--- sourceDocument: Yokohama Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Use generative AI skills # Using ServiceNow Otto for Security Incident Response (SIR) generative AI skills {#ariaid-title1} * Release version: Yokohama * * Updated January 14, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Using ServiceNow Otto for Security Incident Response (SIR) generative AI skills ServiceNow Otto integrates generative AI skills to help security analysts efficiently manage and close security incidents within their workflow. These AI-powered capabilities enable quick summarization, recommended actions, closure note generation, and post-incident analysis directly from Security Incident Response (SIR) records or workspace, enhancing incident investigation and remediation processes. Show full answer Show less ## Key Features * **Skills Reuse and Data Security:** All AI skills operate within the global domain but respect domain separation to ensure users access only their domain's data. Data remains on the instance, with no external persistence of AI prompts or responses, maintaining strict data privacy. * **Role-Based Access:** AI agents use role masking to control user access and data visibility. Specific roles included with Now Assist applications must be configured within security controls to enable appropriate access. * **Generative AI Capabilities for Security Incidents:** * Summarize incident details including underlying issues, observables, and actions taken. * Generate closure notes automatically to streamline incident resolution documentation. * Provide recommended actions and enable creation of remediation tasks from these recommendations within the Security Incident Response Workspace. * Produce post-incident analysis and performance metrics to evaluate remediation efforts. * Generate correlation insights to accelerate incident investigations. * Create quality assessment reports for security incidents. * **Access Points for AI Skills:** Security managers and analysts can request summaries and closure notes from security incident records, the Security Incident Response Workspace, or the Now Assist panel. Recommended actions and post-incident analysis are accessible only from incident records or the workspace, not the Now Assist panel. * **Customization:** Input fields for AI skills can be tailored to meet specific organizational requirements, allowing flexibility in how AI assists with incident response. ## Practical Benefits * Enables security teams to close incidents faster by providing concise, AI-generated summaries and closure documentation. * Improves decision-making with AI-generated actionable recommendations and correlation insights. * Maintains compliance and data privacy through domain separation and role-based access controls. * Supports continuous improvement by generating performance metrics and quality assessment reports. * Integrates AI seamlessly into existing workflows within the Security Incident Response Workspace and Now Assist panel, minimizing disruption. Security analysts can close security incidents quickly from within their flow of work with the generative AI skills supported by ServiceNow Otto for Security Incident Response (SIR). ## Skills reuse {#using-now-assist-for-security__section_vkh_cpq_mhc} By default, all skills exist in the global domain. When you use Now Assist in a domain-separated environment, users are only able to access data in their domain. For example, if a user uses the summarization skill, Now Assist only uses material that exists in the user's domain when generating that summary. Additionally, there is no co-mingling of data for domain-separated instances when using generative AI skills. The data resides only on the instance, and the shared services used for generative AI do not persist any requests (prompts) and responses. For more information, see [Domain separation in the AI Admin Hub console](https://www.servicenow.com/docs/access?context=domain-separation-in-the-now-assist-admin-console&version=yokohama&pubname=yokohama-intelligent-experiences&ft:locale=en-US). (Note that global domain is not the same as global scope. For more information, see [Exploring Next Experience pickers](https://www.servicenow.com/docs/access?context=next-experience-pickers&version=yokohama&pubname=yokohama-platform-user-interface&ft:locale=en-US).){#using-now-assist-for-security__na-skills-global-domain-explanation} AI agents use [role masking](https://www.servicenow.com/docs/access?context=aia-role-masking&version=yokohama&pubname=yokohama-intelligent-experiences&ft:locale=en-US) to determine which users can access them and what data they have access to. Ones installed with Now Assist applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. Data access settings must also include these roles. For the instructions to change the security controls, see [Define security controls for an AI agent](https://www.servicenow.com/docs/access?context=define-sec-controls-aia&version=yokohama&pubname=yokohama-intelligent-experiences&ft:locale=en-US).{#using-now-assist-for-security__agentic-ai-req-roles-aia} Important: Some Now Assist skills, agents, and agentic workflows are turned on by default. For more information, see [Now Assist skills, agents, and agentic workflows on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&version=yokohama&pubname=yokohama-intelligent-experiences&ft:locale=en-US). With generative AI skills with ServiceNow Otto for Security Incident Response (SIR), your security analysts have the option to: * Summarize security incident details and review the context quickly in a concise, easy-to-read format. * Generate closure (resolution) notes. * Generate recommended actions for a security incident * Generate post incident analysis data * Generate performance metrics for your remediation teams.This skill is activated for use with an AI agent. See [Analyze security operations metrics agentic workflow](https://www.servicenow.com/docs/zVngLZuDAp1HAX8RCYjprQ "Chat with an AI agent from the Now Assist panel to help you gain insight into how efficiently your security analysts are working with security incidents resolution.") for more information. * Generate correlation insights to speed up incident investigation. * Generate a quality assessment report of a security incident Security managers and analysts can request security incident summaries and closure notes from the following locations: * Security incident records * Security Incident Response Workspace * The Now Assist panel. Note: The security incident recommended actions and post-incident analysis skills are not available from the Now Assist panel. {#using-now-assist-for-security__ul_hlb_gb4_bcc} Security managers and analysts can generate recommended next steps and post-incident analysis data from the following locations: * Security incident records * Security Incident Response Workspace {#using-now-assist-for-security__ul_krk_gld_ycc} Security managers and analysts can create remediation tasks from generated recommended actions only from security incidents in the Security Incident Response Workspace. 1. [Summarize a security incident with ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/Xj6mVRT02fWngH3DZJRCEA "Understand the context of a security incident with the Security Incident summarization generative AI skill.") Generate a summary for a security incident that includes the underlying issue, incident details, related lists data (observables), and key actions already taken. 2. [Generate recommended actions for a security incident with ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/e7evJzDU1Uf9WdF716jK0Q "Automatically generate the next steps your analysts can take to help them close a security incident in the Security Incident Response Workspace. The recommended steps are based on existing security incidents and knowledge articles.") 3. [Generate a post-incident analysis for a security incident with ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/ieSSImjWduMrAbCPqf4cFw "Automatically generate a post-incident analysis for a security incident that includes a root cause analysis, impact assessment, and learning and recommendations information.") 4. [Generate correlation insights in the Now Assist panel with ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/b9m8o0LgIXw2fqmquayC_g "Generate correlation insights from the Now Assist panel to help you connect past events to the security incident that you are working on.") 5. [Generate a quality assessment report](https://www.servicenow.com/docs/djYHHaUfJOMcYIhRV98B1A "Generate a quality assessment report for a security incident using a predefined rule set.") for a security incident 6. [Generate closure notes for a security incident with ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/AAMAulpFJRgyT03mTegwkg "Automatically generate a draft of the closure notes for a security incident when you close it. The draft is editable and will be reviewed prior to closing the security incident, and it can be used or modified as needed. Closure notes provide information about the resolution of a security incident to other analysts, managers, and key stakeholders.") Automatically generate the closure notes for a security incident. 7. [Request generative AI skills in the Now Assist panel for ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/B~HffOSxQVwBr4KN4xjgZA "Request a security incident summary or closure notes from the Now Assist panel.") Generate summaries and closure notes from the Now Assist panel. Note: The security incident recommended actions and post-incident analysis skills are not available from the Now Assist panel. 8. [Customize a ServiceNow Otto for Security Incident Response (SIR) skill](https://www.servicenow.com/docs/hgvtj1wfHIJkBmZsAs1RMA "Customize some of the input fields of a generative AI skill to suit the requirements of your environment.") Customize the input fields of a skill to suit the requirements of your environment. {#using-now-assist-for-security__cf-using-parent-steps-ol}