---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Monitor AI asset security events and recommendations

# Monitor AI asset security events and recommendations {#ariaid-title1}

Release version: Brazil  
Updated October 26, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Triage and resolve AI recommendations and AI asset security events to optimize AI asset security.

## Before you begin

Role required: AI steward \[sn_ai_governance.ai_steward\]

## Procedure

1. Navigate to AI Control TowerGovernSecurity.
2. On the Overview tab, go to Your top recommendations.  
   Note:  
   In a domain-separated instance, Your top recommendations isn't shown. Instead, go to Security events detected to review AI asset security events.
3. In Your top recommendations, review the AI recommendations and security tasks assigned to you.  
   Confirm that these recommendations align with your specific needs before taking action.
4. On any AI recommendation, select Open to view all associated AI asset security events.  
   To mark a recommendation as resolved, select Complete. To remove it, select Delete and confirm. You can't restore a deleted recommendation. For more information, see [Activity Center](https://www.servicenow.com/docs/VyUySfnSO44PTJ3pSP7iug "Track and act on the governance work generated across AI Control Tower from a single workspace, including lifecycle tasks, security tasks, change and offboarding requests, and AI recommendations.").
5. On any AI asset security event, select an option from the Actions menu.

   | Option | Description |
   | Create Asset Task (shown as Create SIR if the Security Incident Response plugin is installed) | Create a task to remediate the security event. |
   | View asset details | View the asset record in inventory. |
   | View containment options | Review AI agent containment (kill switch), such as deactivating the agent. |
   | View source log | See the input, output, and reason the security event was captured. Sensitive data, such as credit card numbers, are masked. You can also view the source trace record for the event. |
   | View map | See the AI asset in the agent map. |
   |-|-|

   {#gov-sec-use-events__choicetable_kbs_cjn_1lc}  
   The Incident column shows the task linked to the security event, if it exists. To find events, search the list by keyword, or filter it by category, threat type, AI asset, provider, detected date range, or severity. If you view asset details for an AI agent, and it has malicious activity detected, a banner appears.  

6. In the malicious activity banner, select View containment options to address the AI agent issue.  
   For more information, see [Contain AI agents manually using kill switch protocol](https://www.servicenow.com/docs/9QJJbaq_CIoqKdvvvTvYTw "Deactivate or reinstate AI agents using kill switch protocol to help improve your security posture and stop malicous activity.").
{#gov-sec-use-events__steps_r3g_n4n_1lc}

*[\>]: and then