--- sourceDocument: Brazil Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/security-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Configure ServiceNow Otto for Security Incident Response (SIR) # Configuring ServiceNow Otto for Security Incident Response (SIR) {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read The ServiceNow Otto for Security Incident Response (SIR) application is supported in the Security Incident Response Workspace and in the legacy Core UI (UI16). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR). ## Configuration overview {#configuring-now-assist-for-security-operations__cf-config-parent-checklist} AI agents use [role masking](https://www.servicenow.com/docs/access?context=aia-role-masking&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US) to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see [Define security controls for an AI agent](https://www.servicenow.com/docs/access?context=define-sec-controls-aia&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US). Important: Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US). By sharing data with the ServiceNow® AI development program, you provide relevant data to help improve prediction accuracy, user experience, tailor products to your business needs, and reduce hallucinations for your activated ServiceNow Otto skills. You can opt out of a ServiceNow instance from sharing data from the AI Admin Hub console. See [Opt out of data sharing for Now Assist](https://www.servicenow.com/docs/access?context=opt-out-of-data-sharing-for-now-assist&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US). Repeat the opt-out process for all instances that use the ServiceNow Otto functionality. Use the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR). This console contains everything to install the applications and configure the generative AI skills. For additional information, see [Configuring plugins and skills in AI Admin Hub](https://www.servicenow.com/docs/access?context=configuring-na-landing&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US). Note: When you update the ServiceNow Otto for Security Incident Response (SIR) applications, its dependency applications are automatically updated. The following table lists the features and skills that you can access from the AI Admin Hub console. Note: Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US). {#configuring-now-assist-for-security-operations__table_igy_kpc_1cc__entry__2} | ServiceNow Otto product | Security incident skills | |-|-| | ServiceNow Otto for Security Incident Response (SIR) | Security incident summarization Note: The incident summarization supports security incidents in any state other than Draft. | | ServiceNow Otto for Security Incident Response (SIR) | Resolution notes generation. | | ServiceNow Otto for Security Incident Response (SIR) | Security operations metrics analysis | | ServiceNow Otto for Security Incident Response (SIR) | Security incident recommended actions The security incident recommended actions skill supports security incidents in any state other than Closed and Cancelled. Note: The AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to AllAI SearchAI Search Status. Contact support if the page indicates that AI Search is not enabled. Correlation insights support security incidents in all states. | | ServiceNow Otto for Security Incident Response (SIR) | Post-incident analysis | | ServiceNow Otto for Security Incident Response (SIR) | Generate content for shift handover | | ServiceNow Otto for Security Incident Response (SIR) | Security incident resolution plan | | ServiceNow Otto for Security Incident Response (SIR) | Security incident quality assessment | | ServiceNow Otto for Security Incident Response (SIR) | SIR data analysis | [Table 1. ServiceNow Otto for Security Incident Response (SIR) features and skills in the AI Admin Hub console] {#configuring-now-assist-for-security-operations__table_igy_kpc_1cc} 1. [Install AI plugins in AI Admin Hub](https://www.servicenow.com/docs/access?context=install-now-assist-feature-plugins&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US). Install the ServiceNow Otto for Security Incident Response (SIR) application (sn_sec_gen_ai) and Security Incident Response Core \[sn_si\] applications. Note: When you update the ServiceNow Otto for Security Incident Response (SIR) application, its dependency applications are automatically updated. 2. [Configure a skill for ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/PRnO11gOY_zB6Cn595kbog "Configure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup.") You can deactivate, configure, and reactivate generative AI skills and agentic workflows in the Guided Setup. {#configuring-now-assist-for-security-operations__cf-config-parent-tasks-ol} * **[Configure a skill for ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/PRnO11gOY_zB6Cn595kbog)** Configure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup. * **[Customize a skill](https://www.servicenow.com/docs/IoT3zkEBXraDD8HHPIs5xw)** Customize some of the input fields of a generative AI skill to suit the requirements of your environment. * **[Inputs and triggers](https://www.servicenow.com/docs/C~u8QxEG8itpW3u9drW2PQ)** You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used. **Related concepts** * [Set up view of SIR Records](https://www.servicenow.com/docs/5oqXpl5ZQX95rBFYUZ490A "This section describes how the related lists are grouped and presented on the SIR Related Records tab for easy navigation.") * [Configure SI design time investigation](https://www.servicenow.com/docs/1sby0MT9h3eGUBxDrvWd2A "Use this section to configure security incident design time investigation page to add multiple entry points and its associated records within the Security Incident Response Workspace.") * [SIR Workspace Related Records](https://www.servicenow.com/docs/WBoHHYVMtFC_FBQaS8gJVg#sir-records "This section consists of the related lists items that are grouped into sections such as associated observables and configuration items.") * [Configure Shift Handover](https://www.servicenow.com/docs/ChdioNYWKDiIGUS9svNvdw "Configure Shift Handover settings to provide complete shift information to the next shift analysts.") * [Security Incident Response conference call integration](https://www.servicenow.com/docs/jyKkkAE1GmoMN6u1G_GQ2g "The Security Incident Response Conference Call integration enables you to manage and initiate conference call and chat for analysts, managers and affected users.") * [Configure report templates in Security Incident Response](https://www.servicenow.com/docs/us5lwLFRrvfJI52OD0r74g "You can create report templates that can be used to generate an incident summary or an executive summary for analysis and sharing.") * [On-Call scheduling in Security Incident Response](https://www.servicenow.com/docs/1XH1CN2wuBWhXU3J4RFnpw "Use On-Call Scheduling in Security Incident Response to view and manage shifts for your analysts.") * [Category management in Security Incident Response](https://www.servicenow.com/docs/8HapjvkfiPmRGT215mZ_gg "Configure security incident categories and subcategories for granular classification of incidents, which helps you accurately route security incidents.") * [Timeline in Security Incident Response Workspace](https://www.servicenow.com/docs/lWLtZwJuQNjjkeJpcJsS3w "The timeline provides a chronological view of events related to a security incident. Events appear as point events or range events. Administrators can configure which events appear on the timeline and what details are shown in event popovers.") **Related tasks** * [Define the new Risk Score Calculator Rules](https://www.servicenow.com/docs/qeySAMM_7AR4kfCFFPqQaQ "Use the new Risk Score Calculator to define and calculate the risk score of security incidents based on the user-defined criteria, which provide a transparent intelligence scoring of security incidents. The risk score is auto-calculated for the security incident records.") * [View and update Security Incident Response system properties](https://www.servicenow.com/docs/_SBJ6FixUfCqShG39BdnNQ "View and update the Security Incident Response system properties from the Security Incident Response Workspace administration panel to access and update the required properties.") * [Create quick filters for Security Incidents and Response Tasks lists](https://www.servicenow.com/docs/2fydyVZ4hTdfg9HOjsOHJA "Create quick filters to create reusable, predefined filters that appear on the security incidents and response tasks list pages enabling security analysts to filter the list items without adding the filter conditions each time.") *[\>]: and then