--- sourceDocument: yokohama Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/delta-xanadu-yokohama Release : - yokohama ft:locale : - en-US ft:publication_title : - yokohama Combined Product Files ft:clusterId : - delta3yx bundleId : - delta3yx --- # Combined ServiceNow Otto for Security Incident Response (SIR) release notes for upgrades from Xanadu to Yokohama # Combined ServiceNow Otto for Security Incident Response (SIR) release notes for upgrades from Xanadu to Yokohama {#ariaid-title1} Release version: Yokohama Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 11 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined ServiceNow Otto for Security Incident Response (SIR) Release Notes: Upgrades from Xanadu to Yokohama This consolidated guide covers the key updates, new features, changes, and upgrade information for ServiceNow Otto for Security Incident Response (SIR) from the Xanadu release through Yokohama. It is designed to help ServiceNow customers prepare for and implement the upgrade efficiently, ensuring access to enhanced capabilities for security incident management. Show full answer Show less ## Important Upgrade Information * Before upgrading to Yokohama, review pre- and post-upgrade tasks to maintain functionality. * Now Assist plugins will activate any previously untouched default-on skills during upgrade; skills toggled off by customers remain inactive. * Version 2.0.1 renames the Now Assist for Security Operations application to ServiceNow Otto for Security Incident Response (SIR). * Access to new AI-powered features like resolution notes generation and correlation insights requires upgrading to version 2.0.1 and enabling the AI Search application. ## New Features * **Role Configuration:** Additional role assignments are necessary for agentic workflows and AI agents to function correctly, ensuring secure execution. * **Default-On Skills:** New installations activate designated Now Assist skills automatically. Existing customers upgrading will see unconfigured skills enabled, while previously deactivated skills remain off. * **Generative AI Reports:** Generate detailed quality assessment reports and shift handover reports using AI agents that extract relevant incident details and refine content based on analyst feedback. * **Expanded AI Model Options:** Now Assist supports third-party AI providers Google Gemini and AWS Claude, in addition to Now LLM Service and Azure OpenAI. * **Agentic Workflows:** Analyze security operations metrics such as case volume, mean time to assign (MTTA), and mean time to resolve (MTTR), with AI-generated improvement suggestions. * **Enhanced Correlation Insights:** Generate insights from multiple configuration items or affected users simultaneously within the Security Incident Response Workspace to improve triage speed and accuracy. * **Security Incident Resolution:** AI agents assist analysts by providing resolution plans, closing incidents, canceling tasks, and generating post-incident analysis through natural language chat interactions. ## Changes * **Usage Measurement:** Now Assist usage tracking moved from a 365-day look-back to a burn-down model resetting at contract anniversaries starting with Yokohama Patch 5. * **Access Control:** Configure ACLs for AI agents and workflows to manage discovery, triggering, and user access securely within AI Agent Studio. * **Improved UI:** New "Show More" option for recommended actions enhances visibility and context during security incident investigations. * **Application Name Change:** The Now Assist for Security Operations app is now ServiceNow Otto for Security Incident Response (SIR) starting with version 2.0.1. ## Activation and Requirements * ServiceNow Otto for Security Incident Response (SIR) can be installed via the ServiceNow Store, with all related apps and version histories available there. * No additional browser, localization, or accessibility requirements have been introduced or changed in the Yokohama release. ## Highlights by Yokohama Patch * **Patch 11:** Updated usage measurement, default activation of certain skills and workflows, and added role configuration requirements. * **Patch 6:** AI-assisted shift handover report creation and support for Google Gemini and AWS Claude AI models. * **Patch 3:** Introduction of agentic workflows for security metrics analysis and AI-powered incident resolution chat. * **Patch 1:** AI chat interface to efficiently close security incidents and handle false positives. * **Early Availability:** Features include AI-generated resolution notes, recommended actions, post-incident analysis, and correlation insights to accelerate incident triage and resolution. These enhancements empower security teams to leverage AI-driven workflows and insights for faster, more accurate incident response, improving operational efficiency and incident resolution outcomes within the ServiceNow platform. Consolidated page of all release notes for ServiceNow Otto for Security Incident Response (SIR) from Xanadu to Yokohama. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family ServiceNow Otto for Security Incident Response (SIR) release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Yokohama. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading ServiceNow Otto for Security Incident Response (SIR) to Yokohama Before you upgrade to Yokohama, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__2} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | Upgrade information : For more information about required applications for ServiceNow Otto for Security Incident Response (SIR), see [Supporting information](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-security-incident&family=yokohama&ft:locale=en-US). Note: Upgrading the Now Assist plugins activate any designated skills that were previously untouched by the customer. * If you have the plugins installed but never touched the configuration (never activated the skill nor adjusted associated roles) of a skill, any Default On skill will be activated on a per skill basis upon upgrading. * If you have previously toggled a skill from active and then back to inactive or have updated any roles for that skill, that skill remains inactive upon upgrading. * You maintain full control over deactivating individual skills at any time after activation. Starting with version 2.0.1, the name of the Now Assist for Security Operations application in ServiceNow® Store and in your ServiceNow AI Platform® instance has changed to ServiceNow Otto for Security Incident Response (SIR). You must upgrade to version 2.0.1 to access the following features: * Generate resolution notes in the Now Assist context menu. * Generate correlation insights for a security incident investigation from the Now Assist panel. The AI Search application must be enabled so that the recommended actions skill works for security incidents. To verify that AI Search is enabled on your instance, navigate to AllAI SearchAI Search Status. Contact support if the page indicates that AI Search is not enabled. | [ ] ## New features Between your current release family and Yokohama, new features were introduced for ServiceNow Otto for Security Incident Response (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__8} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Role configuration required for agentic workflows and AI agents](https://www.servicenow.com/docs/access?context=aia-role-masking&family=yokohama&ft:locale=en-US) : Agentic workflows and AI agents included with Now Assist applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they will not execute. Data access settings must also include these roles. See the documentation for the agentic workflow or AI agent for the specific roles you must add. [Some Now Assist skills are turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Generate a quality assessment report](https://www.servicenow.com/docs/access?context=na-sir-quality-assessment&family=yokohama&ft:locale=en-US) : Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules. [Generate SIR Shift Handover Report](https://www.servicenow.com/docs/access?context=add-incidents-shifthandover-ai-agent&family=yokohama&ft:locale=en-US) : The AI Agent helps add security incident details to a shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. The AI agent can fetch details of the security incident and identify if the analyst has access to the shift handover record. The AI agent can generate content for each section of the shift handover record and asks for analysts feedback on the content. The AI agent refines the content based on the feedback and saves the content to the records on approval. [New third-party AI model provider options available for all Now Assist applications](https://www.servicenow.com/docs/access?context=exploring-large-language-models&family=yokohama&ft:locale=en-US) : Google Gemini and AWS Claude are available for Now Assist skills and AI agents in addition to Now LLM Service and Azure OpenAI. [Use agentic workflows](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=yokohama&ft:locale=en-US) : The Analyze security operations metrics agentic workflow enables security managers to analyze their teams' performance. * Generate metrics for Security Incident Response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) for a date range of your choosing. * Request suggestions for how to improve MTTR, MTTA, and volume based on your metrics. [Enhancements to correlation insights in Now Assist for Security Incident Response](https://www.servicenow.com/docs/access?context=generating-insights-for-now-assist-for-security&family=yokohama&ft:locale=en-US) : You can generate and view results for correlation insights in the Security Incident Response Workspace. * Correlation insights are not limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident. * You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace. * You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users. * Results are displayed in a modeless dialog that you can size and move. [Using Security incident resolution agentic workflow](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=yokohama&ft:locale=en-US) : Use the Security incident resolution agentic workflow to close your security incidents. Analysts can chat with the AI agents in natural language to resolve the security incidents. The AI agent analyzes the incident details, existing runbooks, knowledge articles, and past similar security incidents as inputs, and provides a resolution plan. The AI agent also assists the analysts to resolve the security incident. [Using Security Incident Response AI agents](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=yokohama&ft:locale=en-US) : Yokohama Patch 1: Use the Close security incident use case to close your security incidents: * Analysts can chat with the AI agents in natural language to close the security incidents. The AI agent can cancel the associated response tasks, generate resolution notes, close code, or close notes and post incident analysis (PIA) during incident closure. Analysts can provide feedback on the content and the AI agent can refine the content based on the feedback. * Analysts can also close false positive security incidents with minimal user intervention. [Yokohama Early Availability](https://www.servicenow.com/docs/access?context=now-assist-security-incident-landing&family=yokohama&ft:locale=en-US) : * [Generate correlation insights](https://www.servicenow.com/docs/access?context=generate-correlation-insights-now-assist-for-security&family=yokohama&ft:locale=en-US) Generate correlation insights to connect current security incidents to past events. You can identify the affected users, configuration items (CI)s, or observables (IP addresses and file hashes) from existing incidents and records to help you more quickly triage your new security incidents. Correlation insights are supported in Workspace, the Core UI, and from the Now Assist panel. * Enhancements to [closure (resolution) notes](https://www.servicenow.com/docs/access?context=generate-closure-notes-si-now-assist-sec-incident&family=yokohama&ft:locale=en-US) and [post incident analysis](https://www.servicenow.com/docs/access?context=generate-pia-report-now-assist-security-incident&family=yokohama&ft:locale=en-US) generation Generate resolution notes from the Close the security incident modal or the Now Assist context menu on a security incident record (SIR). You can also generate resolution notes from the Now Assist panel. If you choose the Now Assist context menu, you have the following options to help you refine the generated text: * Shorten: Select the text to remove details. * Elaborate: Generate more details about the context of a security incident. Note: Generating resolution notes is supported in Workspace and Core UI. Generating a post incident analysis is supported from the Close the security incident modal in Workspace. | [ ] ## Changes Between your current release family and Yokohama, some changes were made to existing ServiceNow Otto for Security Incident Response (SIR) features. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__14} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Changes to Now Assist usage measurement](https://www.servicenow.com/docs/access?context=monitoring-now-assist-usage&family=yokohama&ft:locale=en-US) : Starting with Yokohama Patch 5, Now Assist usage measurement is transitioning from a 365-day look-back model to a 365-day burn-down model, with usage resetting at the contract anniversary date. For more information, refer to [KB KB2704710: Now Assist Usage - Overview \& New Measurement Logic](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2704710). [Some Now Assist skills are now turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The following Now Assist skills for ServiceNow Otto for Security Incident Response (SIR) and ServiceNow Otto for Unified Security Exposure Management are activated by default. * Security incident summarization (SIR) * Resolution notes generation (SIR) * Post incident analysis (SIR) * Security incident recommended actions (SIR) * Correlation insights generation (SIR) * Security incident quality assessment (SIR) The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Configure ACLs for AI agents and agentic workflows](https://www.servicenow.com/docs/access?context=aia-security-implementation&family=yokohama&ft:locale=en-US) : Configure the access control lists for who can discover and trigger AI agents and agentic workflows in their guided setups in AI Agent Studio. You can determine whether an AI agent or agentic workflow behaves as a dynamic user or as an AI user. You can also specify if an AI agent or agentic workflow can be available to all authenticated users or publicly available. [Generate recommended actions](https://www.servicenow.com/docs/access?context=generate-recommended-actions-now-assist-for-security&family=yokohama&ft:locale=en-US) : Introduced a new UI card Show More to enhance the visibility of recommended actions. As a security analyst, you can now access additional context along with further recommended steps to assist in the analysis and investigation of security incidents. [Now Assist for Security Incident Response application name change](https://www.servicenow.com/docs/access?context=activate-skills-for-now-assist-security-incident&family=yokohama&ft:locale=en-US) : Starting with version 2.0.1, the Now Assist for Security Operations application in the ServiceNow® Store and in your ServiceNow AI Platform® instance has changed to the ServiceNow Otto for Security Incident Response (SIR) application. | [ ] ## Removed Between your current release family and Yokohama, some ServiceNow Otto for Security Incident Response (SIR) features or functionality were removed. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__20} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Deprecations Between your current release family and Yokohama, some ServiceNow Otto for Security Incident Response (SIR) features or functionality were deprecated. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__26} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Activation information Review information on how to activate ServiceNow Otto for Security Incident Response (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__32} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | Activation information : Install ServiceNow Otto for Security Incident Response (SIR) by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: ServiceNow Otto for Security Incident Response (SIR) is available in ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__38} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__44} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for ServiceNow Otto for Security Incident Response (SIR), such as specific requirements or compliance levels. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__50} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for ServiceNow Otto for Security Incident Response (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__56} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for ServiceNow Otto for Security Incident Response (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesir-summary__entry__62} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Yokohama Patch 11](https://www.servicenow.com/docs/access?context=yokohama-patch-11&family=yokohama&ft:locale=en-US) * Review changes to Now Assist usage measurement. * Some Now Assist skills, agents, and agentic workflows are on by default. * Additional role configuration is required for agentic workflows and AI agents included with Now Assist applications. * Use generative AI to create a quality assessment report of a security incident. * Yokohama Patch 6Help analysts to add security incidents details to the Shift Handover report by chatting with AI agents in the Now Assist panel. * Use Google Gemini and Anthropic Claude on AWS as AI model providers for Now Assist skills and AI agents in addition to Now LLM Service and Azure OpenAI. * Yokohama Patch 3 Help your analysts to gain insight into security incident record metrics with an agentic workflow. Chat with AI agents in natural language from the Now Assist panel. Help your analysts to resolve security incidents by chatting with AI agents in the Now Assist panel where the AI agent provides a resolution plan. * Yokohama Patch 1Help your analysts to close security incidents more efficiently by chatting with AI agents in natural language from the Now Assist panel. * Yokohama early availability * Triage security incidents with long activity streams by reviewing work notes and contextual information quickly in a concise, easy-to-read format. * Automatically generate resolution notes for security incidents by using generative AI. * Generate recommended actions to resolve security incidents. * Generate a post-incident analysis. * Generate correlation insights to help you connect current incidents to past events. By identifying the affected users, configuration items (CIs), or observables (IP addresses and file hashes) from existing incidents, you can help to triage new security incidents. For more information, see [ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/access?context=now-assist-security-incident-landing&family=yokohama&ft:locale=en-US). | [ ] *[\>]: and then