{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44401,"path":"security-management/security-incident-response/configuring-now-assist-for-security-operations.md","title":"Configuring ServiceNow Otto for Security Incident Response \\(SIR\\)","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configuring ServiceNow Otto for Security Incident Response \\(SIR\\)\n\nThe ServiceNow Otto for Security Incident Response \\(SIR\\) application is supported in the Security Incident Response Workspace and in the legacy Core UI \\(UI16\\). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response \\(SIR\\).\n\n## Configuration overview\n\nAI agents use [role masking](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/implement-aias-security-new.md) to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select **Users with specific roles** for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see [Define security controls for an AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/define-sec-controls-aia.md).\n\n**Important:** Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/now-assist-skills-on-by-default.md).\n\nBy sharing data with the ServiceNow® AI development program, you provide relevant data to help improve prediction accuracy, user experience, tailor products to your business needs, and reduce hallucinations for your activated ServiceNow Otto skills.\n\nYou can opt out of a ServiceNow instance from sharing data from the AI Admin Hub console. See [Opt out of data sharing for Now Assist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/opt-out-of-data-sharing-for-now-assist.md). Repeat the opt-out process for all instances that use the ServiceNow Otto functionality.\n\nUse the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response \\(SIR\\). This console contains everything to install the applications and configure the generative AI skills. For additional information, see [Configuring AI skills](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/configuring-na-landing.md).\n\n**Note:** When you update the ServiceNow Otto for Security Incident Response \\(SIR\\) applications, its dependency applications are automatically updated.\n\nThe following table lists the features and skills that you can access from the AI Admin Hub console.\n\n**Note:** Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/ai-native-sku-overview.md).\n\n\n
\n\nServiceNow Otto product\n\n\n\nSecurity incident skills\n\n
\n\nServiceNow Otto for Security Incident Response \\(SIR\\)\n\n\n\nSecurity incident summarization**Note:** The incident summarization supports security incidents in any state other than **Draft**.\n\n
\n\nResolution notes generation.\n\n
\n\nSecurity operations metrics analysis\n\n
\n\nSecurity incident recommended actionsThe security incident recommended actions skill supports security incidents in any state other than **Closed** and **Cancelled**.\n\n**Note:**\n\nThe AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to **All** > **AI Search** > **AI Search Status**. Contact support if the page indicates that AI Search is not enabled.\n\nCorrelation insights support security incidents in all states.\n\n
\n\nPost-incident analysis\n\n
\n\nGenerate content for shift handover\n\n
\n\nSecurity incident resolution plan\n\n
\n\nSecurity incident quality assessment\n\n
\n\nSIR data analysis\n\n
1. [Install plugins for ServiceNow Otto](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/install-now-assist-feature-plugins.md).\n\n Install the ServiceNow Otto for Security Incident Response \\(SIR\\) application \\(sn\\_sec\\_gen\\_ai\\) and Security Incident Response Core \\[sn\\_si\\] applications.\n\n **Note:**\n\n When you update the ServiceNow Otto for Security Incident Response \\(SIR\\) application, its dependency applications are automatically updated.\n\n2. [Configure a skill for ServiceNow Otto for Security Incident Response \\(SIR\\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/activate-skills-for-now-assist-security-incident.md)\n\n You can deactivate, configure, and reactivate generative AI skills and agentic workflows in the Guided Setup.\n\n\n- **[Configure a skill for ServiceNow Otto for Security Incident Response \\(SIR\\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/activate-skills-for-now-assist-security-incident.md)** \nConfigure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup.\n- **[Customize a skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/cust-now-assist-security-incident-skill.md)** \nCustomize some of the input fields of a generative AI skill to suit the requirements of your environment.\n- **[Inputs and triggers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/input-triggers-now-assist-security-incident.md)** \nYou can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.\n\n**Parent Topic:**[Configuring SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/configuring-security-incident-response-workspace.md)\n\n**Related topics** \n\n\n[Set up view of SIR Records]()\n\n[Configure SI design time investigation]()\n\n[SIR Workspace Related Records]()\n\n[Define the new Risk Score Calculator Rules]()\n\n[Configure Shift Handover]()\n\n[Security Incident Response conference call integration]()\n\n[Configure report templates in Security Incident Response]()\n\n[On-Call scheduling in Security Incident Response]()\n\n[Category management in Security Incident Response]()\n\n[View and update Security Incident Response system properties]()\n\n[Create quick filters for Security Incidents and Response Tasks lists]()\n\n[Timeline in Security Incident Response Workspace]()\n\n"}}