---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Explore

# Exploring ServiceNow Otto for Security Incident Response (SIR) {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Exploring ServiceNow Otto for Security Incident Response (SIR)

ServiceNow Otto for Security Incident Response (SIR) leverages generative AI skills and intelligent workflows to help security analysts efficiently triage, investigate, and close security incidents.
This solution provides concise summaries, recommended next steps, post-incident analysis, performance metrics, and various reports to streamline and enhance incident management processes.
Show full answer Show less  

## Key Features

* **Incident Summaries:** Quickly review security incident details, observations, key actions, and closure information in a concise, easy-to-read format to expedite triaging.
* **Recommended Next Steps:** Generate actionable recommendations within workflows to assist analysts and managers in progressing incident resolution.
* **Closure Notes Generation:** Automatically draft closure notes based on remediation and containment activities, which can be edited before finalizing.
* **Post-Incident Analysis:** Produce root cause analysis, impact assessments, and lessons learned during incident closure.
* **Correlation Insights:** Link current incidents with past events involving the same users, configuration items, or observables to improve incident context.
* **Performance Metrics:** Use an AI agent to generate Security Operations Center (SOC) performance analyses and receive improvement suggestions (requires activation of the Security operations metrics analysis skill).
* **Quality Assessment Reports:** Generate reports to assess the quality of security incident handling.
* **Natural Language Queries:** Ask questions about security incident data in natural language and receive insights without needing to build complex queries.
* **Customization:** Administrators can customize generative AI skills for summaries and closure notes to fit organizational needs, including modifying related fields and skill availability.

## Users and Benefits

* **Security Analysts and Managers:** Benefit from accelerated incident triaging, enhanced situational awareness, AI-generated summaries, actionable recommendations, and automated closure documentation to improve efficiency and accuracy.
* **Security Managers:** Gain insights into team performance, incident quality, and receive data-driven recommendations for operational improvements.
* **Administrators:** Can tailor AI skills to align with organizational workflows and reporting preferences, enhancing usability and relevance.

## Practical Application

By integrating ServiceNow Otto for SIR, customers can expect a streamlined security incident lifecycle that reduces manual effort, improves incident understanding, fosters collaboration among analysts and stakeholders, and supports data-driven decision-making. This enables faster incident resolution and higher quality outcomes in security operations.  
Security analysts can use intelligent workflows and ServiceNow generative AI skills to triage, investigate, and close security incidents with ServiceNow Otto for Security Incident Response (SIR).

## ServiceNow Otto for Security Incident Response (SIR) overview {#exploring-now-assist-security-incident__cf-exploring-parent-overview}

With generative AI skills and agentic workflows, security analysts can complete the following tasks:

* Summarize security incident details and review the context quickly in a concise, easy-to-read format.
* Generate recommended next steps for a security incident.
* Generate post-incident analysis data.
* Generate performance metrics for your remediation teams with an agentic workflow.For this feature, the Security operations metrics analysis skill is activated for use with an AI agent. See [Analyze security operations metrics](https://www.servicenow.com/docs/HuSSfJwhDubN_GgEp8~SjQ "Chat with an AI agent from the ServiceNow Otto panel to help you gain insight into how efficiently your security analysts are working with security incidents resolution.") for more information.

* Generate a resolution plan.
* Generate closure notes.
* Generate correlation insights.
* Generate shift handover reports.
* Generate a quality assessment report for a security incident.
* Ask questions about security incident data in natural language and get insights with an agentic workflow.

{#exploring-now-assist-security-incident__ul_yls_52d_ycc}

Security analysts can share findings, incident details, and closure notes with other analysts, managers, and key stakeholders.

## Users {#exploring-now-assist-security-incident__cf-exploring-parent-users}

{#exploring-now-assist-security-incident__table_vxr_4cq_xbc__entry__2}

| User | Description |
|-|-|
| Security analysts and managers | Preview security incident details, see their potential impact, and view the key remediation actions already taken with security incident summaries using generative AI. Summaries and recommended next steps (actions) give analysts and managers a head start with their investigations and help with closing security incidents. Automatically generate a draft of closure notes using generative AI. Closure notes for security incidents are created based on remediation and containment activities, and other details related to their closure. |
[Table 1. Users]

{#exploring-now-assist-security-incident__table_vxr_4cq_xbc}

## Benefits {#exploring-now-assist-security-incident__cf-exploring-parent-benefits}

{#exploring-now-assist-security-incident__table_yxr_4cq_xbc__entry__3}

| Benefit | Feature | Users |
|-|-|-|
| Expedite triaging of security incidents with long activity streams by reviewing work notes and contextual information in a concise format. | Generate summaries for security incidents that include the following information: * Issue * Details * Observations * Key actions taken * Closure details {#exploring-now-assist-security-incident__ul_jys_vlv_zbc} | * Security analysts * Security managers {#exploring-now-assist-security-incident__ul_ad1_mpq_1cc} |
| Automatically generate a draft of closure notes for a security incident when it's ready for closure. You can modify any content generated by the AI skill by editing it, removing it, or adding your own notes before you close the security incident. | Generate security incident closure notes | * Security analysts * Security managers {#exploring-now-assist-security-incident__ul_qww_mpq_1cc} |
| Generate recommended next steps within the workflow upon request to help you close a security incident. | Generate security incident recommended actions | * Security analysts * Security managers {#exploring-now-assist-security-incident__ul_ygd_lgd_ycc} |
| Generate a post-incident analysis that includes a root cause analysis, impact assessment, and lessons learned within the workflow of closing a security incident. | Generate post-incident analysis | * Security analysts * Security managers {#exploring-now-assist-security-incident__ul_jmg_5hd_ycc} |
| Connect current incidents to past events that involve the same affected users, configuration items (CIs), or observables. | Generate correlation insights | * Security analysts * Security managers {#exploring-now-assist-security-incident__ul_kzs_dk5_pdc} |
| Gain insight into how efficiently your security analysts are working with security incidents by using an AI agent. | Generate a Security Operations Center (SOC) performance analysis and get suggestions for improvement from an AI agent. Note: You must activate the Security operations metrics analysis skill to use the Analyze security operations metrics agentic workflow. | Security managers |
| Learn about the details of a security incident by accessing summaries and closure notes from the ServiceNow Otto panel. | Access the generative AI summary and closure notes from the ServiceNow Otto panel. Enter requests for more information about security incidents in the panel. | * Security analysts * Security managers {#exploring-now-assist-security-incident__ul_owp_3pq_1cc} |
| Generate a quality assessment report for a security incident. | Generate Quality Assessment report | Security managers |
| Get answers about your security incident data without composing queries or knowing the underlying report structure. | SIR data analysis | * Security analysts * Security managers {#exploring-now-assist-security-incident__ul_gkm_7kq_x1c} |
| Customize the generative AI skills for summaries and closure notes to suit your needs. | Copy a skill and modify select related table fields, define the availability of the skill, and choose where the skill is displayed. | Admin users |
[Table 2. ServiceNow Otto for Security Incident Response (SIR) features]

{#exploring-now-assist-security-incident__table_yxr_4cq_xbc}

## What to explore next {#exploring-now-assist-security-incident__cf-exploring-parent-links}

To learn more about configuring and using ServiceNow Otto for Security Incident Response (SIR), see:

* [Configuring ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/uI~W0N2S2hkraUvWti_byw "The ServiceNow Otto for Security Incident Response (SIR) application is supported in the Security Incident Response Workspace and in the legacy Core UI (UI16). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR).")
* [Summarize a security incident](https://www.servicenow.com/docs/StdbZO7beVrPisqduahzrQ "Understand the context of a security incident with the Security Incident summarization generative AI skill.")
* [Generate closure notes](https://www.servicenow.com/docs/9xMQ~KfzT1f2phUViRmNAw "Automatically generate a draft of the closure notes for a security incident when you close it. The draft is editable and will be reviewed before closing the security incident, and it can be used or modified as needed. Closure notes provide information about the resolution of a security incident to other analysts, managers, and key stakeholders.")
* [Generate correlation insights](https://www.servicenow.com/docs/KYvwWz7qSqOd4gOGUPc_9A "Generate correlation insights to avoid duplicating your investigation into affected users, configuration items, and observables and resolve the security incident that you're working on quickly. You select the criteria from a security incident that you want to base the correlation insights on.")
* [Generate recommended actions](https://www.servicenow.com/docs/Rr_BjVmCiybctu1FzE1Rjw "Automatically generate the next steps your analysts can take to help them close a security incident in the Security Incident Response Workspace. The recommended steps are based on existing security incidents and knowledge articles.")
* [Generate a post-incident analysis](https://www.servicenow.com/docs/Oju1YvxGwfqSueDb_4mHlg "Automatically generate a post-incident analysis for a security incident that includes a root cause analysis, impact assessment, and learning and recommendations information.")
* [Analyze security operations metrics](https://www.servicenow.com/docs/HuSSfJwhDubN_GgEp8~SjQ "Chat with an AI agent from the ServiceNow Otto panel to help you gain insight into how efficiently your security analysts are working with security incidents resolution.")
* [Analyze security incident data](https://www.servicenow.com/docs/8UADlq6i4O3HdrUiLxhPuQ "Analyze and get insights into your security incident data using available prompts or natural language queries from the ServiceNow Otto panel.")
* [Inputs and triggers](https://www.servicenow.com/docs/C~u8QxEG8itpW3u9drW2PQ "You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.")
{#exploring-now-assist-security-incident__ul_zxr_4cq_xbc}