Configuring ServiceNow Otto for Security Incident Response \(SIR\)
The ServiceNow Otto for Security Incident Response (SIR) application is supported in the Security Incident Response Workspace and in the legacy Core UI (UI16). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR).
Configuration overview
AI agents use role masking to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see Define security controls for an AI agent.
Important: Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see AI agents, skills, and agentic workflows on by default.
By sharing data with the ServiceNow® AI development program, you provide relevant data to help improve prediction accuracy, user experience, tailor products to your business needs, and reduce hallucinations for your activated ServiceNow Otto skills.
You can opt out of a ServiceNow instance from sharing data from the AI Admin Hub console. See Opt out of data sharing for Now Assist. Repeat the opt-out process for all instances that use the ServiceNow Otto functionality.
Use the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR). This console contains everything to install the applications and configure the generative AI skills. For additional information, see Configuring plugins and skills in AI Admin Hub.
Note: When you update the ServiceNow Otto for Security Incident Response (SIR) applications, its dependency applications are automatically updated.
The following table lists the features and skills that you can access from the AI Admin Hub console.
Note: Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see ServiceNow product tiers.
|
ServiceNow Otto product |
Security incident skills |
|---|---|
|
ServiceNow Otto for Security Incident Response (SIR) |
Security incident summarizationNote: The incident summarization supports security incidents in any state other than Draft. |
|
Resolution notes generation. | |
|
Security operations metrics analysis | |
|
Security incident recommended actionsThe security incident recommended actions skill supports security incidents in any state other than Closed and Cancelled. Note: The AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to All > AI Search > AI Search Status. Contact support if the page indicates that AI Search is not enabled. Correlation insights support security incidents in all states. | |
|
Post-incident analysis | |
|
Generate content for shift handover | |
|
Security incident resolution plan | |
|
Security incident quality assessment | |
|
SIR data analysis |
Install the ServiceNow Otto for Security Incident Response \(SIR\) application \(sn\_sec\_gen\_ai\) and Security Incident Response Core \[sn\_si\] applications.
**Note:**
When you update the ServiceNow Otto for Security Incident Response \(SIR\) application, its dependency applications are automatically updated.
-
Configure a skill for ServiceNow Otto for Security Incident Response (SIR)
You can deactivate, configure, and reactivate generative AI skills and agentic workflows in the Guided Setup.
- Configure a skill for ServiceNow Otto for Security Incident Response (SIR)
Configure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup. - Customize a skill
Customize some of the input fields of a generative AI skill to suit the requirements of your environment. - Inputs and triggers
You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.
Parent Topic:Configuring SIR Workspace
Related topics
Configure SI design time investigation
Define the new Risk Score Calculator Rules
Security Incident Response conference call integration
Configure report templates in Security Incident Response
On-Call scheduling in Security Incident Response
Category management in Security Incident Response
View and update Security Incident Response system properties
Create quick filters for Security Incidents and Response Tasks lists
---
title: Configuring ServiceNow Otto for Security Incident Response \(SIR\)
description: The ServiceNow Otto for Security Incident Response \(SIR\) application is supported in the Security Incident Response Workspace and in the legacy Core UI \(UI16\). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response \(SIR\).
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/configuring-now-assist-for-security-operations.html
release: brazil
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 5
breadcrumb: [Configure, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---
# Configuring ServiceNow Otto for Security Incident Response \(SIR\)
The ServiceNow Otto for Security Incident Response \(SIR\) application is supported in the Security Incident Response Workspace and in the legacy Core UI \(UI16\). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response \(SIR\).
## Configuration overview
AI agents use [role masking](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/aia-role-masking.md) to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select **Users with specific roles** for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see [Define security controls for an AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/define-sec-controls-aia.md).
**Important:** Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/now-assist-skills-on-by-default.md).
By sharing data with the ServiceNow® AI development program, you provide relevant data to help improve prediction accuracy, user experience, tailor products to your business needs, and reduce hallucinations for your activated ServiceNow Otto skills.
You can opt out of a ServiceNow instance from sharing data from the AI Admin Hub console. See [Opt out of data sharing for Now Assist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/opt-out-of-data-sharing-for-now-assist.md). Repeat the opt-out process for all instances that use the ServiceNow Otto functionality.
Use the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response \(SIR\). This console contains everything to install the applications and configure the generative AI skills. For additional information, see [Configuring plugins and skills in AI Admin Hub](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/configuring-na-landing.md).
**Note:** When you update the ServiceNow Otto for Security Incident Response \(SIR\) applications, its dependency applications are automatically updated.
The following table lists the features and skills that you can access from the AI Admin Hub console.
**Note:** Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/ai-native-sku-overview.md).
<table id="table_igy_kpc_1cc"><thead><tr><th>
ServiceNow Otto product
</th><th>
Security incident skills
</th></tr></thead><tbody><tr><td rowspan="9">
ServiceNow Otto for Security Incident Response \(SIR\)
</td><td>
Security incident summarization**Note:** The incident summarization supports security incidents in any state other than **Draft**.
</td></tr><tr><td>
Resolution notes generation.
</td></tr><tr><td>
Security operations metrics analysis
</td></tr><tr><td>
Security incident recommended actionsThe security incident recommended actions skill supports security incidents in any state other than **Closed** and **Cancelled**.
**Note:**
The AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to **All** > **AI Search** > **AI Search Status**. Contact support if the page indicates that AI Search is not enabled.
Correlation insights support security incidents in all states.
</td></tr><tr><td>
Post-incident analysis
</td></tr><tr><td>
Generate content for shift handover
</td></tr><tr><td>
Security incident resolution plan
</td></tr><tr><td>
Security incident quality assessment
</td></tr><tr><td>
SIR data analysis
</td></tr></tbody>
</table>1. [Install AI plugins in AI Admin Hub](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/install-now-assist-feature-plugins.md).
Install the ServiceNow Otto for Security Incident Response \(SIR\) application \(sn\_sec\_gen\_ai\) and Security Incident Response Core \[sn\_si\] applications.
**Note:**
When you update the ServiceNow Otto for Security Incident Response \(SIR\) application, its dependency applications are automatically updated.
2. [Configure a skill for ServiceNow Otto for Security Incident Response \(SIR\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/activate-skills-for-now-assist-security-incident.md)
You can deactivate, configure, and reactivate generative AI skills and agentic workflows in the Guided Setup.
- **[Configure a skill for ServiceNow Otto for Security Incident Response \(SIR\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/activate-skills-for-now-assist-security-incident.md)**
Configure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup.
- **[Customize a skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/cust-now-assist-security-incident-skill.md)**
Customize some of the input fields of a generative AI skill to suit the requirements of your environment.
- **[Inputs and triggers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/input-triggers-now-assist-security-incident.md)**
You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.
**Parent Topic:**[Configuring SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/configuring-security-incident-response-workspace.md)
**Related topics**
[Set up view of SIR Records]()
[Configure SI design time investigation]()
[SIR Workspace Related Records]()
[Define the new Risk Score Calculator Rules]()
[Configure Shift Handover]()
[Security Incident Response conference call integration]()
[Configure report templates in Security Incident Response]()
[On-Call scheduling in Security Incident Response]()
[Category management in Security Incident Response]()
[View and update Security Incident Response system properties]()
[Create quick filters for Security Incidents and Response Tasks lists]()
[Timeline in Security Incident Response Workspace]()
| title | Configuring ServiceNow Otto for Security Incident Response \(SIR\) |
| description | The ServiceNow Otto for Security Incident Response \(SIR\) application is supported in the Security Incident Response Workspace and in the legacy Core UI \(UI16\). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response \(SIR\). |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/security-management/security-incident-response/configuring-now-assist-for-security-operations.html |
| release | brazil |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 5 |
| breadcrumb | ConfigureSecurity Incident Response WorkspaceSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |