Using SIR Workspace
reference brazil Updated Sep 10, 2026 2 min read using-sir-workspace.md
Security Analysts and managers use SIR Workspace to perform day-to-day operations with an improved user experience, do complete incident investigation, and get an overview.
- Using ServiceNow Otto for Security Incident Response (SIR) generative AI skills
Security analysts can close security incidents quickly from within their flow of work with the generative AI skills supported by ServiceNow Otto for Security Incident Response (SIR). - Using agentic AI workflows
Use the Security Incident Response AI agentic workflows to complete security incident tasks. - Working with Security Incident Records
The Security Incident Record consists of the following. - Security Incident Playbook
Invoke the security incident playbook flow automatically or manually. - Prerequisites for the Playbooks
You need the following roles and plugins to build the Playbooks. - Rebuilding existing playbooks in Workflow Studio
You can’t convert existing flows directly into playbooks in Workflow Studio. Each flow designer step that creates a response task to guide the analyst must be broken down into separate actions or subflows. - Activity Definitions
The ServiceNow AI Platform provides a few activity definitions within the base system. In addition, for the playbooks that SIR Workspace base system, there are a few activity definitions defined in the base system under Enterprise Security Case Management PAD Commons application. - Sample Playbooks for SIR Workspace
You can create or configure playbooks for SIR Workspace quickly and easily without writing complicated code. You can use these playbooks to resolve security threats in a step-by-step manner. You can invoke the security incident playbook flow automatically or manually. - Working with MSI Records
Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization. - Working with Form UI actions
Following are the UI actions that are displayed on the security incident form. - Security Incident Closure workflow
Close the security incident by updating the incident state. - Handle security incidents using Advanced Work Assignment
Handle security incidents assigned to you in SIR Workspace using Advanced Work Assignment.
Parent Topic:Security Incident Response Workspace
46 lines · 5.1 KB
--- title: Using SIR Workspace description: Security Analysts and managers use SIR Workspace to perform day-to-day operations with an improved user experience, do complete incident investigation, and get an overview. locale: en-US canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/using-sir-workspace.html release: brazil product: Security Incident Response classification: security-incident-response topic_type: reference last_updated: "2026-09-10" reading_time_minutes: 2 breadcrumb: [Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Using SIR Workspace Security Analysts and managers use SIR Workspace to perform day-to-day operations with an improved user experience, do complete incident investigation, and get an overview. - **[Using ServiceNow Otto for Security Incident Response \(SIR\) generative AI skills](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/using-now-assist-for-security.md)** Security analysts can close security incidents quickly from within their flow of work with the generative AI skills supported by ServiceNow Otto for Security Incident Response \(SIR\). - **[Using agentic AI workflows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/using-now-assist-ai-agents-sir.md)** Use the Security Incident Response AI agentic workflows to complete security incident tasks. - **[Working with Security Incident Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/using-analyst-workspace.md)** The Security Incident Record consists of the following. - **[Security Incident Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/security-incident-playbook.md)** Invoke the security incident playbook flow automatically or manually. - **[Prerequisites for the Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/getting-started-with-processes.md)** You need the following roles and plugins to build the Playbooks. - **[Rebuilding existing playbooks in Workflow Studio](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/rebuilding-existing-playbooks-on-pad.md)** You can’t convert existing flows directly into playbooks in Workflow Studio. Each flow designer step that creates a response task to guide the analyst must be broken down into separate actions or subflows. - **[Activity Definitions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/build-activities.md)** The ServiceNow AI Platform provides a few activity definitions within the base system. In addition, for the playbooks that SIR Workspace base system, there are a few activity definitions defined in the base system under Enterprise Security Case Management PAD Commons application. - **[Sample Playbooks for SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/sir-workspace-playbooks.md)** You can create or configure playbooks for SIR Workspace quickly and easily without writing complicated code. You can use these playbooks to resolve security threats in a step-by-step manner. You can invoke the security incident playbook flow automatically or manually. - **[Working with MSI Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/working-with-msi-records.md)** Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization. - **[Working with Form UI actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/enable_workspace_form_ui_actions.md)** Following are the UI actions that are displayed on the security incident form. - **[Security Incident Closure workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/security-incident-closure-workflow_0.md)** Close the security incident by updating the incident state. - **[Handle security incidents using Advanced Work Assignment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/handle-incidents-using-awa.md)** Handle security incidents assigned to you in SIR Workspace using Advanced Work Assignment. **Parent Topic:**[Security Incident Response Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/sir-workspace-landing-page.md)
| title | Using SIR Workspace |
| description | Security Analysts and managers use SIR Workspace to perform day-to-day operations with an improved user experience, do complete incident investigation, and get an overview. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/security-management/security-incident-response/using-sir-workspace.html |
| release | brazil |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | reference |
| last_updated | 2026-09-10 |
| reading_time_minutes | 2 |
| breadcrumb | Security Incident Response WorkspaceSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |