Use capabilities in SIR Workspace

  • リリースバージョン: Australia
  • 更新日 2026年03月12日
  • 所要時間：1分

    • Use the capabilities created using Now Assist for Security Incident Response integrations in the SIR Workspace.

    始める前に

    Role required: sn_si_int_kit.integration_creator or sn_si.analyst

    手順

    1. Navigate to Workspaces > Security Incident Response Workspace.
    2. From the list view, select any security incident record.
    3. Select the Investigation tab.
    4. Select Associated Observable or Configuration Items.
      The capabilities applicable to observables are available under the Associated Observable section. The capabilities applicable to configuration items are available under the Configuration Items section.
    5. Select the observables on which you want to execute the capabilities.
    6. Select the Capability button.

      A pop-up appears with the list of applications.

      Select capability
    7. Select the application to execute the capability.

      The run() method is called from the SIR Workspace.