View, edit, and assign security incidents with a risk score greater than 60 with the Security Incident Response Mobile app

From your mobile device, view and edit Security Incident Response (SIR) incidents with a value in the risk score field that is greater than 60. View related lists and the audit trail of work notes for more details about incidents.

Before you begin

Role required: sn_si.analyst

About this task

From the list of records, assign an open security incident that has a risk score that is greater that 60 to yourself or to another analyst in your group. Alternatively, view the details and related lists of the record or add a work note prior to assignment. Time to complete this task: 5-10 minutes.

Procedure

1. If you are not logged in to your ServiceNow AI Platform instance on your mobile device, for more information see Log in to the Security Incident Response Mobile app.
2. With the Security Incidents landing screen displayed, tap Risk Score > 60.

   If you navigate away from the Security Incident Response Mobile app after you have logged in, tap the Now Agent app at any time to return to the last screen you had displayed.

   The Incident Risk Score screen is displayed with a list of security incidents.
3. Optional: Refer to Search for security incidents with the Security Incident Response Mobile app to search for security incidents that match specific criteria.
   Alternatively, with the filter icon () displayed, Set filters to limit the number of records on the list. Filtering records on screens in the mobile app works like filtering with a condition builder on the ServiceNow AI Platform.
4. To assign a security incident to yourself or reassign it directly from the list of open security incident records displayed, swipe left on a record to open the menu.
5. Choose one to continue.

   Option	Description
   Assign to Me	Assign the security incident to yourself. If the security incident is already assigned to you, this option is not displayed.
   Reassign	To assign or reassign the assignment group: Tap Assignment group. Tap a group from the list that is displayed, or enter text in the search field. The group must be a security-related assignment group. To assign or reassign the security incident to a member of the assignment group: Tap Assigned to and Tap a name from the list that is displayed, or enter text in the search field. Tap Submit to save and submit your changes.

6. Alternatively, to view the details of an open security incident record and to see more associated records and related lists, with the Incident Risk Score screen displayed, tap a record on the list.
7. On the open record that is displayed, choose one option from the following table to continue.

   Option	Description
   Menu icon	From the menu that is displayed, choose from the following options. Tap Edit. With the Edit Security Incident screen displayed, tap a field to expand it and choose one or more of the options that are displayed. Alternatively, tap the search icon and enter text. To reassign the incident, tap Reassign or Assign to Me. Follow the instructions described in the previous table. After you complete your edits, tap Submit to save your changes and update the security incident.
   Activity Stream tab	With the Activity Stream tab selected, review the audit trail of work notes, activities, and additional comments of the record. Tap the plus icon to add a work note or attach a file.
   Related List tab	With the Related List tab selected, view the items on any of the Related Lists that are populated on the security incident. Tap an item on the list that is displayed to view the details for a related list. From the lists of items that are displayed, tap an item to continue to view the activity streams and related lists associated with the parent security incident.
   Screen icons at the bottom of the screen.	On the bottom of the screen, choose one to continue. Tap the Security Incidents icon to return to the landing screen. If displayed, tap an icon to open another ServiceNow® mobile app. Tap Notification to view notifications from the ServiceNow AI Platform and the Security Incident Response Mobile app. Tap Settings and choose one to continue. View information about the ServiceNow AI Platform instance on your device. Log out of the current ServiceNow AI Platform instance.