---
sourceDocument: Brazil Platform Analytics
sourceDocumentLink: https://www.servicenow.com/docs/r/now-intelligence

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform Analytics

ft:clusterId :

    - par

bundleId :

    - par

workflow :

    - Platform


---

# Security Incident Response

# Content pack for Security Incident Response {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Using the Process Mining content pack for Security Incident Response, you can analyze inefficiencies through the life cycle of your security incidents. You can use this information to optimize the processes for your security incidents.

This content pack loads automatically when SIR is installed on your instance and the relevant tables are present. For more information, see [Automatic delivery of content packs](https://www.servicenow.com/docs/NXLuKLvy10aciHUbaN_NjQ "Starting with the Brazil release, most Process Mining content packs are delivered automatically with Process Mining and no longer require manual installation from the ServiceNow Store.").

The content pack also extends coverage to the security incident task table (sn_si_task).

## Templates shipped with content pack {#sir-proc-min-content-pack__temp-sir}

{#sir-proc-min-content-pack__table_template_overview__entry__3}

| Content pack | Template name | Table |
|-|-|-|
| SIR | Standard template for Security Incidents | sn_si_incident |
| Field Service Management | Standard template for Work Orders | wm_order |
| Field Service Management | Standard template for Work Order Tasks | wm_task |
[ ]

{#sir-proc-min-content-pack__table_template_overview}

## What you get with this content pack {#sir-proc-min-content-pack__value-sir}

This content pack analyzes your security incident processes, including related security incident tasks. It gives you visibility into common process issues, such as:

* Incidents that take longer than expected to resolve
* Rework, such as incidents that get reopened or bounced back between teams
* Deviations from the expected process flow
* Work that stalls with a particular team or agent longer than expected

## End user and roles {#sir-proc-min-content-pack__section_wxq_4nl_52c}

If you have the required roles, you can use the Analyst workbench to access the visualized security incident workflow data, and tools for analyzing the data related to security incidents. For more information, see [Analyst workbench page](https://www.servicenow.com/docs/MxfHwegMoCerLgX7sgNN7g "View the visualized process map with tools for managing visualizations and performing analysis tasks from a project's page.").

* Process Mining role: sn_process_mining_analyst
* Security Incident Response role: sn_si_read
{#sir-proc-min-content-pack__ul_gwl_5nl_52c}