---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Process Mining Workspace for Security Incident Response

# Process Mining Workspace for Security Incident Response {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Process Mining scan through security incident audit logs and identify factors contributing to inefficiencies such as multiple reassignments, prolonged hold times, and periods of inactivity for security incidents. Organizations
can use this information to address the inefficiencies.  
With process mining, you can identify the following opportunities of improvements for your security incidents.{#sir-process-mining__table_ix2_rvw_bfc__entry__2}

| Opportunity | Description |
|-|-|
| Incidents with at least two assignment group changes | Incidents for which the assignment group changed for two or more times. |
| SIRT (Max repetitions is 2) |   |
| Incidents took over 5 hours to escalate to high priority | Incidents for which the priority was escalated to a higher priority after five hours. |
| Incidents took more than 5 hours to analyze | Incidents that were in analysis state for more than five hours. |
| Incidents analyzed within 30 minutes | Incidents that were in analysis state for less than 30 minutes. |
| Review (Max repetitions is 2) | Incidents that were move to review state for two times. |
| Eradicate (Max repetitions is 2) | Incidents that were move to eradicate state for two times. |
[Table 1. Opportunities with process mining]

{#sir-process-mining__table_ix2_rvw_bfc}

The Process Mining Content Pack for Security Incident Response adds a prebuilt project that includes a predefined process model definition for security incidents. To create a project, see [Create process mining project for security incidents](https://www.servicenow.com/docs/jbnLrjpqFwttDMuTET3KrA "Create a project in Process Mining Workspace using the pre-build process models definitions from the content pack to scan through audit logs of security incident records and identify inefficiencies in your security incident life cycle.").  
Note:  
Beginning with the Brazil release, the Process Mining Content Pack application is set to be part of the core ServiceNow AI Platform and is automatically installed for Security Incident Response. To auto-install the Process Mining Content Pack application, upgrade your instance to Brazil.

Support for the standalone SIR Process Mining Content Pack (com.sn_sir_process_mining_cp) ends with this
change; it remains active on upgrade, but is no longer supported.