---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Inputs and triggers

# Inputs and triggers {#ariaid-title1}

Release version: Australia  
Updated July 30, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.

## Inputs and triggers {#input-triggers-now-assist-security-incident__section_bkt_wh3_1cc}

Inputs identify the data used for a skill. Inputs include the table and fields used to generate a security incident summary. A trigger initiates an action. For example, triggers determine when the system generates a summary.

You can modify inputs and triggers, but you can't modify a skill's data source. The data source contains the tables and fields that the skill relies on.

## Security incident summarization skill {#input-triggers-now-assist-security-incident__section_lqj_d33_1cc}

Inputs for the security incident summarization skill identify the table and fields used when a security incident summary is generated. The following table lists the inputs for the Security Incident summarization skill from the
Choose Input page in the AI Admin Hub console.
{#input-triggers-now-assist-security-incident__table_arz_fk3_1cc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. |
| Input fields | * Short description * Description * State * Priority * Work notes * Additional comments {#input-triggers-now-assist-security-incident__ul_o2w_jk3_1cc} |
| Related Input tables | * Affected CIs - configuration item * Affected Users - Users * Security Incident Response Task - Short description * State - Any state other than Cancelled. * Associated Observables - Observable finding is Malicious or Suspicious. {#input-triggers-now-assist-security-incident__ul_nfq_pk3_1cc} |
[ ]

{#input-triggers-now-assist-security-incident__table_arz_fk3_1cc}

## Resolution notes generation skill {#input-triggers-now-assist-security-incident__section_pk4_bl3_1cc}

Inputs for the Resolution notes generation skill identify the table and fields that are used when the resolution notes are generated for a security incident. The following table lists the inputs for the resolution notes generation
skill from the Choose Input page in the AI Admin Hub console.
{#input-triggers-now-assist-security-incident__table_il3_sfj_1cc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. |
| Input fields | * Short description * Description * Work notes * Additional comments {#input-triggers-now-assist-security-incident__ul_pq5_xfj_1cc} |
[ ]

{#input-triggers-now-assist-security-incident__table_il3_sfj_1cc}

## Security incident recommended actions generation skill {#input-triggers-now-assist-security-incident__section_q44_2kd_ycc}

{#input-triggers-now-assist-security-incident__table_b4z_gkd_ycc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. |
[ ]

{#input-triggers-now-assist-security-incident__table_b4z_gkd_ycc}

## Post incident analysis generation skill {#input-triggers-now-assist-security-incident__section_rby_3kd_ycc}

{#input-triggers-now-assist-security-incident__table_sp5_kkd_ycc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. |
[ ]

{#input-triggers-now-assist-security-incident__table_sp5_kkd_ycc}

## Correlation insights generation skill {#input-triggers-now-assist-security-incident__section_l1b_cl5_pdc}

Your correlation insights for a security incident can contain records from the following tables, but you must have permission to access these tables and records.  
{#input-triggers-now-assist-security-incident__table_ytl_2l5_pdc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. Configuration item \[cmdb_ci\] table. Incident \[incident\] table. Change request \[change_request\] table. Problem \[problem\] table. Vulnerable item \[sn_vul_vulnerable_item\] table. Associate observable \[sn_ti_observable\] table. |
[ ]

{#input-triggers-now-assist-security-incident__table_ytl_2l5_pdc}

## Security Incident Quality Assessment {#input-triggers-now-assist-security-incident__section_ksn_tc4_jhc}

Your Quality Assessment report for a security incident can contain records from the following tables, but you must have permission to access these tables and records.
{#input-triggers-now-assist-security-incident__table_k2k_zc4_jhc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. Configuration item \[cmdb_ci\] table. Task CI \[task_ci\] Associated Observable \[sn_ti_observable\] Affected Users \[sn_si_m2m_task_affected_user\] Security Incident Task \[sn_si_task\] Task SLA \[task_sla\] Email \[sys_email\] Playbook Activities: sys_pd_activity_context |
[ ]

{#input-triggers-now-assist-security-incident__table_k2k_zc4_jhc}