Managing security incidents and inbound requests

After a security incident has been created, there are numerous types of information that can be added and viewed as your analysis of the issue progresses toward resolution.

Important:

The latest features in Security Incident Response are exclusively available in the Security Incident Response Workspace. Install or upgrade to the latest Security Incident Response [com.snc.security_incident] or Security Incident Response Workspace [com.snc.security_incident.workspace] version from the ServiceNow Store to access features such as Shift-Handover, Risk Score Calculator, etc.

This section describes the following:

• Create an inbound request
• Manage observables
• Manage lookups and scans
• Manage on-demand orchestration
• Calculate the severity of a security incident
• Manage post incident activities
• Close security incidents