--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-xanadu-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zx bundleId : - delta3zx --- # Combined ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes for upgrades from Xanadu to Zurich # Combined ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes for upgrades from Xanadu to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 14 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined ServiceNow Otto for Security Incident Response (SIR) Release Notes for Upgrades from Xanadu to Zurich This consolidated release note summarizes all updates, new features, changes, and important upgrade information for ServiceNow Otto for Security Incident Response (SIR) from the Xanadu release through to Zurich. It is designed to help ServiceNow customers prepare for and understand the enhancements and configuration requirements involved in upgrading to Zurich. Show full answer Show less ## Important Upgrade Information * Several Now Assist AI skills, agents, and agentic workflows are activated by default upon upgrading to Zurich. These include security incident summarization, resolution notes generation, post-incident analysis, recommended actions, correlation insights, quality assessment, and various AI agents assisting with security incident resolution and shift handovers. * Customers who previously installed but did not configure certain skills will find those skills activated by default during upgrade. Skills that were explicitly deactivated and had role changes remain inactive. * Dependency applications are automatically updated with the ServiceNow Otto for SIR application. * The AI Search application must be enabled for recommended actions to function properly. ## New Features and Enhancements * **Agentic Workflows and AI Agents:** Require additional role-based security configuration to ensure proper execution. Roles must be assigned to users to trigger these workflows and agents. * **Generative AI Capabilities:** New features include generating quality assessment reports for security incidents and shift handover reports using AI agents that interact with analysts to refine content. * **Correlation Insights Enhancements:** Insights can now be generated from multiple configuration items (CIs) or affected users beyond the primary CI, accessible from any state in the Security Incident Response Workspace. * **Security Incident Resolution Workflow:** Analysts can interact with AI agents in natural language to receive resolution plans, leveraging existing runbooks, knowledge articles, and past incidents for context. * **Additional AI Model Providers:** Google Gemini and AWS Claude are now supported alongside existing AI providers, enhancing AI skill and agent options. * **Improved Recommended Actions UI:** A new "Show More" card provides analysts with additional context and further actionable steps during incident investigation. * **Sightings Search and Isolate Host:** Added to the incident resolution workflow to assist analysts in efficient security incident management. * **Security Operations Metrics Analysis:** Agentic workflows enable security managers to analyze team performance metrics such as case volume, mean time to assign (MTTA), and mean time to resolve (MTTR), with AI-generated suggestions for improvement. ## Changes to Existing Features * Now Assist usage measurement has shifted from a 365-day look-back to a 365-day burn-down model resetting at the contract anniversary, affecting how usage is tracked and reported. * Some Now Assist skills are now enabled by default for new installs and upgrades, streamlining access to AI-driven functionalities. * Access control lists (ACLs) must be configured in AI Agent Studio to manage who can discover and trigger AI agents and workflows, defining user visibility and behavior. * The application name changed from Now Assist for Security Operations to ServiceNow Otto for Security Incident Response (SIR) starting with version 2.0.1. ## Activation and Additional Requirements * ServiceNow Otto for Security Incident Response (SIR) is available for installation via the ServiceNow Store. Customers should request access through the store portal. * AI Search must be enabled on the instance to support recommended action functionality. * No changes in browser requirements, localization, or accessibility details were introduced from Xanadu to Zurich. ## Practical Benefits for ServiceNow Customers * Enhanced AI-driven workflows and agents automate and accelerate security incident resolution, improving analyst productivity and response accuracy. * Improved visibility and actionable insights through correlation analysis and enhanced recommended actions help security teams triage and investigate incidents more effectively. * Generative AI reports aid in quality assessment and shift handovers, facilitating better communication and incident documentation. * Role-based access controls ensure secure and compliant use of AI capabilities, giving administrators granular control over AI feature adoption. * Integration of existing runbooks into AI resolution plans leverages organizational knowledge to optimize incident closure processes. * Metrics analysis workflows enable security managers to monitor and improve team performance using AI-driven suggestions. Consolidated page of all release notes for ServiceNow Otto for Security Incident Response (SIR) (SIR) from Xanadu to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading ServiceNow Otto for Security Incident Response (SIR) (SIR) to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__2} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | Upgrade information : Note: The following Now Assist skills, agents, and agentic workflows for ServiceNow Otto for Security Incident Response (SIR) are activated by default: Skills * Security incident summarization * Resolution notes generation * Post incident analysis * Security incident recommended actions * Correlation insights generation * Security incident quality assessment * Natural language condition evaluator * Generate content for shift handover * Quality assessment report NACM * Security incident resolution plan * Security operations metrics analysis Agentic workflows * Wrap up security incident * Resolve security incident * Generate SIR shift handover report * Analyze security operations metrics Agents * EDR AI agent * Exchange online integration handling AI agent * Observable analysis AI agent * Security incident activities handling AI agent * Security incident resolution AI agent * Security incident retrieval AI agent * Security incident shift handover AI agent * Security incident wrap up generator AI agent * Security metrics analysis AI agent For more information, see [AI assets on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=zurich&ft:locale=en-US) Note: Upgrading the Now Assist plugins activates any designated skills that were previously untouched by the customer. * If you installed the plugins for a skill but never configured it, meaning you never activated it nor adjusted associated roles, any skill on by default is activated on a per skill basis when upgrade. * If you previously toggled a skill from active and then back to inactive, or updated any roles for that skill, that skill remains inactive when upgrading. * You maintain full control over deactivating individual skills at any time after activation. When you update the ServiceNow Otto for Security Incident Response (SIR) (SIR) application, the dependency applications are automatically updated. For more information about required applications for ServiceNow Otto for Security Incident Response (SIR), see [Supporting information](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-security-incident&family=zurich&ft:locale=en-US). The AI Search application must be enabled so that the recommended actions skill works for security incidents with ServiceNow Otto for Security Incident Response (SIR). To verify that AI Search is enabled on your instance, navigate to AllAI SearchAI Search Status. Contact support if the page indicates that AI Search isn't enabled. | [ ] ## New features Between your current release family and Zurich, new features were introduced for ServiceNow Otto for Security Incident Response (SIR) (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__10} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Role configuration required for agentic workflows and AI agents](https://www.servicenow.com/docs/access?context=aia-role-masking&family=yokohama&ft:locale=en-US) : Agentic workflows and AI agents included with Now Assist applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they will not execute. Data access settings must also include these roles. See the documentation for the agentic workflow or AI agent for the specific roles you must add. [Some Now Assist skills are turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Generate a quality assessment report](https://www.servicenow.com/docs/access?context=na-sir-quality-assessment&family=yokohama&ft:locale=en-US) : Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules. [Generate SIR Shift Handover Report](https://www.servicenow.com/docs/access?context=add-incidents-shifthandover-ai-agent&family=yokohama&ft:locale=en-US) : The AI Agent helps add security incident details to a shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. The AI agent can fetch details of the security incident and identify if the analyst has access to the shift handover record. The AI agent can generate content for each section of the shift handover record and asks for analysts feedback on the content. The AI agent refines the content based on the feedback and saves the content to the records on approval. [New third-party AI model provider options available for all Now Assist applications](https://www.servicenow.com/docs/access?context=exploring-large-language-models&family=yokohama&ft:locale=en-US) : Google Gemini and AWS Claude are available for Now Assist skills and AI agents in addition to Now LLM Service and Azure OpenAI. [Use agentic workflows](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=yokohama&ft:locale=en-US) : The Analyze security operations metrics agentic workflow enables security managers to analyze their teams' performance. * Generate metrics for Security Incident Response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) for a date range of your choosing. * Request suggestions for how to improve MTTR, MTTA, and volume based on your metrics. [Enhancements to correlation insights in Now Assist for Security Incident Response](https://www.servicenow.com/docs/access?context=generating-insights-for-now-assist-for-security&family=yokohama&ft:locale=en-US) : You can generate and view results for correlation insights in the Security Incident Response Workspace. * Correlation insights are not limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident. * You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace. * You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users. * Results are displayed in a modeless dialog that you can size and move. [Using Security incident resolution agentic workflow](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=yokohama&ft:locale=en-US) : Use the Security incident resolution agentic workflow to close your security incidents. Analysts can chat with the AI agents in natural language to resolve the security incidents. The AI agent analyzes the incident details, existing runbooks, knowledge articles, and past similar security incidents as inputs, and provides a resolution plan. The AI agent also assists the analysts to resolve the security incident. [Using Security Incident Response AI agents](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=yokohama&ft:locale=en-US) : Yokohama Patch 1: Use the Close security incident use case to close your security incidents: * Analysts can chat with the AI agents in natural language to close the security incidents. The AI agent can cancel the associated response tasks, generate resolution notes, close code, or close notes and post incident analysis (PIA) during incident closure. Analysts can provide feedback on the content and the AI agent can refine the content based on the feedback. * Analysts can also close false positive security incidents with minimal user intervention. [Yokohama Early Availability](https://www.servicenow.com/docs/access?context=now-assist-security-incident-landing&family=yokohama&ft:locale=en-US) : * [Generate correlation insights](https://www.servicenow.com/docs/access?context=generate-correlation-insights-now-assist-for-security&family=yokohama&ft:locale=en-US) Generate correlation insights to connect current security incidents to past events. You can identify the affected users, configuration items (CI)s, or observables (IP addresses and file hashes) from existing incidents and records to help you more quickly triage your new security incidents. Correlation insights are supported in Workspace, the Core UI, and from the Now Assist panel. * Enhancements to [closure (resolution) notes](https://www.servicenow.com/docs/access?context=generate-closure-notes-si-now-assist-sec-incident&family=yokohama&ft:locale=en-US) and [post incident analysis](https://www.servicenow.com/docs/access?context=generate-pia-report-now-assist-security-incident&family=yokohama&ft:locale=en-US) generation Generate resolution notes from the Close the security incident modal or the Now Assist context menu on a security incident record (SIR). You can also generate resolution notes from the Now Assist panel. If you choose the Now Assist context menu, you have the following options to help you refine the generated text: * Shorten: Select the text to remove details. * Elaborate: Generate more details about the context of a security incident. Note: Generating resolution notes is supported in Workspace and Core UI. Generating a post incident analysis is supported from the Close the security incident modal in Workspace. | | Zurich | [Resolve a security incident](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Help enhance incident resolution plan generation by adding your existing runbooks to the AI runbooks section within the Security incident resolution plan skill. The existing runbooks provide additional context to the skill. [Role configuration required for agentic workflows and AI agents](https://www.servicenow.com/docs/access?context=aia-role-masking&family=zurich&ft:locale=en-US) : Agentic workflows and AI agents included with your applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they will not execute. See the documentation for the agentic workflow or AI agent for the specific roles you must add. [Explore Security incident quality assessment](https://www.servicenow.com/docs/access?context=na-sir-quality-assessment&family=zurich&ft:locale=en-US) : Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules. [Generate SIR Shift Handover Report](https://www.servicenow.com/docs/access?context=add-incidents-shifthandover-ai-agent&family=zurich&ft:locale=en-US) : The AI agent helps add security incident details to a shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. The AI agent can fetch details of the security incident and identify if the analyst has access to the shift handover record. The AI agent can generate content for each section of the shift handover record and asks for analysts feedback on the content. The AI agent refines the content based on the feedback and saves the content to the records on approval. [Use agentic workflows](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=zurich&ft:locale=en-US) : The analyze security operations metrics agentic workflow helps security managers to analyze their teams' performance. * Generate metrics for Security Incident Response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) for a date range of your choosing. * Request suggestions for how to improve MTTR, MTTA, and volume based on your metrics. [Enhancements to correlation insights in ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/access?context=generating-insights-for-now-assist-for-security&family=zurich&ft:locale=en-US) : You can generate and view results for correlation insights in the Security Incident Response Workspace. * Correlation insights aren't limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident. * You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace. * You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users. * Results are displayed in a modeless dialog that you can size and move. [Using the security incident resolution agentic workflow](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Use the security incident resolution agentic workflow to close your security incidents. Analysts can chat with AI agents in natural language to resolve the security incidents. The AI agent analyzes the incident details, existing runbooks, Knowledge articles, and past similar security incidents as inputs, and provides a resolution plan. The AI agent also assists the analysts to resolve the security incident. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing ServiceNow Otto for Security Incident Response (SIR) (SIR) features. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__18} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Changes to Now Assist usage measurement](https://www.servicenow.com/docs/access?context=monitoring-now-assist-usage&family=yokohama&ft:locale=en-US) : Starting with Yokohama Patch 5, Now Assist usage measurement is transitioning from a 365-day look-back model to a 365-day burn-down model, with usage resetting at the contract anniversary date. For more information, refer to [KB KB2704710: Now Assist Usage - Overview \& New Measurement Logic](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2704710). [Some Now Assist skills are now turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The following Now Assist skills for ServiceNow Otto for Security Incident Response (SIR) and ServiceNow Otto for Unified Security Exposure Management are activated by default. * Security incident summarization (SIR) * Resolution notes generation (SIR) * Post incident analysis (SIR) * Security incident recommended actions (SIR) * Correlation insights generation (SIR) * Security incident quality assessment (SIR) The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Configure ACLs for AI agents and agentic workflows](https://www.servicenow.com/docs/access?context=aia-security-implementation&family=yokohama&ft:locale=en-US) : Configure the access control lists for who can discover and trigger AI agents and agentic workflows in their guided setups in AI Agent Studio. You can determine whether an AI agent or agentic workflow behaves as a dynamic user or as an AI user. You can also specify if an AI agent or agentic workflow can be available to all authenticated users or publicly available. [Generate recommended actions](https://www.servicenow.com/docs/access?context=generate-recommended-actions-now-assist-for-security&family=yokohama&ft:locale=en-US) : Introduced a new UI card Show More to enhance the visibility of recommended actions. As a security analyst, you can now access additional context along with further recommended steps to assist in the analysis and investigation of security incidents. [Now Assist for Security Incident Response application name change](https://www.servicenow.com/docs/access?context=activate-skills-for-now-assist-security-incident&family=yokohama&ft:locale=en-US) : Starting with version 2.0.1, the Now Assist for Security Operations application in the ServiceNow® Store and in your ServiceNow AI Platform® instance has changed to the ServiceNow Otto for Security Incident Response (SIR) application. | | Zurich | [Resolve a security incident](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Use the Sightings search and Isolate host capabilities in the Resolve security incident workflow to help resolve security incidents. [Generate recommended actions](https://www.servicenow.com/docs/access?context=generate-recommended-actions-now-assist-for-security&family=zurich&ft:locale=en-US) : A new Show More UI card has been introduced to enhance the visibility of recommended actions. As a security analyst, you can now access additional context along with further recommended steps to assist in the analysis and investigation of security incidents. | [ ] ## Removed Between your current release family and Zurich, some ServiceNow Otto for Security Incident Response (SIR) (SIR) features or functionality were removed. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__26} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some ServiceNow Otto for Security Incident Response (SIR) (SIR) features or functionality were deprecated. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__34} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate ServiceNow Otto for Security Incident Response (SIR) (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__42} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | Activation information : Install ServiceNow Otto for Security Incident Response (SIR) by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: ServiceNow Otto for Security Incident Response (SIR) is available in ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__50} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__58} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for ServiceNow Otto for Security Incident Response (SIR) (SIR), such as specific requirements or compliance levels. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__66} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__74} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__82} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | [Zurich Patch 7](https://www.servicenow.com/docs/access?context=zurich-patch-7&family=zurich&ft:locale=en-US) * Help enhance incident resolution plan generation by adding your existing runbooks to the AI runbooks section within the Security incident resolution plan skill. The existing runbooks provide additional context to the skill. * Use the Sightings search and Isolate host capabilities in the Resolve security incident workflow to help resolve security incidents. [Zurich Patch 5](https://www.servicenow.com/docs/access?context=zurich-patch-5&family=zurich&ft:locale=en-US) * Review changes to Now Assist usage measurement. [Zurich Patch 4](https://www.servicenow.com/docs/access?context=zurich-patch-4&family=zurich&ft:locale=en-US) * Some Now Assist skills are now turned on by default. * Use generative AI to create a quality assessment report of a security incident. * Additional role configuration required for agentic workflows and AI agents included with your applications. [Zurich Patch 1](https://www.servicenow.com/docs/access?context=zurich-patch-1&family=zurich&ft:locale=en-US) * Help analysts to add security incidents details to the Shift Handover report by chatting with AI agents in the Now Assist panel. Zurich Early Availability * Help your analysts to gain insight into security incident record metrics with an agentic workflow. Chat with AI agents in natural language from the Now Assist panel. * Help your analysts to resolve security incidents by chatting with AI agents in the Now Assist panel where the AI agent can assist in providing a resolution plan. | [ ] *[\>]: and then