Configuring ServiceNow Otto for Security Incident Response (SIR)

The ServiceNow Otto for Security Incident Response (SIR) application is supported in the Security Incident Response Workspace and in the legacy Core UI (UI16). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR).

Configuration overview

AI agents use role masking to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see Define security controls for an AI agent.

Important:

Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see AI agents, skills, and agentic workflows on by default.

By sharing data with the ServiceNow® AI development program, you provide relevant data to help improve prediction accuracy, user experience, tailor products to your business needs, and reduce hallucinations for your activated ServiceNow Otto skills.

You can opt out of a ServiceNow instance from sharing data from the AI Admin Hub console. See Opt out of data sharing for Now Assist. Repeat the opt-out process for all instances that use the ServiceNow Otto functionality.

Use the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR). This console contains everything to install the applications and configure the generative AI skills. For additional information, see Configuring AI skills.

Note:

When you update the ServiceNow Otto for Security Incident Response (SIR) applications, its dependency applications are automatically updated.

The following table lists the features and skills that you can access from the AI Admin Hub console.

Note:

Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see ServiceNow product tiers.

Table 1. ServiceNow Otto for Security Incident Response (SIR) features and skills in the AI Admin Hub console

ServiceNow Otto product	Security incident skills
ServiceNow Otto for Security Incident Response (SIR)	Security incident summarization Note: The incident summarization supports security incidents in any state other than Draft.
	Resolution notes generation.
	Security operations metrics analysis
	Security incident recommended actions The security incident recommended actions skill supports security incidents in any state other than Closed and Cancelled. Note: The AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to All > AI Search > AI Search Status. Contact support if the page indicates that AI Search is not enabled. Correlation insights support security incidents in all states.
	Post-incident analysis
	Generate content for shift handover
	Security incident resolution plan
	Security incident quality assessment

1. Install plugins for ServiceNow Otto.

   Install the ServiceNow Otto for Security Incident Response (SIR) application (sn_sec_gen_ai) and Security Incident Response Core [sn_si] applications.

   Note:

   When you update the ServiceNow Otto for Security Incident Response (SIR) application, its dependency applications are automatically updated.

2. Configure a skill for ServiceNow Otto for Security Incident Response (SIR)

   You can deactivate, configure, and reactivate generative AI skills and agentic workflows in the Guided Setup.