Add closure information to a security incident

task australia Updated Nov 6, 2026 1 min read add-closure-info-to-si.md

When a security incident is in the Review or Closed state, you can enter closure information.

Before you begin

Role required: sn_si.basic

Procedure

If it isn’t already open, open the security incident you want to update.
Select the Related Records tab.

Fill in the fields, as needed.

Field	Description
Create knowledge article	The option to generate a knowledge article using the contents of the post incident report.
Close code	The close code that best describes the reason for closing the security incident.
Closed by	[Read only] Displays the user who closed the security incident.
Closed	[Read only] Displays the date and time the security incident was closed.
Close notes	How the security incident has been closed, including lessons learned, resolution, and so on.

Select any of the following tabs to further update the security incident:
- Incident Details
- Post Incident Review
Select Submit.

46 lines · 2.0 KB Wrap lines

---
title: Add closure information to a security incident
description: When a security incident is in the Review or Closed state, you can enter closure information.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/add-closure-info-to-si.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-11-06"
reading_time_minutes: 1
breadcrumb: [Close security incidents, Managing security incidents and inbound requests, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Add closure information to a security incident

When a security incident is in the Review or Closed state, you can enter closure information.

## Before you begin

Role required: sn\_si.basic

## Procedure

1.  If it isn’t already open, open the security incident you want to update.

2.  Select the **Related Records** tab.

3.  Fill in the fields, as needed.

    |Field|Description|
    |-----|-----------|
    |Create knowledge article|The option to generate a knowledge article using the contents of the post incident report.|
    |Close code|The close code that best describes the reason for closing the security incident.|
    |Closed by|\[Read only\] Displays the user who closed the security incident.|
    |Closed|\[Read only\] Displays the date and time the security incident was closed.|
    |Close notes|How the security incident has been closed, including lessons learned, resolution, and so on.|

4.  Select any of the following tabs to further update the security incident:

    -   [Incident Details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/add_inc_details_to_si.md)
    -   [Post Incident Review](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/c_PostIncidentReview.md)
5.  Select **Submit**.