Use capabilities in SIR Workspace

Use the capabilities created using Now Assist for Security Incident Response integrations in the SIR Workspace.

Before you begin

Role required: sn_si_int_kit.integration_creator or sn_si.analyst

Procedure

1. Navigate to Workspaces > Security Incident Response Workspace.
2. From the list view, select any security incident record.
3. Select the Investigation tab.
4. Select Associated Observable or Configuration Items.
   The capabilities applicable to observables are available under the Associated Observable section. The capabilities applicable to configuration items are available under the Configuration Items section.
5. Select the observables on which you want to execute the capabilities.
6. Select the Capability button.

   A pop-up appears with the list of applications.

   
7. Select the application to execute the capability.

   The run() method is called from the SIR Workspace.