Activity Definitions

---
title: Activity Definitions
description: The ServiceNow AI Platform provides a few activity definitions within the base system. In addition, for the playbooks that SIR Workspace base system, there are a few activity definitions defined in the base system under Enterprise Security Case Management PAD Commons application.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/build-activities.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Activity Definitions

The ServiceNow AI Platform provides a few activity definitions within the base system. In addition, for the playbooks that SIR Workspace base system, there are a few activity definitions defined in the base system under Enterprise Security Case Management PAD Commons application.

Role required: sn\_si.admin.

Here’s the list of activity definitions that are a part of the base system:

|Activity Definition|Table|Description|Application|
|-------------------|-----|-----------|-----------|
|Wait For Condition with No Experience|Global\[global\]|Wait for Condition with no experience|Enterprise Security Case Management PAD Commons|
|Submit to CSF X Sandbox|Security Incident \[sn\_si\_incident\]|Submit to sandbox|Enterprise Security Case Management PAD Commons|
|Send Email|Security Incident \[sn\_si\_incident\]|Send email activity for SIR playbooks.|Enterprise Security Case Management PAD Commons|
|Search Email|Security Incident \[sn\_si\_incident\]|Search emails on email server|Enterprise Security Case Management PAD Commons|
|Update Task State|Security Incident \[sn\_si\_incident\]|Update the task state|Enterprise Security Case Management PAD Commons|
|Delete Email|Security Incident \[sn\_si\_incident\]|Delete emails|Enterprise Security Case Management PAD Commons|
|Yes No Outcome|Task \[task\]|Expected outcome|Enterprise Security Case Management PAD Commons|

-   **[Example Activity Definition: Send email](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/example-activity-definition-send-email.md)**  
The following is an example of Send email activity definition.
-   **[Submit to CSF X Sandbox](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/submit-to-csf-x-sandbox.md)**  
Submit to CSF X Sandbox is an example of an activity definition process.

**Parent Topic:**[Using SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/using-sir-workspace.md)

**Related topics**  


[Using ServiceNow Otto for Security Incident Response \(SIR\) generative AI skills]()

[Using agentic AI workflows]()

[Working with Security Incident Records]()

[Security Incident Playbook]()

[Prerequisites for the Playbooks]()

[Rebuilding existing playbooks in Workflow Studio]()

[Sample Playbooks for SIR Workspace]()

[Working with MSI Records]()

[Working with Form UI actions]()

[Security Incident Closure workflow]()

[Handle security incidents using Advanced Work Assignment]()