Install and configure Security Incident Response

task brazil Updated Sep 10, 2026 1 min read install-and-configure-sir.md

Before you run Security Incident Response in your instance, you must download it from the ServiceNow Store and complete configuration steps.

Before you begin

Role required: sn_secops_setup.admin

Important:

Installing the Security Incident Response 13.4.5 version or later from the ServiceNow Store will automatically install the Security Incident Response Workspace (sn_si_aw) 1.5.1 version or later by default. For more information on the dependent applications, refer to the SIR Workspace plugins section.
Please note that the Security Incident Response Workspace versions 1.5.1 and above can only be installed/upgraded through an installation/upgradation of Security Incident Response and cannot be installed independently.
The latest features in Security Incident Response are exclusively available in the Security Incident Response Workspace. Please install or upgrade to the latest Security Incident Response or Security Incident Response Workspace version to access and leverage features such as Shift-Handover, Risk Score Calculator, etc.

Note: The Setup Assistant requires the sn_secops_setup.admin role. Users with the sn_si.admin role automatically inherit this role. The Setup Status (sn_secops_setup_status) table fields are enforced as strict read-only to prevent unauthorized modifications.

Procedure

Follow the instructions for downloading an application from the ServiceNow Store.
After you have downloaded the Security Incident Response application and all of its dependency applications, navigate to Security Incident > Analyst Workspace Setup > Setup Assistant.

[Omitted image "sir-setup-assistant.png"] Alt text: Security Incident Response setup assistant
Follow the instructions on the forms to configure the Security Incident Response base system.

For additional information on some of the more complicated setup tasks, see Setup Assistant reference, as needed.

44 lines · 3.1 KB Wrap lines

---
title: Install and configure Security Incident Response
description: Before you run Security Incident Response in your instance, you must download it from the ServiceNow Store and complete configuration steps.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/install-and-configure-sir.html
release: brazil
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Security Incident Response setup, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Install and configure Security Incident Response

Before you run Security Incident Response in your instance, you must download it from the ServiceNow Store and complete configuration steps.

## Before you begin

Role required: sn\_secops\_setup.admin

**Important:**

- Installing the Security Incident Response 13.4.5 version or later from the ServiceNow Store will automatically install the Security Incident Response Workspace \(sn\_si\_aw\) 1.5.1 version or later by default. For more information on the dependent applications, refer to the [SIR Workspace plugins](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/components-installed-with-analyst-workspace.md) section.
- Please note that the Security Incident Response Workspace versions 1.5.1 and above can only be installed/upgraded through an installation/upgradation of Security Incident Response and cannot be installed independently.
- The latest features in Security Incident Response are exclusively available in the Security Incident Response Workspace. Please install or upgrade to the latest Security Incident Response or Security Incident Response Workspace version to access and leverage features such as Shift-Handover, Risk Score Calculator, etc.

**Note:** The Setup Assistant requires the sn\_secops\_setup.admin role. Users with the sn\_si.admin role automatically inherit this role. The Setup Status \(sn\_secops\_setup\_status\) table fields are enforced as strict read-only to prevent unauthorized modifications.

## Procedure

1. Follow the instructions for [downloading an application from the ServiceNow Store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/download-app-first-time.md).

2. After you have downloaded the Security Incident Response application and all of its dependency applications, navigate to **Security Incident** &gt; **Analyst Workspace Setup** &gt; **Setup Assistant**.

\[Omitted image "sir-setup-assistant.png"\] Alt text: Security Incident Response setup assistant

3. Follow the instructions on the forms to configure the Security Incident Response base system.

For additional information on some of the more complicated setup tasks, see [Setup Assistant reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/setup-assistant-reference.md), as needed.