Using agentic AI workflows

Use the Security Incident Response AI agentic workflows to complete security incident tasks.

Agentic workflows and their AI agents use role masking to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see Define security controls for an agentic workflow.

Note: Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see ServiceNow product tiers.

Important: Some generative AI skills, agents, and agentic workflows are turned on by default. The default behavior works as follows:

New customers

When you install an AI product, designated generative AI skills, AI agents, or agentic workflows are turned on automatically.
Existing customers who are upgrading (starting with Zurich Patch 4)

There is no change to skills, agents, or agentic workflows that are currently enabled and customized.

An AI asset is turned on if:
- The AI plugin is installed, but the asset was never turned on.
- An admin has never adjusted roles for the skill. An AI asset is not turned on if:
- The asset was previously turned on, and then turned off again.
- An admin has adjusted roles for the asset.

For more information, see AI agents, skills, and agentic workflows on by default.

Agentic workflow name	Description	Available AI agents
Wrap up security incident	This agentic workflow helps security analysts close a security incident using natural language in the ServiceNow Otto panel.	Security incident wrap-up generator AI agent
Analyze security operations metrics	This agentic workflow helps a security operations center (SOC) manager analyze their security analysts' performance. Metrics are generated for security incident response (SIR) records for case volume, mean time to assign (MTTA), and mean time to resolve (MTTR).	Security incident retrieval AI agent Security metrics analysis AI agent
Resolve security incident	This agentic workflow helps security analysts identify a security incident resolution path. This workflow also helps security analysts close a security incident using natural language in the ServiceNow Otto panel.	Security incident resolution AI agent Exchange Online integration handling AI agent Security incident wrap-up generator AI agent Observable analysis AI agent Security incident activities handling AI agent Endpoint detection and response (EDR) AI agent
Generate SIR Shift Handover Report	This agentic workflow adds details of a security incident to the shift handover report. The AI agent populates the different sections of the shift handover with details identified from the security incident.	Security incident shift handover AI agent
	This agentic workflow helps security analysts and managers ask questions about security incident data in natural language in the ServiceNow Otto panel. The AI agent returns insights with links to the source records, and answers follow-up questions within the same chat.	Security incident data analysis AI agent

**Important:** By default, all agentic workflows and AI agent records are read-only.

To modify an agentic workflow, you must first duplicate the agentic workflow. If required, you can add a trigger to invoke the workflow automatically.

There might be AI agents installed on your instance that are not used in agentic workflows. To learn how to see all agents that are available to you, see Find AI agents.

Close security incidents
The Wrap up security incident agentic workflow enables security analysts to close a security incident.
Resolve security incidents
Chat with an AI agent in the ServiceNow Otto panel to help you create a resolution plan for a security incident and to resolve it.
Analyze security incident data
Analyze and get insights into your security incident data using available prompts or natural language queries from the ServiceNow Otto panel.
Analyze security operations
The Analyze security operations metrics agentic workflow helps security operations center managers analyze the performance of their security teams.
Generate SIR Shift Handover Report
Chat with an AI agent in the ServiceNow Otto panel to use the Generate SIR Shift Handover Report agentic workflow to help you add a security incident's detail to a shift handover report.

Parent Topic:Using SIR Workspace

Working with Security Incident Records

Security Incident Playbook

Prerequisites for the Playbooks

Rebuilding existing playbooks in Workflow Studio

Activity Definitions

Sample Playbooks for SIR Workspace

Working with MSI Records

Working with Form UI actions

Security Incident Closure workflow

Handle security incidents using Advanced Work Assignment

title	Using agentic AI workflows
description	Use the Security Incident Response AI agentic workflows to complete security incident tasks.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/using-now-assist-ai-agents-sir.html
release	australia
product	Security Incident Response
classification	security-incident-response
topic_type	concept
last_updated	2026-09-10
reading_time_minutes	5
keywords	AI agentsagentic AIagentic workflow
breadcrumb	UseSecurity Incident Response WorkspaceSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations