Configure a skill for Now Assist for Security Incident Response

  • Release version: Zurich
  • Updated December 3, 2025
  • 4 minutes to read

    • Configure and review the details for a skill in the Guided Setup. You can deactivate, edit, and reactivate a skill from the Guided Setup.

    Before you begin

    Role required: admin

    About this task

    Important:
    Some Now Assist skills, agents, and agentic workflows are now turned on by default. The new default behavior works as follows:
    New customers
    When you install a Now Assist product, designated skills, agents, or agentic workflows are turned on automatically.
    Existing customers who are upgrading (starting with Zurich Patch 4)
    There is no change to skills, agents, or agentic workflows that are currently enabled and customized.

    An AI asset is turned on if:

    • The Now Assist plugin is installed, but the asset was never turned on.
    • An admin has never adjusted roles for the skill.
    An AI asset is not turned on if:
    • The asset was previously turned on, and then turned off again.
    • An admin has adjusted roles for the asset.
    For more information, see Now Assist skills, agents, and agentic workflows on by default.

    Procedure

    1. Navigate to All > Now Assist Admin > Skills.
    2. With Technology selected in the navigation panel, select Security Operations from the list.
      The Now Assist skills for Security Operations page is displayed. The Now Assist for Security Incident Response skills are active by default and supported for Now Assist for Security Incident Response.
      • Security incident recommended actions

        The AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to All > AI Search > AI Search Status. Contact support if the page indicates AI Search is not enabled.

      • Post incident analysis
      • Correlation insights generation
      • Security incident summarization
      • Resolution notes generation
      • Security operations metrics analysis
      • Generate content for shift handover
      • Security Incident Quality Assessment

      The following steps are optional. You must deactivate a skill to configure it using the Guided Setup.

    3. Select Deactivate skill for the skill that you want to configure.
    4. Follow the steps to configure and reactivate a skill using the Guided Setup.
      Note:
      Some skills do not require all the configuration steps listed below. Select only the tasks that are displayed in the left panel and follow the prompts. After you have completed the tasks, activate the skill.
      1. In the navigation panel, select Choose input to configure the inputs or triggers for the selected skill.

        Some, or all of the following input templates for the skill are listed: Work In Progress, Review, and Closed. The Work In Progress template is selected.

        You might prefer to leave these input templates in their default settings until you become familiar with how the skills for Now Assist for Security Operations work.

        However, for some of the skills you can modify certain related table fields, test the prompt on a security incident, define the availability of the skill, and choose where the skill is displayed.

        For the Security Incident Quality Assessment skill, select Assessment Rules to activate or deactivate the current rules, or to add a new rule.

        If you choose to modify fields, select only the supported options from the lists provided as part of your input data.

        If you modify the inputs or triggers for a skill, you determine how and when a skill is used. You can't modify a skill's input data source. The data source contains the tables and fields that the skill relies on. However, you can copy a skill and customize it. For more information, see Customize a Now Assist for Security Incident Response skill.

    5. Select Save and continue to go to the next step in the Guided Setup.
    6. Optional: Test the prompt on a security incident record.
    7. Select Save and continue to go to the next step in the Guided Setup.
    8. Optional: Choose one of the following options to define availability.
      OptionDescription
      Skill is always available Skill is always available to users.
      Customize skill availability The skill is available only when certain conditions are met (Default).

      Use the condition builder to set your conditions.
    9. Select Save and continue to go to the next step in the Guided Setup.
    10. Choose Select display to determine where you'd like to display the skill.
      OptionDescription
      In-product Now Assist skills are displayed on forms and workspaces.
      User roles Select the expand icon (Expand icon.)
      Now Assist panel Now Assist skills are available in the Now Assist panel.
      Note:
      If you don't see this option, you must activate the Now Assist panel. For more information, see Turn on the Now Assist panel.

      The security incident recommended actions and post-incident analysis skills are not available from the Now Assist panel.
    11. Select Save and continue to go to the next step.
    12. Optional: Add or remove roles.

      By default, the sn_si.analyst and sn_si.manager roles are added and can see the results from automated skills generation. You can add or remove roles only if you Customize a Now Assist for Security Incident Response skill.

    13. Review your choices and select Activate to complete the configuration for the skill.
    14. Select Return to Security Incident.
      The skill is displayed in the Active skills section.