---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Configure ServiceNow Otto for Security Incident Response (SIR)

# Configuring ServiceNow Otto for Security Incident Response (SIR) {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Configuring ServiceNow Otto for Security Incident Response (SIR)

The ServiceNow Otto for Security Incident Response (SIR) application enhances security incident management by integrating generative AI capabilities within the Security Incident Response Workspace and the legacy Core UI (UI16).
Configuration is centralized in the AI Admin Hub console, which streamlines installation, setup of AI skills, and management of permissions.
This solution assists security teams by automating incident summarization, resolution notes, recommended actions, and post-incident analysis, improving efficiency and decision-making.
Show full answer Show less  

## Key Features

* **Role-Based Access Control:** AI agents use role masking to restrict access to authorized users. Roles included with the application must be configured in security controls to enable access.
* **Generative AI Skills and Agentic Workflows:** Skills like security incident summarization (supporting all incident states except Draft), resolution notes generation, security operations metrics analysis, recommended actions (requires AI Search enabled), correlation insights, post-incident analysis, shift handover content generation, resolution planning, quality assessment, and SIR data analysis.
* **AI Admin Hub Console:** Central interface for installing the Otto for SIR application, configuring generative AI skills, managing agentic workflows, and controlling data sharing preferences.
* **Automatic Dependency Updates:** When updating the Otto for SIR application, all dependent applications update automatically to maintain compatibility.
* **Customizable Skills:** Inputs and triggers of AI skills can be tailored to fit organizational workflows and requirements through the Guided Setup.
* **Data Sharing and Privacy Controls:** Customers can opt out of sharing instance data with the ServiceNow AI development program via the AI Admin Hub console to protect sensitive information.

## Practical Configuration Steps

* Install the ServiceNow Otto for Security Incident Response (snsecgenai) and Security Incident Response Core (snsi) applications.
* Use the AI Admin Hub console's Guided Setup to activate, configure, deactivate, or customize generative AI skills and workflows.
* Ensure AI Search is enabled to utilize recommended actions effectively; verify via the AI Search Status page in your instance.
* Adjust security controls to assign appropriate roles for AI agent access, according to your organization's security policies.
* Repeat data sharing opt-out for all instances using Otto functionality if privacy is a concern.

## Related Configuration and Usage Areas

* Configuring views and investigation setups for Security Incident Response records.
* Integrating conference calls and on-call scheduling within SIR.
* Setting up report templates and category management to enhance incident handling.
* Defining risk score calculators and updating system properties to tailor incident prioritization and workflows.
* Creating quick filters for incident and response task lists to improve incident tracking and management.

By leveraging ServiceNow Otto for SIR, customers can automate routine incident response tasks, gain actionable insights from AI-driven analysis, and customize AI behavior to their environment, thereby enhancing the overall efficiency and effectiveness of their security operations.  
The ServiceNow Otto for Security Incident Response (SIR) application is supported in the Security Incident Response Workspace and in the legacy Core UI (UI16). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR).

## Configuration overview {#configuring-now-assist-for-security-operations__cf-config-parent-checklist}

AI agents use [role masking](https://www.servicenow.com/docs/access?context=aia-role-masking&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US) to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see [Define security controls for an AI agent](https://www.servicenow.com/docs/access?context=define-sec-controls-aia&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US).  
Important:  
Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US).

By sharing data with the ServiceNow® AI development program, you provide relevant data to help improve prediction accuracy, user experience, tailor products to your business needs, and reduce hallucinations for your activated ServiceNow Otto skills.

You can opt out of a ServiceNow instance from sharing data from the AI Admin Hub console. See [Opt out of data sharing for Now Assist](https://www.servicenow.com/docs/access?context=opt-out-of-data-sharing-for-now-assist&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US). Repeat the opt-out process for all instances that use the ServiceNow Otto functionality.  
Use the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR). This console contains everything to install the applications and configure the generative AI skills. For additional information, see [Configuring Now Assist Admin features](https://www.servicenow.com/docs/access?context=configuring-na-landing&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US).  
Note:  
When you update the ServiceNow Otto for Security Incident Response (SIR) applications, its dependency applications are automatically updated.

The following table lists the features and skills that you can access from the AI Admin Hub console.  
Note:  
Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US).
{#configuring-now-assist-for-security-operations__table_igy_kpc_1cc__entry__2}

| ServiceNow Otto product | Security incident skills |
|-|-|
| ServiceNow Otto for Security Incident Response (SIR) | Security incident summarization Note: The incident summarization supports security incidents in any state other than Draft. |
| ServiceNow Otto for Security Incident Response (SIR) | Resolution notes generation. |
| ServiceNow Otto for Security Incident Response (SIR) | Security operations metrics analysis |
| ServiceNow Otto for Security Incident Response (SIR) | Security incident recommended actions The security incident recommended actions skill supports security incidents in any state other than Closed and Cancelled. Note: The AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to AllAI SearchAI Search Status. Contact support if the page indicates that AI Search is not enabled. Correlation insights support security incidents in all states. |
| ServiceNow Otto for Security Incident Response (SIR) | Post-incident analysis |
| ServiceNow Otto for Security Incident Response (SIR) | Generate content for shift handover |
| ServiceNow Otto for Security Incident Response (SIR) | Security incident resolution plan |
| ServiceNow Otto for Security Incident Response (SIR) | Security incident quality assessment |
| ServiceNow Otto for Security Incident Response (SIR) | SIR data analysis |
[Table 1. ServiceNow Otto for Security Incident Response (SIR) features and skills in the AI Admin Hub console]

{#configuring-now-assist-for-security-operations__table_igy_kpc_1cc}

1. [Install plugins for ServiceNow Otto](https://www.servicenow.com/docs/access?context=install-now-assist-feature-plugins&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US).

   Install the ServiceNow Otto for Security Incident Response (SIR) application (sn_sec_gen_ai) and Security Incident Response Core \[sn_si\] applications.  
   Note:  
   When you update the ServiceNow Otto for Security Incident Response (SIR) application, its dependency applications are automatically updated.
2. [Configure a skill for ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/PRnO11gOY_zB6Cn595kbog "Configure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup.")

   You can deactivate, configure, and reactivate generative AI skills and agentic workflows in the Guided Setup.
{#configuring-now-assist-for-security-operations__cf-config-parent-tasks-ol}
* **[Configure a skill for ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/PRnO11gOY_zB6Cn595kbog)**   
  Configure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup.
* **[Customize a skill](https://www.servicenow.com/docs/IoT3zkEBXraDD8HHPIs5xw)**   
  Customize some of the input fields of a generative AI skill to suit the requirements of your environment.
* **[Inputs and triggers](https://www.servicenow.com/docs/C~u8QxEG8itpW3u9drW2PQ)**   
  You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.

**Related concepts**   

* [Set up view of SIR Records](https://www.servicenow.com/docs/5oqXpl5ZQX95rBFYUZ490A "This section describes how the related lists are grouped and presented on the SIR Related Records tab for easy navigation.")
* [Configure SI design time investigation](https://www.servicenow.com/docs/1sby0MT9h3eGUBxDrvWd2A "Use this section to configure security incident design time investigation page to add multiple entry points and its associated records within the Security Incident Response Workspace.")
* [SIR Workspace Related Records](https://www.servicenow.com/docs/WBoHHYVMtFC_FBQaS8gJVg#sir-records "This section consists of the related lists items that are grouped into sections such as associated observables and configuration items.")
* [Configure Shift Handover](https://www.servicenow.com/docs/ChdioNYWKDiIGUS9svNvdw "Configure Shift Handover settings to provide complete shift information to the next shift analysts.")
* [Security Incident Response conference call integration](https://www.servicenow.com/docs/jyKkkAE1GmoMN6u1G_GQ2g "The Security Incident Response Conference Call integration enables you to manage and initiate conference call and chat for analysts, managers and affected users.")
* [Configure report templates in Security Incident Response](https://www.servicenow.com/docs/us5lwLFRrvfJI52OD0r74g "You can create report templates that can be used to generate an incident summary or an executive summary for analysis and sharing.")
* [On-Call scheduling in Security Incident Response](https://www.servicenow.com/docs/1XH1CN2wuBWhXU3J4RFnpw "Use On-Call Scheduling in Security Incident Response to view and manage shifts for your analysts.")
* [Category management in Security Incident Response](https://www.servicenow.com/docs/8HapjvkfiPmRGT215mZ_gg "Configure security incident categories and subcategories for granular classification of incidents, which helps you accurately route security incidents.")
* [Timeline in Security Incident Response Workspace](https://www.servicenow.com/docs/lWLtZwJuQNjjkeJpcJsS3w "The timeline provides a chronological view of events related to a security incident. Events appear as point events or range events. Administrators can configure which events appear on the timeline and what details are shown in event popovers.")  
**Related tasks**   

* [Define the new Risk Score Calculator Rules](https://www.servicenow.com/docs/qeySAMM_7AR4kfCFFPqQaQ "Use the new Risk Score Calculator to define and calculate the risk score of security incidents based on the user-defined criteria, which provide a transparent intelligence scoring of security incidents. The risk score is auto-calculated for the security incident records.")
* [View and update Security Incident Response system properties](https://www.servicenow.com/docs/_SBJ6FixUfCqShG39BdnNQ "View and update the Security Incident Response system properties from the Security Incident Response Workspace administration panel to access and update the required properties.")
* [Create quick filters for Security Incidents and Response Tasks lists](https://www.servicenow.com/docs/2fydyVZ4hTdfg9HOjsOHJA "Create quick filters to create reusable, predefined filters that appear on the security incidents and response tasks list pages enabling security analysts to filter the list items without adding the filter conditions each time.")

*[\>]: and then