Configure the Security incident resolution plan skill

task brazil Updated Sep 10, 2026 1 min read config-resolution-plan-skill.md

Add your existing runbooks to the resolution plan generation skill. The runbooks provide additional context to the resolution plan generation skill.

Before you begin

Role required: sn_si.admin

About this task

Important: This generative AI skill is turned on by default. The skill will be automatically available to appropriate role users for the application. For more information, see AI agents, skills, and agentic workflows on by default.

Procedure

Navigate to Admin > AI Admin Hub > AI Skills.
In Technology, select Security Operations.
In the Security Incident resolution plan tile, select [Omitted image "cj-sir-flow-more-icon.png"] Alt text: More actions icon..
Select Edit.
Select Add AI Runbooks.
In the Additional Runbook Context page, select Add.
In Condition, enter a condition when the skill must reference the runbook.

For example, set the condition as If category is Phishing and affected user VIP status is true.
In Choose KB Reference, select a knowledge base article runbook.
In Order, set an order of importance.

You can set Order to any positive integer, a lower value indicating a higher priority.
Select Save and continue.

Parent Topic:Configure a skill for ServiceNow Otto for Security Incident Response (SIR)

Keywords Skill configurationconfigure resolution plan skill

57 lines · 2.5 KB Wrap lines

---
title: Configure the Security incident resolution plan skill
description: Add your existing runbooks to the resolution plan generation skill. The runbooks provide additional context to the resolution plan generation skill.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/config-resolution-plan-skill.html
release: brazil
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [Skill configuration, configure resolution plan skill]
breadcrumb: [Configure a skill, Configure ServiceNow Otto for Security Incident Response \(SIR\), Configure, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Configure the Security incident resolution plan skill

Add your existing runbooks to the resolution plan generation skill. The runbooks provide additional context to the resolution plan generation skill.

## Before you begin

Role required: sn\_si.admin

## About this task

**Important:** This generative AI skill is turned on by default. The skill will be automatically available to appropriate role users for the application. For more information, see [AI agents, skills, and agentic workflows on by default](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/now-assist-skills-on-by-default.md).

## Procedure

1. Navigate to **Admin** &gt; **AI Admin Hub** &gt; **AI Skills**.

2. In **Technology**, select **Security Operations**.

3. In the Security Incident resolution plan tile, select \[Omitted image "cj-sir-flow-more-icon.png"\] Alt text: More actions icon..

4. Select **Edit**.

5. Select **Add AI Runbooks**.

6. In the **Additional Runbook Context** page, select **Add**.

7. In **Condition**, enter a condition when the skill must reference the runbook.

For example, set the condition as `If category is Phishing and affected user VIP status is true`.

8. In **Choose KB Reference**, select a knowledge base article runbook.

9. In **Order**, set an order of importance.

You can set **Order** to any positive integer, a lower value indicating a higher priority.

10. Select **Save and continue**.

**Parent Topic:**[Configure a skill for ServiceNow Otto for Security Incident Response \(SIR\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/activate-skills-for-now-assist-security-incident.md)