Add information to a security incident

After a security incident is created, you can add more details to aid in analysis, such as access roles and different kinds of notes.

Before you begin

Role required: sn_si.basic

Procedure

If it is not already open, open the security incident you want to update.
Select the Incident Details tab.
Fill in the fields, as needed.

Field	Description
Read access	Gives a user with the special access role read access to the security incident. The user is able to read and write work notes. Note: If a user is added to both Read access and Privileged access lists, then only the Privileged access permissions persist. User with sn_si.admin role only can modify both read access and privileged access.
Watch list	Select the lock icon to add users who are notified when changes to the security incident occur. After the field is unlocked, options are available for adding or removing multiple users or entering user email addresses. When you have completed your entries, select the lock icon to lock the field.
Privileged access	Gives a user with the special access role read and write access to all fields of the security incident except Assigned to. Users with special access roles have their own module containing all security incidents assigned to them. No other modules are available to them. No one else can see the Visible to Me module.Note: Only an assigned user or someone with a security role (for example, sn_si_analyst or sn_si.admin) can change the Assigned to field. If a user is added to both Read access and Privileged access lists, then only the Privileged access permissions persist.
Work notes list	Select the lock icon ([Omitted image "lock.png"] Alt text: Lock) to add users who are notified when new work notes are added. After the field is unlocked, options are available for adding or removing multiple users or entering user email addresses. When you have completed your entries, select the lock icon to lock the field.
Description	Enter a full description of the security incident, along with any information that can help to find the cause or resolve the issue.
Secure notes	Only user roles with sn_si.admin and sn_si.analyst can view or edit the secure notes.
Work notes	Type work notes that are not visible to the customer. Work notes appear in the Activity area.
Activity	Displays information manually entered in Work notes, and all dynamically updated task activity (actions, comments, work notes, and so on) on related records for this security incident. Work notes appear with a yellow color band. [Omitted image "manual-work-note.png"] Alt text: Manually-entered work note Automatically generated notes appear with a gray color band. [Omitted image "auto-work-note.png"] Alt text: Automatically-generated work note

4. You can limit the types of information displayed in the **Activity** field by selecting the filter \(\[Omitted image "filter-icon.png"\] Alt text: Filter\) icon.

**Note:** The **Automation activity** check box allows you to include any enrichment performed by this security incident, including workflow activities, risk score updates, and so forth.

Select any of the following tabs to further update the security incident:
When you have completed your entries, select Submit.

title	Add information to a security incident
description	After a security incident is created, you can add more details to aid in analysis, such as access roles and different kinds of notes.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/add\_inc\_details\_to\_si.html
release	australia
product	Security Incident Response
classification	security-incident-response
topic_type	task
last_updated	2026-11-06
reading_time_minutes	2
breadcrumb	Managing security incidents and inbound requestsSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations