--- sourceDocument: Brazil Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/security-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Security Incident Management Premium dashboard # Security Incident Management Premium dashboard {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Security Incident Management Premium dashboard The Security Incident Management Premium dashboard leverages advanced Platform Analytics visualizations to help security managers monitor and manage the lifecycle of security incidents. It tracks incident volume, performance, and progress from initial detection through containment, eradication, and recovery. Use of this dashboard requires a licensed version of Performance Analytics. Show full answer Show less ## End Users and Roles * **Security Response Manager (snsi.manager):** Gains comprehensive visibility into security incidents related to applications and services, with the ability to modify assignment groups. * **Security Response Administrator (snsi.admin):** Focuses on quickly identifying concerns and has full control over security incident data, including managing territories, skills, and adjusting risk parameters to prioritize critical vulnerabilities. * **Security Response Analysts (snsi.analyst):** Tier 1 and 2 analysts prioritize vulnerabilities based on organizational criticality and handle creation and updates of security incidents, requests, tasks, and related problems or changes. ## Key Indicators and Metrics The dashboard provides several critical indicators organized in tabs: * **Process by State and Process by Age:** Includes metrics such as average age of open incidents (in days), average reassignment times, average age since last update, and percentage of incidents not updated in the last 5 days. * **Data Quality:** Offers interactive filters by incident category, risk, priority, and severity to analyze open incidents over 30 days by assignment group and state, incidents with inactive or no assignees, and incidents not updated in over 30 days. * **KPI Tab:** Displays performance indicators like percentage of new critical incidents, average age and close time of incidents, reassignment rates, first assignment closure rates, self-service closure rates, unresolved incident percentages, and average close time for incident tasks. ## Breakdowns The dashboard metrics can be broken down by: * Security Group * Security Incident Age * Security Incident Category * Security Incident Priority * Security Incident State ## Benefits for ServiceNow Customers This dashboard enables security teams to gain actionable insights into incident response efficiency and incident lifecycle management, improving prioritization and resource allocation. By leveraging these analytics, customers can ensure timely updates, reduce incident closure times, and enhance overall security posture visibility across their organization. This dashboard uses advanced Platform Analytics visualizations to aid security managers to track the volume, performance and progress of security incidents from initial analysis/detection to containment, eradication, and recovery. The licensed version of Performance Analytics is therefore required. Figure 1. Security incident response by state Figure 2. Security incident response by age ## End users and roles {#si-mgmt-premium-dashboard__section_pth_zj2_n2b} {#si-mgmt-premium-dashboard__table_nvn_dk2_n2b__entry__3} | End user and goal | Required role | Benefits | |-|-|-| | Security Response Manager: Needs clear visibility into the overall state and volume of security incidents associated with applications and services. | sn_si.manager | Can review the overall security posture with the ability to adjust the members of assignment groups. | | Security Response Administrator: Needs to pinpoint areas of concern quickly and have full control over all Security Incident Response data while administering territories and skills, as needed. | sn_si.admin | Can adjust risk calculation parameters to ensure vulnerable items that are most pertinent to the organization are being addressed first. | | Security Response Analysts: Need to quickly prioritize which vulnerabilities to focus on based upon criticality to the organization. | sn_si.analyst | Tier 1 and 2 security analysts work on security incidents. They can create and update security incidents, requests, and tasks, as well as problems, changes, and outages related to their incidents. | [ ] {#si-mgmt-premium-dashboard__table_nvn_dk2_n2b} ## Security Incident Management Premium indicators {#si-mgmt-premium-dashboard__section_ch1_1hf_n2b} The Process by State and Process by Age tabs contain workbench widgets with the following indicators: Average age : The Average age of open security incidents indicator uses the formula `[[Summed age of open security incidents]] / [[Number of open security incidents]] / 24` to give a result in days. Average reassignment times : The Average re-assignment of open security incidents indicator uses the formula `Summed re-assignment of open security incidents / Number of open security incidents`. Average age of last update : The Average age of last update of open security incidents indicator uses the formula `Summed age of last update of open security incidents / Number of open security incidents / 24` to give a result in days. % not updated in 5 days : The % of open security incidents not updated in last 5 days indicator uses the formula `( [[Number of open security incidents not updated in the last 5 days]] / [[Number of open security incidents]] ) * 100`. The Data Quality tab has interactive filters for the Category of the security incident and the levels of Risk, Priority, and Severity. These filters are applied simultaneously to the following indicators: Security Incidents Open for More Than 30 Days by Assignment Group and State : The Number of open security incidents filtered for an age of 30 days and broken down by Assignment group and State. Security Incidents With Assignee That is not Active : The Number of open security incidents with no assignee or an assignee who is not active. Security Incidents Open for More Than 30 Days by Assignment Group and State : The Number of open security incidents not updated in the last 30 days indicator broken down by Assignment group and State. The KPI tab has the following additional indicators: * % of new critical security incidents * Average Age of Open Security Incidents * Average Close Time of Security Incidents * % Of Security Incidents that have been reassigned * % of Security Incidents closed on first assignment * % of security incidents closed by self-service * % of security incidents not solved * Average Close time of security incident tasks {#si-mgmt-premium-dashboard__ul_ig5_klm_n2b} ## Breakdowns {#si-mgmt-premium-dashboard__section_njs_bnm_n2b} The following breakdowns apply to the indicators on the dashboard: * Security Group * Security Incident Age * Security Incident Category * Security Incident Priority * Security Incident State {#si-mgmt-premium-dashboard__ul_vyr_2nm_n2b} **Related concepts** * [CISO dashboard](https://www.servicenow.com/docs/XTl2PuIXU2dLq5AYxKfPFg "This dashboard reveals the overall security posture of your organization, including security vulnerability and incidents.") * [Security Incident Management dashboard](https://www.servicenow.com/docs/ESuCiFbopBD17fGjr3QRxw "With this dashboard, security managers can easily track the volume, performance and progress of security incidents from initial analysis/detection to containment, eradication, and recovery.") * [Security Incident Explorer dashboard](https://www.servicenow.com/docs/6OCjwdPWOaIGbV21nz5mCg "With this dashboard, security managers are able to view security incidents summarized and grouped by category, subcategory, location, priority and business impact. These views let managers quickly gain insight into the frequency in which attacks are occurring and which business services are affected.") * [Security Operations Efficiency dashboard](https://www.servicenow.com/docs/AnJp8Q~hjOyBXX20aUDeHQ "Security operations center (SOC) managers can view overall efficiency metrics and measure the individual performance of the SOC team members in the organization.")