Use capabilities in SIR Workspace

task australia Updated Sep 10, 2026 1 min read use-capabilities-sir-workspace.md

Use the capabilities created using ServiceNow Otto for Security Incident Response (SIR) integration Toolkit in the SIR Workspace.

Before you begin

Role required: sn_si_int_kit.integration_creator or sn_si.analyst

Procedure

Navigate to Workspaces > Security Incident Response Workspace.
From the list view, select any security incident record.
Select the Investigation tab.
Select Associated Observable or Configuration Items.

The capabilities applicable to observables are available under the Associated Observable section. The capabilities applicable to configuration items are available under the Configuration Items section.
Select the observables on which you want to execute the capabilities.
Select the Capability button.

A pop-up appears with the list of applications.

[Omitted image "select-cap-sir-workspace.png"] Alt text: Select capability
Select the application to execute the capability.

The run() method is called from the SIR Workspace.

46 lines · 1.6 KB Wrap lines

---
title: Use capabilities in SIR Workspace
description: Use the capabilities created using ServiceNow Otto for Security Incident Response \(SIR\) integration Toolkit in the SIR Workspace.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/use-capabilities-sir-workspace.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Use SIR Integration Builder, LLM-powered SIR integration builder, Security Operations]
---

# Use capabilities in SIR Workspace

Use the capabilities created using ServiceNow Otto for Security Incident Response \(SIR\) integration Toolkit in the SIR Workspace.

## Before you begin

Role required: sn\_si\_int\_kit.integration\_creator or sn\_si.analyst

## Procedure

1. Navigate to **Workspaces** &gt; **Security Incident Response Workspace**.

2. From the list view, select any security incident record.

3. Select the **Investigation** tab.

4. Select **Associated Observable** or **Configuration Items**.

The capabilities applicable to observables are available under the **Associated Observable** section. The capabilities applicable to configuration items are available under the **Configuration Items** section.

5. Select the observables on which you want to execute the capabilities.

6. Select the **Capability** button.

A pop-up appears with the list of applications.

\[Omitted image "select-cap-sir-workspace.png"\] Alt text: Select capability

7. Select the application to execute the capability.

The run\(\) method is called from the SIR Workspace.