--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-yokohama-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zy bundleId : - delta3zy --- # Combined ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes for upgrades from Yokohama to Zurich # Combined ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes for upgrades from Yokohama to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 14 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined ServiceNow Otto for Security Incident Response (SIR) Release Notes: Yokohama to Zurich This consolidated guide outlines the key updates, features, configuration requirements, and upgrade considerations for ServiceNow Otto for Security Incident Response (SIR) from Yokohama through to the Zurich release. It is designed to help ServiceNow customers prepare for and smoothly transition to the Zurich release, highlighting new AI-driven capabilities, agentic workflows, and security enhancements to improve incident response efficiency. Show full answer Show less ## Key Features * **Now Assist Skills Activated by Default:** Skills such as security incident summarization, resolution notes generation, post-incident analysis, recommended actions, correlation insights, and quality assessment reports are enabled automatically for new customers and previously unconfigured skills during upgrades. * **AI Agents and Agentic Workflows:** The Zurich release introduces AI agents assisting with security incident resolution, shift handover report generation, and security operations metrics analysis. These AI agents analyze incident data, runbooks, and historical cases to provide resolution plans and actionable insights. * **Enhanced Correlation Insights:** Users can generate correlation insights in the Security Incident Response Workspace for multiple configuration items (CIs), affected users, or observables simultaneously, enhancing incident triage and investigation. * **Security Incident Quality Assessment:** Generative AI creates detailed quality assessment reports based on predefined natural language rules, aiding in evaluating incident handling effectiveness. * **Agentic Workflow for Security Operations Metrics:** Security managers can analyze team performance metrics such as case volume, mean time to assign (MTTA), and mean time to resolve (MTTR), and receive AI-generated improvement suggestions. * **New AI Model Providers:** Customers can now leverage Google Gemini and AWS Claude alongside existing Now LLM Service and Azure OpenAI models for AI-powered features. * **Integration Enhancements:** New capabilities include Sightings search and Isolate host functions within the incident resolution workflow to expedite containment and remediation. * **User Access and Role Configuration:** Agentic workflows and AI agents require explicit role assignments to execute; administrators must configure these roles properly to ensure functionality. * **Improved User Interface:** A new "Show More" UI card enhances visibility and context for recommended actions during incident investigation. ## Upgrade and Configuration Considerations * **Pre- and Post-Upgrade Tasks:** Customers should review and complete all recommended upgrade tasks to enable new AI features and workflows. * **Automatic Dependency Updates:** Updating Otto for SIR also updates required dependent applications automatically. * **AI Search Requirement:** The AI Search application must be enabled for recommended actions to function correctly; verify status via AI Search settings. * **Role-Based Access Control:** To use agentic workflows and AI agents, roles installed with the application must be assigned to users with restricted access settings. * **Now Assist Usage Measurement Changes:** Usage measurement transitioned to a 365-day burn-down model resetting on the contract anniversary date starting from Yokohama Patch 5. * **Activation:** ServiceNow Otto for Security Incident Response is available through the ServiceNow Store and requires installation and activation via the store portal. ## Key Outcomes for ServiceNow Customers * **Improved Incident Resolution Efficiency:** AI-powered workflows and agents streamline resolution planning and execution by leveraging existing runbooks, knowledge articles, and incident history. * **Enhanced Incident Analysis and Reporting:** Quality assessment reports and shift handover content generation automate documentation tasks, reducing manual effort and improving accuracy. * **Better Security Operations Insights:** Metrics analysis workflows and enhanced correlation insights enable security teams to monitor performance and identify patterns for faster incident triage. * **Greater Control and Security:** Role configuration requirements ensure secure activation and usage of AI agents and workflows in line with organizational policies. * **Flexible AI Model Options:** Access to multiple AI model providers allows customers to select the best AI capabilities to fit their environment and preferences. * **Smooth Upgrade Path:** Clear guidance on new default behaviors and feature activations helps customers manage changes with minimal disruption. Consolidated page of all release notes for ServiceNow Otto for Security Incident Response (SIR) (SIR) from Yokohama to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family ServiceNow Otto for Security Incident Response (SIR) (SIR) release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading ServiceNow Otto for Security Incident Response (SIR) (SIR) to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__2} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | Upgrade information : Note: The following Now Assist skills, agents, and agentic workflows for ServiceNow Otto for Security Incident Response (SIR) are activated by default: Skills * Security incident summarization * Resolution notes generation * Post incident analysis * Security incident recommended actions * Correlation insights generation * Security incident quality assessment * Natural language condition evaluator * Generate content for shift handover * Quality assessment report NACM * Security incident resolution plan * Security operations metrics analysis Agentic workflows * Wrap up security incident * Resolve security incident * Generate SIR shift handover report * Analyze security operations metrics Agents * EDR AI agent * Exchange online integration handling AI agent * Observable analysis AI agent * Security incident activities handling AI agent * Security incident resolution AI agent * Security incident retrieval AI agent * Security incident shift handover AI agent * Security incident wrap up generator AI agent * Security metrics analysis AI agent For more information, see [AI assets on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=zurich&ft:locale=en-US) Note: Upgrading the Now Assist plugins activates any designated skills that were previously untouched by the customer. * If you installed the plugins for a skill but never configured it, meaning you never activated it nor adjusted associated roles, any skill on by default is activated on a per skill basis when upgrade. * If you previously toggled a skill from active and then back to inactive, or updated any roles for that skill, that skill remains inactive when upgrading. * You maintain full control over deactivating individual skills at any time after activation. When you update the ServiceNow Otto for Security Incident Response (SIR) (SIR) application, the dependency applications are automatically updated. For more information about required applications for ServiceNow Otto for Security Incident Response (SIR), see [Supporting information](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-security-incident&family=zurich&ft:locale=en-US). The AI Search application must be enabled so that the recommended actions skill works for security incidents with ServiceNow Otto for Security Incident Response (SIR). To verify that AI Search is enabled on your instance, navigate to AllAI SearchAI Search Status. Contact support if the page indicates that AI Search isn't enabled. | [ ] ## New features Between your current release family and Zurich, new features were introduced for ServiceNow Otto for Security Incident Response (SIR) (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__8} | Release | Release notes | |-|-| | Yokohama | [Role configuration required for agentic workflows and AI agents](https://www.servicenow.com/docs/access?context=aia-role-masking&family=yokohama&ft:locale=en-US) : Agentic workflows and AI agents included with Now Assist applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they will not execute. Data access settings must also include these roles. See the documentation for the agentic workflow or AI agent for the specific roles you must add. [Some Now Assist skills are turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Generate a quality assessment report](https://www.servicenow.com/docs/access?context=na-sir-quality-assessment&family=yokohama&ft:locale=en-US) : Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules. [Generate SIR Shift Handover Report](https://www.servicenow.com/docs/access?context=add-incidents-shifthandover-ai-agent&family=yokohama&ft:locale=en-US) : The AI Agent helps add security incident details to a shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. The AI agent can fetch details of the security incident and identify if the analyst has access to the shift handover record. The AI agent can generate content for each section of the shift handover record and asks for analysts feedback on the content. The AI agent refines the content based on the feedback and saves the content to the records on approval. [New third-party AI model provider options available for all Now Assist applications](https://www.servicenow.com/docs/access?context=exploring-large-language-models&family=yokohama&ft:locale=en-US) : Google Gemini and AWS Claude are available for Now Assist skills and AI agents in addition to Now LLM Service and Azure OpenAI. [Use agentic workflows](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=yokohama&ft:locale=en-US) : The Analyze security operations metrics agentic workflow enables security managers to analyze their teams' performance. * Generate metrics for Security Incident Response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) for a date range of your choosing. * Request suggestions for how to improve MTTR, MTTA, and volume based on your metrics. [Enhancements to correlation insights in Now Assist for Security Incident Response](https://www.servicenow.com/docs/access?context=generating-insights-for-now-assist-for-security&family=yokohama&ft:locale=en-US) : You can generate and view results for correlation insights in the Security Incident Response Workspace. * Correlation insights are not limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident. * You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace. * You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users. * Results are displayed in a modeless dialog that you can size and move. [Using Security incident resolution agentic workflow](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=yokohama&ft:locale=en-US) : Use the Security incident resolution agentic workflow to close your security incidents. Analysts can chat with the AI agents in natural language to resolve the security incidents. The AI agent analyzes the incident details, existing runbooks, knowledge articles, and past similar security incidents as inputs, and provides a resolution plan. The AI agent also assists the analysts to resolve the security incident. [Using Security Incident Response AI agents](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=yokohama&ft:locale=en-US) : Yokohama Patch 1: Use the Close security incident use case to close your security incidents: * Analysts can chat with the AI agents in natural language to close the security incidents. The AI agent can cancel the associated response tasks, generate resolution notes, close code, or close notes and post incident analysis (PIA) during incident closure. Analysts can provide feedback on the content and the AI agent can refine the content based on the feedback. * Analysts can also close false positive security incidents with minimal user intervention. [Yokohama Early Availability](https://www.servicenow.com/docs/access?context=now-assist-security-incident-landing&family=yokohama&ft:locale=en-US) : * [Generate correlation insights](https://www.servicenow.com/docs/access?context=generate-correlation-insights-now-assist-for-security&family=yokohama&ft:locale=en-US) Generate correlation insights to connect current security incidents to past events. You can identify the affected users, configuration items (CI)s, or observables (IP addresses and file hashes) from existing incidents and records to help you more quickly triage your new security incidents. Correlation insights are supported in Workspace, the Core UI, and from the Now Assist panel. * Enhancements to [closure (resolution) notes](https://www.servicenow.com/docs/access?context=generate-closure-notes-si-now-assist-sec-incident&family=yokohama&ft:locale=en-US) and [post incident analysis](https://www.servicenow.com/docs/access?context=generate-pia-report-now-assist-security-incident&family=yokohama&ft:locale=en-US) generation Generate resolution notes from the Close the security incident modal or the Now Assist context menu on a security incident record (SIR). You can also generate resolution notes from the Now Assist panel. If you choose the Now Assist context menu, you have the following options to help you refine the generated text: * Shorten: Select the text to remove details. * Elaborate: Generate more details about the context of a security incident. Note: Generating resolution notes is supported in Workspace and Core UI. Generating a post incident analysis is supported from the Close the security incident modal in Workspace. | | Zurich | [Resolve a security incident](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Help enhance incident resolution plan generation by adding your existing runbooks to the AI runbooks section within the Security incident resolution plan skill. The existing runbooks provide additional context to the skill. [Role configuration required for agentic workflows and AI agents](https://www.servicenow.com/docs/access?context=aia-role-masking&family=zurich&ft:locale=en-US) : Agentic workflows and AI agents included with your applications require additional security configuration. If you select Users with selected roles for your user access security controls for an agentic workflow or AI agent, you must add the installed roles, or they will not execute. See the documentation for the agentic workflow or AI agent for the specific roles you must add. [Explore Security incident quality assessment](https://www.servicenow.com/docs/access?context=na-sir-quality-assessment&family=zurich&ft:locale=en-US) : Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules. [Generate SIR Shift Handover Report](https://www.servicenow.com/docs/access?context=add-incidents-shifthandover-ai-agent&family=zurich&ft:locale=en-US) : The AI agent helps add security incident details to a shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. The AI agent can fetch details of the security incident and identify if the analyst has access to the shift handover record. The AI agent can generate content for each section of the shift handover record and asks for analysts feedback on the content. The AI agent refines the content based on the feedback and saves the content to the records on approval. [Use agentic workflows](https://www.servicenow.com/docs/access?context=using-now-assist-ai-agents-sir&family=zurich&ft:locale=en-US) : The analyze security operations metrics agentic workflow helps security managers to analyze their teams' performance. * Generate metrics for Security Incident Response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) for a date range of your choosing. * Request suggestions for how to improve MTTR, MTTA, and volume based on your metrics. [Enhancements to correlation insights in ServiceNow Otto for Security Incident Response (SIR)](https://www.servicenow.com/docs/access?context=generating-insights-for-now-assist-for-security&family=zurich&ft:locale=en-US) : You can generate and view results for correlation insights in the Security Incident Response Workspace. * Correlation insights aren't limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident. * You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace. * You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users. * Results are displayed in a modeless dialog that you can size and move. [Using the security incident resolution agentic workflow](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Use the security incident resolution agentic workflow to close your security incidents. Analysts can chat with AI agents in natural language to resolve the security incidents. The AI agent analyzes the incident details, existing runbooks, Knowledge articles, and past similar security incidents as inputs, and provides a resolution plan. The AI agent also assists the analysts to resolve the security incident. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing ServiceNow Otto for Security Incident Response (SIR) (SIR) features. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__14} | Release | Release notes | |-|-| | Yokohama | [Changes to Now Assist usage measurement](https://www.servicenow.com/docs/access?context=monitoring-now-assist-usage&family=yokohama&ft:locale=en-US) : Starting with Yokohama Patch 5, Now Assist usage measurement is transitioning from a 365-day look-back model to a 365-day burn-down model, with usage resetting at the contract anniversary date. For more information, refer to [KB KB2704710: Now Assist Usage - Overview \& New Measurement Logic](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2704710). [Some Now Assist skills are now turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The following Now Assist skills for ServiceNow Otto for Security Incident Response (SIR) and ServiceNow Otto for Unified Security Exposure Management are activated by default. * Security incident summarization (SIR) * Resolution notes generation (SIR) * Post incident analysis (SIR) * Security incident recommended actions (SIR) * Correlation insights generation (SIR) * Security incident quality assessment (SIR) The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Configure ACLs for AI agents and agentic workflows](https://www.servicenow.com/docs/access?context=aia-security-implementation&family=yokohama&ft:locale=en-US) : Configure the access control lists for who can discover and trigger AI agents and agentic workflows in their guided setups in AI Agent Studio. You can determine whether an AI agent or agentic workflow behaves as a dynamic user or as an AI user. You can also specify if an AI agent or agentic workflow can be available to all authenticated users or publicly available. [Generate recommended actions](https://www.servicenow.com/docs/access?context=generate-recommended-actions-now-assist-for-security&family=yokohama&ft:locale=en-US) : Introduced a new UI card Show More to enhance the visibility of recommended actions. As a security analyst, you can now access additional context along with further recommended steps to assist in the analysis and investigation of security incidents. [Now Assist for Security Incident Response application name change](https://www.servicenow.com/docs/access?context=activate-skills-for-now-assist-security-incident&family=yokohama&ft:locale=en-US) : Starting with version 2.0.1, the Now Assist for Security Operations application in the ServiceNow® Store and in your ServiceNow AI Platform® instance has changed to the ServiceNow Otto for Security Incident Response (SIR) application. | | Zurich | [Resolve a security incident](https://www.servicenow.com/docs/access?context=now-assist-sir-resolve-incident-ai-workflow&family=zurich&ft:locale=en-US) : Use the Sightings search and Isolate host capabilities in the Resolve security incident workflow to help resolve security incidents. [Generate recommended actions](https://www.servicenow.com/docs/access?context=generate-recommended-actions-now-assist-for-security&family=zurich&ft:locale=en-US) : A new Show More UI card has been introduced to enhance the visibility of recommended actions. As a security analyst, you can now access additional context along with further recommended steps to assist in the analysis and investigation of security incidents. | [ ] ## Removed Between your current release family and Zurich, some ServiceNow Otto for Security Incident Response (SIR) (SIR) features or functionality were removed. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__20} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some ServiceNow Otto for Security Incident Response (SIR) (SIR) features or functionality were deprecated. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__26} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate ServiceNow Otto for Security Incident Response (SIR) (SIR). {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__32} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | Activation information : Install ServiceNow Otto for Security Incident Response (SIR) by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: ServiceNow Otto for Security Incident Response (SIR) is available in ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__38} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__44} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for ServiceNow Otto for Security Incident Response (SIR) (SIR), such as specific requirements or compliance levels. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__50} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__56} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for ServiceNow Otto for Security Incident Response (SIR) (SIR) we have noted them here. {#dfrn3-servicenowottoforsecurityincidentresponsesirsir-summary__entry__62} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | [Zurich Patch 7](https://www.servicenow.com/docs/access?context=zurich-patch-7&family=zurich&ft:locale=en-US) * Help enhance incident resolution plan generation by adding your existing runbooks to the AI runbooks section within the Security incident resolution plan skill. The existing runbooks provide additional context to the skill. * Use the Sightings search and Isolate host capabilities in the Resolve security incident workflow to help resolve security incidents. [Zurich Patch 5](https://www.servicenow.com/docs/access?context=zurich-patch-5&family=zurich&ft:locale=en-US) * Review changes to Now Assist usage measurement. [Zurich Patch 4](https://www.servicenow.com/docs/access?context=zurich-patch-4&family=zurich&ft:locale=en-US) * Some Now Assist skills are now turned on by default. * Use generative AI to create a quality assessment report of a security incident. * Additional role configuration required for agentic workflows and AI agents included with your applications. [Zurich Patch 1](https://www.servicenow.com/docs/access?context=zurich-patch-1&family=zurich&ft:locale=en-US) * Help analysts to add security incidents details to the Shift Handover report by chatting with AI agents in the Now Assist panel. Zurich Early Availability * Help your analysts to gain insight into security incident record metrics with an agentic workflow. Chat with AI agents in natural language from the Now Assist panel. * Help your analysts to resolve security incidents by chatting with AI agents in the Now Assist panel where the AI agent can assist in providing a resolution plan. | [ ] *[\>]: and then