{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44962,"path":"security-management/security-incident-response/sir-records.md","title":"SIR Workspace Related Records","bundle":null,"doc_type":null,"release":"australia","body":"\n# SIR Workspace Related Records\n\nThis section consists of the related lists items that are grouped into sections such as associated observables and configuration items.\n\nThe following related lists groups that are available as a part of the base system. You can modify these groups or create groups within the application and their respective actions.\n\nYou can modify these groups or create new groups. For more information, see [Configure Security Incident Related List](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/sir-records.md) on how to configure and group the related list for security incidents and response tasks. Each related list is fully functional within the SIR Workspace.\n\n\n
\n\nRelated list\n\n\n\nGrouped item\n\n
\n\nBusiness Impact\n\n\n\n- Configuration Items\n- Affected Users\n- Related Configuration Items\n- Related Users\n- Affected Services\n\n
\n\nThreat Intel\n\n\n\n- Associated Observables\n- Threat Lookup Results\n\n
\n\nPhishing\n\n\n\n- Associated Phish Emails\n- Associated Phish Headers\n\n
\n\nRelated Security Incidents\n\n\n\n- Parent Security Incident\n- Child Security Incident\n- Similar Security Incident\n\n
\n\nSLA Records\n\n\n\nTask SLAs\n\n
\n\nSource Events/Alerts\n\n\n\nSource events or alerts are the SIEM integration enabled related list such as Source Email, LogRhythm Drill Down Logs, LogRhythm Events, Aggregated IBM QRadar Offense and so on.**Note:** This list is completely dependent on the integration that you have in your instance. To view the relevant SIEM integration related list, you must install the latest version.\n\n
\n\nSighting Search\n\n\n\n- Sightings Search Results\n- Sightings Search Details\n- Sighting\n\n
\n\nObservable Enrichment\n\n\n\n- Observable Enrichment Results\n- Associated MISP Events\n- MISP Enrichment Results\n\n
\n\nEndpoint Detection and Response \\(EDR\\)\n\n\n\n- Host Details\n- Running Processes\n- Running Services\n- Logged On Users\n- Network Statistics\n- Get File\n- Isolate Host Entries\n- Additional Actions On Endpoint\n- Microsoft Defender for Endpoint-Related Machines Details\n\n
\\[Omitted image \"sir-records.png\"\\] Alt text: Related Records\n\n**Note:** In general, you'd be able to create new records, link, or unlink existing records or new records against the related list group as applicable.\n\n**Parent Topic:**[Configuring SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/configuring-security-incident-response-workspace.md)\n\n**Related topics** \n\n\n[Configuring ServiceNow Otto for Security Incident Response \\(SIR\\)]()\n\n[Set up view of SIR Records]()\n\n[Configure SI design time investigation]()\n\n[Define the new Risk Score Calculator Rules]()\n\n[Configure Shift Handover]()\n\n[Security Incident Response conference call integration]()\n\n[Configure report templates in Security Incident Response]()\n\n[On-Call scheduling in Security Incident Response]()\n\n[Category management in Security Incident Response]()\n\n[View and update Security Incident Response system properties]()\n\n[Create quick filters for Security Incidents and Response Tasks lists]()\n\n[Timeline in Security Incident Response Workspace]()\n\n[Configure Security Incident Related List](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/sir-records.md)\n\n## Configure Security Incident Related List\n\nYou can add new related lists or new related list groups, and modify existing groups or related lists that appear in the SIR Workspace.\n\n### Before you begin\n\nThe security incident related list are grouped and displayed as group related list items on the **Related Records** tab on the workspace.\n\nRole required: sn\\_si.admin\n\n### Procedure\n\n1. In the classic UI, navigate to **All** > **Security Incident** > **Show Open Incidents**.\n\n \\[Omitted image \"show-incidents.png\"\\] Alt text: Open incidents\n\n2. Select any incident record.\n\n3. Right click on the incident context menu.\n\n4. Go to **Configure** > **Related List**.\n\n \\[Omitted image \"configure-related-list.png\"\\] Alt text: related list page\n\n The **Configuring related lists on Security Incident form** is displayed.\n\n5. Go to **View name** and select **New**.\n\n6. Enter a name for the view.\n\n7. Select the newly created view.\n\n After you select the view, choose the required related list fields from the slush bucket.\n\n \\[Omitted image \"related-list-slushbucket.png\"\\] Alt text: related list slush bucket view\n\n **Note:** If you want to modify anything, select the view and remove or add the items.\n\n8. Click **Save**.\n\n9. On the left navigation, navigate to **All** > **Now Experience Framework** > **Experiences**.\n\n10. Select **Security Incident Response Workspace**.\n\n \\[Omitted image \"related-list-newexp.png\"\\] Alt text: configure related list new experience\n\n The **UX Application Security Incident Response Workspace** page is displayed.\n\n11. Go to **UX Page Properties** tab and select **relatedListLayoutConfig** option in the list view.\n\n \\[Omitted image \"related-list-config.png\"\\] Alt text: Related list\n\n \\[Omitted image \"related-list-ux-view.png\"\\] Alt text: Related List configuration section.\n\n12. Add the newly created view name separated by a comma to an already existing list of values in the **Value** text box under the **sn\\_si\\_incident.viewsUsedForGrouping** field.\n\n For example, if you had created a new view name as, **Business Impact** then in the **Value** text box you must specify it as **business\\_impact** \\(which is separated by underscore within the view name and separated by a comma after an existing value\\) under the sn\\_si\\_incident:groups field.\n\n \\[Omitted image \"value-text-box-related-list.png\"\\] Alt text: Related List Layout configuration.\n\n **Note:** If you add the new view name under **sn\\_si\\_incident.viewsUsedForGrouping** field then the entry will be created in the **Related Records** tab of the workspace.\n\n If you update the view name entry in **si\\_other\\_records.viewsUsedForGrouping** then the related list group will get added in the **Other Records** tab of the workspace.\n\n Below is an example view which shows the newly created views added.\n\n \\[Omitted image \"related-list-new-view-page.png\"\\] Alt text: related list newly created view\n\n **Note:** **requiredRolesForGrouping** contains comma separated sys\\_user\\_role record names. SIR Workspace user should have at least one of these roles, to use the grouped related lists. When a user does not have any of these roles then related lists view configured for the current user role using view rule configuration will be represented vertically without grouping. This property is ignored when **isGrouped** property is set to false. If this property is empty any user can access the grouped related lists.\n\n13. Click **Save**.\n\n14. Navigate to **Workspaces** > **Security Incident Response Workspace**.\n\n15. Select any specific security incident.\n\n16. Go to **Related Records** tab of the workspace.\n\n The grouped related lists are displayed.\n\n\n## Configure Response Task Related List\n\nUse this section to configure response tasks new related lists that appears on the Security Incident Response application.\n\n### Before you begin\n\nRole required: sn\\_si.admin\n\n### About this task\n\nThe response tasks related list is not grouped but displayed as individual related list items, as there are few default lists. View the response tasks related items from the **Response Tasks** tab of the security incident record of the workspace.\n\n### Procedure\n\n1. Navigate to **All** > **Security Incident** > **Response Tasks** > **Show All Tasks**.\n\n \\[Omitted image \"response-tasks-configure.png\"\\] Alt text: List of all Security Incident Response Tasks\n\n2. Select any response task record.\n\n3. Select and hold \\(or right-click\\) the Security Incident Response Task context menu.\n\n4. Navigate to **Configure** > **Related List**.\n\n The **Configuring related lists on Security Response Task form** is displayed.\n\n5. Go to **View name** and select **sirw** view.\n\n \\[Omitted image \"response-task-sirw-view.png\"\\] Alt text: sirw view name highlighted\n\n6. Select the desired related list fields from the slush bucket.\n\n For example, Affected Locations.\n\n \\[Omitted image \"response-tasks-selction.png\"\\] Alt text: related list slush bucket view\n\n7. Select **Save**.\n\n8. Navigate to **Workspaces** > **Security Incident Response Workspace** > **Response Tasks**.\n\n The configured related lists \\(For example, Affected Users as selected\\) is listed within the Related Records list.\n\n \\[Omitted image \"aafected-locations-response-tasks.png\"\\] Alt text: configured related list\n\n\n"}}