--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-yokohama-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zy bundleId : - delta3zy --- # Combined Security Incident Response release notes for upgrades from Yokohama to Zurich # Combined Security Incident Response release notes for upgrades from Yokohama to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 14 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Security Incident Response release notes for upgrades from Yokohama to Zurich This consolidated release notes document assists ServiceNow customers in preparing for upgrading Security Incident Response (SIR) from the Yokohama release to the Zurich release. It details new features, changes, enhancements, and important upgrade considerations to help optimize incident management, integration capabilities, and analyst workflows. Show full answer Show less ## Key Features * **Process Mining for Security Incidents:** Analyze historical incident data to identify bottlenecks such as reassignments and hold times, enabling faster incident resolution. * **Integration Enhancements:** * **CrowdStrike Next-Gen SIEM:** Automate discovery and ingestion of detections, map detection fields to SIR incidents, filter defects, and synchronize comments and statuses to avoid duplicates. * **Splunk ES Integration:** Enable bidirectional updates, closure synchronization, and retrieval of historical and ongoing event data into ServiceNow. * **Cortex XSIAM by Palo Alto Networks:** Create and manage ingestion profiles, filter incidents, aggregate related incidents, and synchronize work notes for actionable incident response. * **Proofpoint Integration:** Detect and block email threats, tag suspicious emails, and automate incident creation for email events. * **Advanced Work Assignment (AWA):** Automatically assign security incidents to analysts based on availability, skills, and capacity, improving response efficiency. * **On-Call Schedule Management:** Admins can create shifts and schedules, assign members, and manage group on-call calendars; analysts can specify availability and preferred contact methods. * **Security Incident Enhancements:** * Bulk close multiple incidents with predefined closure comments to streamline incident management. * Update related records such as observables directly from the incident's Related Records list view for faster data management. * Add categories and subcategories for better classification and reporting of incidents. * Include Functional Impact, Recoverability, and Information Impact fields to improve triage accuracy and risk scoring. * Prevent duplicate security incidents from IT incident escalations via a configurable system property. * Display users currently accessing the same incident to avoid conflicts. * Universal search capability across all observable fields for efficient incident investigation. * **Visualization and Framework Support:** Ingest MITRE D3FEND data and explore ATT\&CK and D3FEND techniques via interactive node-based visualizations within SIR records. * **Conference Call Integration:** Initiate calls using Microsoft Teams, Cisco Webex, or Zoom directly from SIR to facilitate collaboration during incident resolution. * **LLM-Powered Integration Builder:** Quickly create and maintain product-ready integrations using AI-generated code from public API documentation for faster setup. * **Third-Party Risk Score Ingestion:** Incorporate external risk scores into incident risk calculations to better prioritize threats. * **Theme and User Experience:** Introduction of the Coral theme as the default with an optional dark mode to enhance usability and accessibility. ## Key Changes * "Discuss" option renamed to "Start Chat" and relocated under the Collaborate menu for clarity. * Integration workflows migrated to Workflow Studio to improve manageability and flexibility. * Shift Handover Records updated---Start and End date fields removed; shift name selection now used for configuration. * Multiple ITSM incidents, problems, or change requests can now be linked to a single security incident to better track complex remediation activities. * Attachments can no longer be modified on closed security incidents to preserve incident integrity. * Microsoft Teams and SharePoint integration setup simplified for Major Security Incident Management Workspace. ## Important Upgrade Considerations * Review and complete pre- and post-upgrade tasks as outlined to ensure smooth migration. * Security Incident Response is installed and activated via the ServiceNow Store; the Security Support Common plugin activates automatically with core Security Operations applications. * No deprecated or removed features between Yokohama and Zurich releases. * No new browser or additional system requirements introduced. * Accessibility improvements include a dark theme option to reduce eye strain in web and mobile experiences. ## Practical Benefits for ServiceNow Customers * Enhanced automation and integration capabilities reduce manual work and improve incident detection and response times. * Improved incident assignment and on-call scheduling increase analyst availability and workload balancing. * Advanced visualization and risk scoring empower better decision-making and incident prioritization. * Streamlined workflows and UI enhancements improve analyst efficiency and collaboration. * Compliance with accessibility standards and improved user interface themes enhance user experience across platforms. Consolidated page of all release notes for Security Incident Response from Yokohama to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Security Incident Response release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Security Incident Response to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-securityincidentresponse-summary__entry__2} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## New features Between your current release family and Zurich, new features were introduced for Security Incident Response. {#dfrn3-securityincidentresponse-summary__entry__8} | Release | Release notes | |-|-| | Yokohama | [Process Mining for security incidents](https://www.servicenow.com/docs/access?context=sir-process-mining&family=yokohama&ft:locale=en-US) : Identify factors contributing to delays in processing Security Incident Response (SIR) incidents that take a long time to close or resolve by scanning historical SIR records through Process Mining. Time-consuming factors can include multiple reassignments, prolonged hold times, and periods of inactivity. [Add indirectly linked VITs to CVEs](https://www.servicenow.com/docs/access?context=configure-mitre-att-ck-properties&family=yokohama&ft:locale=en-US) : Identify all the Third-Party Entities (TPEs) associated with a Common Vulnerabilities and Exposures (CVE) and then calculate and display the total number of vulnerable items (VITs) indirectly linked to those CVEs through the TPEs by setting the sn_ti.include_cve_vit_indirect_relation property. [Configure on-call schedules](https://www.servicenow.com/docs/access?context=on-call-schedule-sir&family=yokohama&ft:locale=en-US) : As an admin: * Create a shift and assign or remove members to/from the shift. * Create/edit on-call schedules for groups. * View any group's on-call schedule, including those to which they belong. As an analyst: * Specify your availability and preferred contact methods. * View your on-call schedule and see other members of your shift. [Enhancements to relationship graphs](https://www.servicenow.com/docs/access?context=sir-relationship-graph&family=yokohama&ft:locale=en-US) : As an admin: * Define default child nodes to populate in the relationship graph. * Configure relationship labels. As an analyst: * Add or remove child nodes at the parent node level. * Save the state of the relationship graph. * Retrieve updated data. [CrowdStrike Next-Gen SIEM integration](https://www.servicenow.com/docs/access?context=crowdstrike-next-gen-integration-secops&family=yokohama&ft:locale=en-US) : As a Profile Admin: * Discover CrowdStrike Next-Gen SIEM detections that are candidates for security incidents and automate the creation of these security incidents. * Create detection profiles. * Map CrowdStrike Next-Gen SIEM Detection and Events Fields to SIR security incident fields. * Filter CrowdStrike Next-Gen SIEM defects. * Aggregate detections to existing open security incidents so that you don't have to create duplicate security incidents. * Schedule ongoing detection ingestion. * Automate CrowdStrike Next-Gen SIEM detection status updates for Security Incident Response. * Synchronize CrowdStrike Next-Gen SIEM detection comments with SIR Work notes. [Create an event profile](https://www.servicenow.com/docs/access?context=splunk-event-ingest-create-profile-security&family=yokohama&ft:locale=en-US) : * Enables bidirectional updates and closure synchronization between Splunk ES and Splunk integrations. * Enables retrieval of historical, and ongoing data including closed events, with an option to pull the closed events into the ServiceNow Splunk ES instance. * Receive updates for the mapped fields in SIR. [Components installed with Security Incident Response](https://www.servicenow.com/docs/access?context=installed-with-sir&family=yokohama&ft:locale=en-US) : A new Profile Admin role (sn_si.ingestion_profile_admin) provides access to configure plugins, and create, edit, delete, and manage profiles for the Splunk, Splunk ES, and Azure Sentinel Integration for Security Operations application. [Configure report templates in Security Incident Response](https://www.servicenow.com/docs/access?context=daily-status-sir&family=yokohama&ft:locale=en-US) : As an admin, create report templates that can be used to generate an incident summary or an executive summary for analysis and sharing.As an analyst, use the templates to generate analyst summary or executive summary reports for a SIR incident that can be shared over email. [Security Incident Response conference call integration](https://www.servicenow.com/docs/access?context=sir-conf-call-capability&family=yokohama&ft:locale=en-US) : Initiate conference calls using communication channels such as Microsoft Teams, Cisco Webex, or Zoom with customers and peer agents to resolve security incidents over a call by using the SIR conference call feature. [Proofpoint integration for Security Operations](https://www.servicenow.com/docs/access?context=proofpoint-integration-secops-landing&family=yokohama&ft:locale=en-US) : Proofpoint integration for Security Operations supports integration between SOAR (Security Orchestration, Automation, and Response) and Proofpoint Targeted Attack Protection (TAP) software. This integration provides the following benefits: * Detect and block threats such as business email compromise and tags suspicious emails for tracking, analysis, and audit. * Import data to automatically create security incidents for email events that are not captured by TAP products. [Data Loss Prevention Incident Response Analyst Workspace](https://www.servicenow.com/docs/access?context=using-dlp-ops-portal&family=yokohama&ft:locale=en-US) : Preview the evidence file of the incident from either the Data Loss Prevention analyst workspace or the DLP end user workspace. | | Zurich | [MITRE D3FEND framework](https://www.servicenow.com/docs/access?context=mitre-d3fend-framework&family=zurich&ft:locale=en-US) : Security administrators can now ingest MITRE D3FEND data. Security analysts can explore MITRE ATT\&CK and D3FEND techniques through an interactive, node-based visualization that maps attack techniques, defense techniques, and related artifacts within a Security Incident Response (SIR) record. [Close multiple security incidents](https://www.servicenow.com/docs/access?context=close-multiple-incidents-sir&family=zurich&ft:locale=en-US) : Close security incidents in bulk with predefined closure comments or codes to reduce the time that would be spent on manually closing individual incidents. Closure candidates might include multiple incidents with common root causes such as alert misconfiguration, duplicates, or changes in system behavior. [Process Mining for security incidents](https://www.servicenow.com/docs/access?context=sir-process-mining&family=zurich&ft:locale=en-US) : Identify factors contributing to delays in processing SIR incidents that take a long time to close or resolve by scanning historical SIR records through Process Mining. Time-consuming factors can include multiple reassignments, prolonged hold times, and periods of inactivity. Use analysis methods to identify these factors such as multi-hop analysis or bottleneck analysis. [Send Observables to TISC](https://www.servicenow.com/docs/access?context=tisc-context-in-sir-workspace&family=zurich&ft:locale=en-US) : Add metadata to the observables such as confidence score, Traffic Light Protocol value, notes and TISC tags before sending them to TISC. [Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks](https://www.servicenow.com/docs/access?context=cortex-xsiam-siem&family=zurich&ft:locale=en-US) : As a profile admin: * Create profiles for incident ingestion. * Filter Cortex XSIAM incidents. * Map Cortex XSIAM Incident, Alert, and Event fields to SIR security incident fields. * Aggregate incidents to existing open security incidents to avoid having to create duplicate security incidents. * Synchronize ServiceNow instance Work notes with Palo Alto Networks XSIAM comments. [Set up Splunk environment](https://www.servicenow.com/docs/access?context=splunk-es-addon&family=zurich&ft:locale=en-US) : The ServiceNow Security Operations Event Ingestion Add-on for Splunk ES enables seamless integration between Splunk and ServiceNow Security Operations, allowing you to send security-related events from Splunk ES to a ServiceNow security incident. [LLM-powered SIR integration builder](https://www.servicenow.com/docs/access?context=sir-integration-builder-now-assist&family=zurich&ft:locale=en-US) : With the ServiceNow platform's latest LLM powered integrations, you can create product-ready integration quickly. The LLM-powered integration builder has the following capabilities: * Automatically generates integration code from a public API documentation. * Provides guided setup built on existing capabilities. * Provides easy edit and maintenance of the generated auto code. [Deny rule for phishing emails](https://www.servicenow.com/docs/access?context=urp-about&family=zurich&ft:locale=en-US) : The security admin can add rules to prevent the conversion of phishing emails such as false positives or low-risk messages into security incidents. Any new phishing email is verified first with the deny rules to avoid unwanted security incidents. [Update information in security incident related records](https://www.servicenow.com/docs/access?context=edit-related-records-in-list&family=zurich&ft:locale=en-US) : The security analysts can now edit related records such as associated observables, for a security incident directly from the Related Records list view. Security analysts can quickly update the records without leaving their current context. [Advanced Work Assignment for SIR](https://www.servicenow.com/docs/access?context=awa-for-sir&family=zurich&ft:locale=en-US) : Use Advanced Work Assignment (AWA) to streamline the security incident assignment process which ensure that critical incidents are handled by the most appropriate and available analysts. This improves overall response times and efficiency in security operations.As an admin, configure the following: * Service channels * Queues * Assignment rules * Presence states * Rejection reasons As an analyst, do the following: * Set your availability * Accept or reject incoming security incidents [Prevent duplicate security incidents for IT incidents](https://www.servicenow.com/docs/access?context=si-creation&family=zurich&ft:locale=en-US) : Prevent the creation of duplicate security incidents when ITIL users escalate an IT incident to a security incident, the system by enabling the `sn_si.disable_duplicate_security_incident` system property. [Ingest third-party risk scores](https://www.servicenow.com/docs/access?context=define-risk-score-calculator-rules-sir&family=zurich&ft:locale=en-US) : Factor third-party risk scores into security incident risk calculation by ingesting and mapping those scores for better prioritization of high-risk threats. [Simplified adding categories and sub-categories for security incidents](https://www.servicenow.com/docs/access?context=category-management-sir&family=zurich&ft:locale=en-US) : Admin can create categories and subcategories in Security Incident Response Workspace based on threat types, compliance requirements, or reporting needs. Security analysts can assign these categories and subcategories to security incidents. [Security incident Details tab](https://www.servicenow.com/docs/access?context=security-incident-details-form&family=zurich&ft:locale=en-US) : Include the Functional Impact, Recoverability and Information Impact fields on the Details tab of a security incident to improve triage accuracy, incident handling efficiency, and executive reporting for calculating the risk score. [Add indirectly linked VITs to CVEs](https://www.servicenow.com/docs/access?context=configure-mitre-att-ck-properties&family=zurich&ft:locale=en-US) : In MITRE-ATT\&CK framework, identify all third-party entities (TPEs) associated with common vulnerabilities and exposures (CVEs) and then calculate and display the total number of vulnerable items (VITs) indirectly linked to those CVEs through the TPEs by setting the sn_ti.include_cve_vit_indirect_relation system property. [Configure on-call schedules](https://www.servicenow.com/docs/access?context=on-call-schedule-sir&family=zurich&ft:locale=en-US) : As an admin, manage on-call schedules through the following activities: * Create a shift and assign or remove members to or from the shift. * Create and edit on-call schedules for groups. * View any group's on-call schedule. As an analyst, track your on-call responsibilities through the following activities: * Specify your availability and preferred contact methods. * View your on-call schedule. * See other members of your shift. [Users accessing the same incident](https://www.servicenow.com/docs/access?context=security-incident-overview&family=zurich&ft:locale=en-US) : When you open an incident, the initials of all the users currently accessing the same incident are displayed to avoid conflicts. [Universal search field for linking observables](https://www.servicenow.com/docs/access?context=sir-records&family=zurich&ft:locale=en-US) : Search across all the field values of the associated observables for an incident. [CrowdStrike Next-Gen SIEM integration](https://www.servicenow.com/docs/access?context=crowdstrike-next-gen-integration-secops&family=zurich&ft:locale=en-US) : As a Profile Admin: * Discover CrowdStrike Next-Gen SIEM detections that are candidates for security incidents and automate the creation of these security incidents. * Create detection profiles. * Map CrowdStrike Next-Gen SIEM Detection and Events Fields to SIR security incident fields. * Filter CrowdStrike Next-Gen SIEM defects. * Aggregate detections to existing open security incidents so that you don't have to create duplicate security incidents. * Automate CrowdStrike Next-Gen SIEM detection status updates for Security Incident Response. * Synchronize CrowdStrike Next-Gen SIEM detection comments with SIR Work notes. [Create an event profile](https://www.servicenow.com/docs/access?context=splunk-event-ingest-create-profile-security&family=zurich&ft:locale=en-US) : * Enables bidirectional updates and closure synchronization between Splunk ES and Splunk integrations. * Enables retrieval of historical, and ongoing data including closed events, with an option to pull the closed events into the ServiceNow Splunk ES instance. * Receive updates for the mapped fields in SIR. [Components installed with Security Incident Response](https://www.servicenow.com/docs/access?context=installed-with-sir&family=zurich&ft:locale=en-US) : A new Profile Admin role (sn_si.ingestion_profile_admin) provides access to configure plugins, and to create, edit, delete, and manage profiles for the Splunk, Splunk ES, and Azure Sentinel Integration for Security Operations application. [Enhancements to relationship graphs](https://www.servicenow.com/docs/access?context=sir-relationship-graph&family=zurich&ft:locale=en-US) : As an admin: * Define default child nodes to populate in the relationship graph. * Configure relationship labels. As an analyst: * Add or remove child nodes at the parent node level. * Save the state of the relationship graph. * Retrieve updated data. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing Security Incident Response features. {#dfrn3-securityincidentresponse-summary__entry__14} | Release | Release notes | |-|-| | Yokohama | [Start a Sidebar chat in Security Incident Response](https://www.servicenow.com/docs/access?context=initiate-chat-sidebar-sir&family=yokohama&ft:locale=en-US) : The Discuss option has been renamed Start Chat and moved under the Collaborate option. [Security Operations](https://www.servicenow.com/docs/access?context=security-operations-landing-page&family=yokohama&ft:locale=en-US) : {#dfrn3-securityincidentresponse-summary__entry__18} | Integration name | Integration changes | |-|-| | Microsoft Teams Chat | Simplified the setup of Microsoft Teams Chat integration with Major Security Incident Management Workspace. For more information, see [Integrate Major Security Incident Management with Microsoft SharePoint](https://www.servicenow.com/docs/access?context=integrate-msim-sharepoint&family=yokohama&ft:locale=en-US). | | Microsoft SharePoint | Simplified the setup of Microsoft SharePoint integration with Major Security Incident Management Workspace. For more information, see [Integrate Major Security Incident Management with Microsoft Teams](https://www.servicenow.com/docs/access?context=integrate-teams-msim&family=yokohama&ft:locale=en-US). | | Security Incident Response Integrations | Workflow was migrated to Workflow Studio. For more information, see the following: * [Get Log Data Flow](https://www.servicenow.com/docs/access?context=get-threat-log-data&family=yokohama&ft:locale=en-US) * [Get WildFire Data Enrichment Flow](https://www.servicenow.com/docs/access?context=enrich-wildfire-data&family=yokohama&ft:locale=en-US) * [Configure](https://www.servicenow.com/docs/access?context=activate-configure-ms-exch-on-prem-integ&family=yokohama&ft:locale=en-US) * [Microsoft Exchange - Perform Email Search and Deletion flow](https://www.servicenow.com/docs/access?context=ms-exch-perform-email-search-deletion-wf&family=yokohama&ft:locale=en-US) * [Get AutoFocus Session Info Enrichment Flow](https://www.servicenow.com/docs/access?context=search-for-malicious-content&family=yokohama&ft:locale=en-US) | | Security Incident Response Orchestration | Workflow was migrated to Workflow Studio in the section [Run procdump flow](https://www.servicenow.com/docs/access?context=invoke_procdump&family=yokohama&ft:locale=en-US). | | Security Operations common functionality | Workflow was migrated to Workflow Studio. For more information, see the following: * [Integration capabilities](https://www.servicenow.com/docs/access?context=integration-capabilities&family=yokohama&ft:locale=en-US) * [Security Operations Integration- Block Request capability](https://www.servicenow.com/docs/access?context=block-request-capability&family=yokohama&ft:locale=en-US) * [Security Operations Integration- Email Search and Delete capability](https://www.servicenow.com/docs/access?context=email-search-capability&family=yokohama&ft:locale=en-US) * [Security Operations Integration- Enrich CI capability](https://www.servicenow.com/docs/access?context=enrich-ci-capability&family=yokohama&ft:locale=en-US) * [Security Operations Integration- Enrich Observable capability](https://www.servicenow.com/docs/access?context=enrich-observable-capability&family=yokohama&ft:locale=en-US) * [Security Operations Integration- Get Network Statistics capability](https://www.servicenow.com/docs/access?context=get-network-statistics-capability&family=yokohama&ft:locale=en-US) * [Security Operations Integration- Get Running Processes capability](https://www.servicenow.com/docs/access?context=get-running-processes-capability&family=yokohama&ft:locale=en-US) * [Security Operations Integration- Isolate Host capability](https://www.servicenow.com/docs/access?context=isolate-host-capability&family=yokohama&ft:locale=en-US) * [Security Operations Integration- Publish to Watchlist capability](https://www.servicenow.com/docs/access?context=pubish-to-watchlist-capability&family=yokohama&ft:locale=en-US) * [Security Operations Integration- Sightings Search capability](https://www.servicenow.com/docs/access?context=sightings-search-capability&family=yokohama&ft:locale=en-US) * [Security Operations Integration - Threat Lookup capability](https://www.servicenow.com/docs/access?context=sec-ops-threat-lookups-capability&family=yokohama&ft:locale=en-US) * [Change the order of flow execution](https://www.servicenow.com/docs/access?context=change-wf-execution-order&family=yokohama&ft:locale=en-US) | [ ] [Other additional Security Incident Response setup tasks](https://www.servicenow.com/docs/access?context=t_ConfigureSIM&family=yokohama&ft:locale=en-US) : View security incidents with read access and update security incidents with write access without any defined security role. | | Zurich | [Shift Handover Records](https://www.servicenow.com/docs/access?context=manage-shift-handover-records&family=zurich&ft:locale=en-US) : The Start date and End date fields have been removed. You can now select the shift name instead when configuring the Shift Handover record. Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [Security Incident Response Other Records](https://www.servicenow.com/docs/access?context=security-incident-response-other-records&family=zurich&ft:locale=en-US) : Add
 multiple ITSM incidents, problems, or change requests to a security incident for which multiple IT actions are needed. For more information, see the "Link multiple ITSM incidents" section. [Modify attachments of a closed security incident](https://www.servicenow.com/docs/access?context=t_ClosingSecIncidents&family=zurich&ft:locale=en-US) : You cannot modify the attachments of a security incident once the security incident is closed. | [ ] ## Removed Between your current release family and Zurich, some Security Incident Response features or functionality were removed. {#dfrn3-securityincidentresponse-summary__entry__32} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some Security Incident Response features or functionality were deprecated. {#dfrn3-securityincidentresponse-summary__entry__38} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate Security Incident Response. {#dfrn3-securityincidentresponse-summary__entry__44} | Release | Release notes | |-|-| | Yokohama | Activation information : Install Security Incident Response by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). [Security Operations common functionality](https://www.servicenow.com/docs/access?context=sec-ops-common-functionality&family=yokohama&ft:locale=en-US) : The Security Support Common plugin is activated when any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated. Important: Security Incident Response is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Zurich | Activation information : Install Security Incident Response by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). [Security Operations common functionality](https://www.servicenow.com/docs/access?context=sec-ops-common-functionality&family=zurich&ft:locale=en-US) : The Security Support Common plugin is activated when any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated. Important: Security Incident Response is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Security Incident Response we have noted them here. {#dfrn3-securityincidentresponse-summary__entry__50} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Security Incident Response we have noted them here. {#dfrn3-securityincidentresponse-summary__entry__56} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Security Incident Response, such as specific requirements or compliance levels. {#dfrn3-securityincidentresponse-summary__entry__62} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | [ ] ## Localization information If there are specific localization considerations for Security Incident Response we have noted them here. {#dfrn3-securityincidentresponse-summary__entry__68} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Security Incident Response we have noted them here. {#dfrn3-securityincidentresponse-summary__entry__74} | Release | Release notes | |-|-| | Yokohama | * Identify inefficiencies and optimize the resolution process of security incidents for faster closure by using Process MIning. * Implemented CrowdStrike Next-Gen SIEM integration enabling real-time ingestion of correlated detections, and enrichment data. * Enhanced Splunk ES integrations to improve incident classification and enable efficient retrieval of historical data and alerts. * Include the number of VITs indirectly associated with a CVE through TPEs. * Help managers ensure there are no gaps in coverage and analysts are always available to address security incidents by configuring shifts for analysts. * Define default child nodes to populate in the relationship graph, and add or remove child nodes at the parent node level. See [Security Incident Response](https://www.servicenow.com/docs/access?context=sir-landing-page&family=yokohama&ft:locale=en-US) for more information. | | Zurich | * Integrate Cortex XSIAM by Palo Alto Networks with ServiceNow Security Incident Response platform to turn SIEM insights into actionable incidents, thus accelerating response from detection to closure. * Use Advanced Work Assignment (AWA) to automatically assign incidents to your security analysts, based on their availability, capacity, and skills. * Ingest third-party risk scores in Security Incident Response to factor these scores when calculating risk scores. * Starting in version 13.9.33, you can do the following: * Fetch closed offenses from IBM QRadar into Security Incident Response. * Set the batch size for correlation rules during IBM QRadar offense polling to optimize performance. * Use the Now Assist LLM-powered integration builder to rapidly build integrations for Security Incident Response using auto-code generation. * Ingest MITRE D3FEND data and visualize attack--defense relationships through an interactive graph directly within a security incident. * Starting in version 13.9.21, you can do the following: * Integrate CrowdStrike Next-Gen SIEM integration with ServiceNow Security Incident Response platform to retrieve detections and convert them into security incidents, thus enabling automated response actions. * Improve incident classification and enable efficient retrieval of historical data and alerts through enhanced Splunk ES integrations. * Configure and use on-call scheduling to prevent gaps in coverage and ensure analysts are available to address security incidents by configuring shifts for analysts. See [Security Incident Response](https://www.servicenow.com/docs/access?context=sir-landing-page&family=zurich&ft:locale=en-US) for more information. | [ ]