Security Incident Response Workspace

---
title: Security Incident Response Workspace
description: The ServiceNow Security Incident Response Workspace is a reimagined interface that provides a next-gen user experience for the security analysts and SOC managers. The security analysts can use this to manage the life cycle of security incidents from an initial analysis to containment, eradication, and recovery.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/sir-workspace-landing-page.html
release: brazil
product: Security Incident Response
classification: security-incident-response
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Security Incident Response Workspace

The ServiceNow® Security Incident Response Workspace is a reimagined interface that provides a next-gen user experience for the security analysts and SOC managers. The security analysts can use this to manage the life cycle of security incidents from an initial analysis to containment, eradication, and recovery.

## Get started with SIR Workspace

Select a tile to get started.

<table id="table_sxm_bbz_xtb" class="nav-card"><tbody><tr><td>

[Explore Workspace \[Omitted image "bus-explore.svg"\] Alt text:Learn about SIR Workspace concepts and features](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/exploring-security-incident-response-workspace.md)

</td><td>

[Admins using Workspace \[Omitted image "bus-sdlc.svg"\] Alt text:Configure SIR Workspace and features](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/configuring-security-incident-response-workspace.md)

</td></tr><tr><td>

[Analysts using Workspace \[Omitted image "bus-agent-workspace-1.svg"\] Alt text: Learn how Analysts use SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/using-sir-workspace.md)

</td><td>

[View SIR Dashboards \[Omitted image "ind-facilities-manager.svg"\] Alt text:View SIR Workspace dashboards](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/working-with-analysts-dashboard.md)

</td></tr></tbody>
</table>## Request apps on Store

Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html).

**Important:**

-   Installing the Security Incident Response 13.4.5 version or later from the ServiceNow Store will automatically install the Security Incident Response Workspace \(sn\_si\_aw\) 1.5.1 version or later by default. For more information on the dependent applications, refer to the [SIR Workspace plugins](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/components-installed-with-analyst-workspace.md) section.
-   Please note that the Security Incident Response Workspace versions 1.5.1 and above can only be installed/upgraded through an installation/upgradation of Security Incident Response and can’t be installed independently.

## More resources

Visit the [Security Incident Response forum on the ServiceNow Community.](https://www.servicenow.com/community/secops-articles/tkb-p/security-operations-kb/label-name/security%20incident%20response?labels=security%20incident%20response)