Configuring Now Assist for Security Incident Response

  • Release version: Xanadu
  • Updated May 19, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Configuring Now Assist for Security Incident Response

    The Now Assist for Security Incident Response application is integrated within the Security Incident Response Workspace and legacy Core UI (UI16). It allows users to configure generative AI skills through the Now Assist Admin console, enhancing the incident response process by sharing relevant data to improve accuracy and user experience.

    Show full answer Show less

    Key Features

    • Security Incident Summarization: Supports all security incidents except those in Draft state.
    • Resolution Notes Generation: Automatically generates resolution notes for incidents.
    • Recommended Actions: Provides action recommendations for incidents not in Closed or Cancelled states, requiring the AI Search application to be enabled.
    • Correlation Insights: Offers insights for incidents in all states.
    • Post-Incident Analysis Generation: Analyzes metrics and suggests improvements for remediation teams.

    Key Outcomes

    By configuring Now Assist for Security Incident Response, customers can expect improved incident management through AI-driven insights and recommendations, thereby enhancing overall security operations. The guided setup process ensures a straightforward configuration experience.

    The Now Assist for Security Incident Response application is supported in the Security Incident Response Workspace and in the legacy Core UI (UI16). You can use the guided setup in the Now Assist Admin console to configure Now Assist for Security Incident Response.

    Configuration overview

    By sharing data with the ServiceNow® AI development program, you provide relevant data to help improve prediction accuracy, user experience, tailor products to your business needs, and reduce hallucinations for your activated Now Assist skills.

    You can choose to opt out of a ServiceNow instance from data sharing from the Now Assist Admin console if you don't want to participate. See Opt out of data sharing for Now Assist. Repeat the opt-out process for all instances that use the Now Assist functionality.

    Use the Now Assist Admin console to configure Now Assist for Security Incident Response. This console contains everything that you must install the applications and configure the generative AI skills. For additional information, see Configuring Now Assist settings and features.

    The following table lists the features and skills that you can access from the Now Assist Admin console.

    Table 1. Now Assist for Security Incident Response features and skills in the Now Assist Admin console
    Now Assist Technology product Security incident skills
    Now Assist for Security Incident Response Security Incident summarization
    Note:
    The incident summarization supports security incidents in any state other than Draft.
    Resolution notes generation.
    Security incident recommended actions
    The security incident recommended actions skill supports security incidents in any state other than Closed and Cancelled.
    Note:

    The AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to All > AI Search > AI Search Status. Contact support if the page indicates AI Search is not enabled.

    Correlation insights supports security incidents in all states.
    Post-incident analysis generation
    Analyze security operations metrics for your remediation teams and get suggestions for improvement from an AI agent.
    1. Install Now Assist plugins.
      Note:
      The Now Assist for Security Operations application in the ServiceNow® Store and in your ServiceNow AI Platform instance has changed to the Now Assist for Security Incident Response application starting with version 2.0.1.

      Install the Now Assist for Security Incident Response application (sn_sec_gen_ai).

    2. Configure and activate a skill for Now Assist for Security Incident Response.

      Configure and review the details for a skill. You activate a skill from the Guided Setup.

    Using Guided Setup to implement Now Assist for Security Incident Response

    Guided Setup provides a sequence of tasks that help you configure Now Assist for Security Incident Response on your ServiceNow instance. To open the Guided Setup for Now Assist for Security Incident Response, navigate to All > Now Assist Admin > Skills.

    For more information, see Configure and activate a skill for Now Assist for Security Incident Response.