--- sourceDocument: Zurich Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Use agentic workflows # Using agentic AI workflows {#ariaid-title1} Release version: Zurich Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Using agentic AI workflows Agentic AI workflows in the Security Incident Response (SIR) application automate task completion autonomously by leveraging AI agents and role masking to control user access. These workflows come with predefined roles included with the application, and administrators must configure security controls to grant access to users assigned to those roles. Access to features depends on your ServiceNow license tier. Show full answer Show less Some generative AI skills, AI agents, and agentic workflows are enabled by default. New customers get these assets turned on automatically upon AI product installation. Existing customers upgrading from Zurich Patch 4 retain their current configurations, with AI assets turning on only if they were never previously enabled or had roles adjusted. ## Key Features * **Security Incident Wrap-up:** Assists security analysts in closing incidents using natural language commands in the ServiceNow Otto panel via the Security incident wrap-up generator AI agent. * **Analyze Security Operations Metrics:** Helps SOC managers generate performance metrics like case volume, MTTA, and MTTR for SIR records, utilizing the Security incident retrieval AI agent and Security metrics analysis AI agent. * **Resolve Security Incident:** Guides analysts through identifying resolution paths and closing incidents with natural language assistance, supported by multiple AI agents including resolution, exchange online integration handling, observable analysis, and EDR agents. * **Generate SIR Shift Handover Report:** Automatically populates shift handover reports with relevant incident details using the Security incident shift handover AI agent. All agentic workflows and AI agent records are read-only by default; to customize, you must duplicate the workflow first. Workflows can also be configured with triggers for automatic invocation. ## Practical Considerations for ServiceNow Customers * Ensure appropriate roles are assigned and security controls configured to enable user access to agentic workflows. * Understand your license entitlements to know which AI features and workflows are available. * Recognize that some AI agents may exist on your instance but not be linked to workflows; you can view all available agents to assess usage. * Modify workflows only by duplicating them to preserve default configurations and maintain upgrade compatibility. Use the Security Incident Response AI agentic workflows to complete your tasks autonomously. Agentic workflows and their AI agents use [role masking](https://www.servicenow.com/docs/access?context=aia-role-masking&version=zurich&pubname=zurich-intelligent-experiences&ft:locale=en-US) to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see [Define security controls for an agentic workflow](https://www.servicenow.com/docs/access?context=define-sec-controls-aw&version=zurich&pubname=zurich-intelligent-experiences&ft:locale=en-US). Note: Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&version=zurich&pubname=zurich-intelligent-experiences&ft:locale=en-US). Important: Some generative AI skills, agents, and agentic workflows are turned on by default. The default behavior works as follows: New customers : When you install an AI product, designated generative AI skills, AI agents, or agentic workflows are turned on automatically. Existing customers who are upgrading (starting with Zurich Patch 4) : There is no change to skills, agents, or agentic workflows that are currently enabled and customized.An AI asset is turned on if: * The AI plugin is installed, but the asset was never turned on. * An admin has never adjusted roles for the skill. {#using-now-assist-ai-agents-sir__ul_yvc_bvq_g3c} An AI asset is not turned on if: * The asset was previously turned on, and then turned off again. * An admin has adjusted roles for the asset. {#using-now-assist-ai-agents-sir__ul_zvc_bvq_g3c} For more information, see [AI agents, skills, and agentic workflows on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&version=zurich&pubname=zurich-intelligent-experiences&ft:locale=en-US). {#using-now-assist-ai-agents-sir__table_fsq_52h_m2c__entry__3} | Agentic workflow name | Description | Available AI agents | |-|-|-| | Wrap up security incident | This agentic workflow helps the security analysts to close a security incident using natural language in the ServiceNow Otto panel. | Security incident wrap-up generator AI agent | | Analyze security operations metrics | This agentic workflow helps a security operations center (SOC) manager analyze their security analysts' performance. Metrics are generated for security incident response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR). | * Security incident retrieval AI agent * Security metrics analysis AI agent {#using-now-assist-ai-agents-sir__ul_nxz_v3m_w2c} | | Resolve security incident | This agentic workflow helps the security analysts to identify a security incident resolution path. This workflow also assist the security analysts to close a security incident using natural language in the ServiceNow Otto panel. | * Security incident resolution AI agent * Exchange online integration handling AI agent * Security incident wrap up generator AI agent * Observable analysis AI agent * Security incident activities handling AI agent * EDR AI agent {#using-now-assist-ai-agents-sir__ul_nx5_2ty_1fc} | | Generate SIR Shift Handover Report | This agentic workflow adds details of a security incident to the shift handover report. The agent populates the different sections of the shift handover with appropriate content by identifying the relevant details from the security incident. | Security incident shift handover AI agent | [Table 1. Available agentic workflows for AI agents for Security Incident Response] {#using-now-assist-ai-agents-sir__table_fsq_52h_m2c} Important: By default, all agentic workflows and AI agent records are read-only. To modify an agentic workflow, you must first [duplicate the agentic workflow](https://www.servicenow.com/docs/access?context=clone-aia-usecase&version=zurich&pubname=zurich-intelligent-experiences&ft:locale=en-US). If required, you can add a trigger to invoke the workflow automatically. There might be AI agents installed on your instance that are not used in agentic workflows. To learn how to see all agents that are available to you, see [Find AI agents](https://www.servicenow.com/docs/access?context=find-ai-agents&version=zurich&pubname=zurich-intelligent-experiences&ft:locale=en-US).