentic workflows and AI agents included with your applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they will not execute. See the documentation for the agentic workflow or AI agent for the specific roles you must add. [Explore Security incident quality assessment](https://www.servicenow.com/docs/access?context=na-sir-quality-assessment&family=zurich&ft:locale=en-US) : Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules. [Generate SIR Shift Handover Report](https://www.servicenow.com/docs/access?context=add-incidents-shifthandover-ai-agent&family=zurich&ft:locale=en-US) : The AI agent helps add security incident details to a shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. The AI agent can fetch details of the security incident and identify if the analyst has access to the shift handover record. The AI agent can generate content for each section of the shift handover record and asks for analysts feedback on the content. The AI agent refines the content based on the feedback and saves the content to the records on approval. [Use agentic workflows](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=zurich&ft:locale=en-US) : The analyze security operations metrics agentic workflow helps security managers to analyze their teams' performance. * Generate metrics for Security Incident Response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) for a date range of your choosing. * Request suggestions for how to improve MTTR, MTTA, and volume based on your metrics. [Enhancements to correlation insights in ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/access?context=generating-insights-for-now-assist-for-security&family=zurich&ft:locale=en-US) : You can generate and view results for correlation insights in the Security Incident Response Workspace. * Correlation insights aren't limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident. * You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace. * You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users. * Results are displayed in a modeless dialog that you can size and move. [Using the security incident resolution agentic workflow](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Use the security incident resolution agentic workflow to close your security incidents. Analysts can chat with AI agents in natural language to resolve the security incidents. The AI agent analyzes the incident details, existing runbooks, Knowledge articles, and past similar security incidents as inputs, and provides a resolution plan. The AI agent also assists the analysts to resolve the security incident. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Changes Between your current release family and Brazil, some changes were made to existing ServiceNow Otto for Security Incident Response (SIR) (SIR) features. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__18} | Release | Release notes | |-|-| | Zurich | [Resolve a security incident](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Use the Sightings search and Isolate host capabilities in the Resolve security incident workflow to help resolve security incidents. [Generate recommended actions](https://www.servicenow.com/docs/access?context=generate-recommended-actions-now-assist-for-security&family=zurich&ft:locale=en-US) : A new Show More UI card has been introduced to enhance the visibility of recommended actions. As a security analyst, you can now access additional context along with further recommended steps to assist in the analysis and investigation of security incidents. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Removed Between your current release family and Brazil, some ServiceNow Otto for Security Incident Response (SIR) (SIR) features or functionality were removed. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__26} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Deprecations Between your current release family and Brazil, some ServiceNow Otto for Security Incident Response (SIR) (SIR) features or functionality were deprecated. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__34} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Activation information Review information on how to activate ServiceNow Otto for Security Incident Response (SIR) (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__42} | Release | Release notes | |-|-| | Zurich | Activation information : Install ServiceNow Otto for Security Incident Response (SIR) by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: ServiceNow Otto for Security Incident Response (SIR) is available in ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Additional requirements If any additional requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__50} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__58} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for ServiceNow Otto for Security Incident Response (SIR) (SIR), such as specific requirements or compliance levels. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__66} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__74} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__82} | Release | Release notes | |-|-| | Zurich | [Zurich Patch 7](https://www.servicenow.com/docs/access?context=zurich-patch-7&family=zurich&ft:locale=en-US) * Help enhance incident resolution plan generation by adding your existing runbooks to the AI runbooks section within the Security incident resolution plan skill. The existing runbooks provide additional context to the skill. * Use the Sightings search and Isolate host capabilities in the Resolve security incident workflow to help resolve security incidents. [Zurich Patch 5](https://www.servicenow.com/docs/access?context=zurich-patch-5&family=zurich&ft:locale=en-US) * Review changes to Now Assist usage measurement. [Zurich Patch 4](https://www.servicenow.com/docs/access?context=zurich-patch-4&family=zurich&ft:locale=en-US) * Some Now Assist skills are now turned on by default. * Use generative AI to create a quality assessment report of a security incident. * Additional role configuration required for agentic workflows and AI agents included with your applications. [Zurich Patch 1](https://www.servicenow.com/docs/access?context=zurich-patch-1&family=zurich&ft:locale=en-US) * Help analysts to add security incidents details to the Shift Handover report by chatting with AI agents in the Now Assist panel. Zurich Early Availability * Help your analysts to gain insight into security incident record metrics with an agentic workflow. Chat with AI agents in natural language from the Now Assist panel. * Help your analysts to resolve security incidents by chatting with AI agents in the Now Assist panel where the AI agent can assist in providing a resolution plan. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] *[\>]: and then