This dashboard provides comprehensive insights into the volume, performance, and lifecycle progress of security incidents, enhancing visibility and control over security response activities.

End Users and Roles

• Security Response Manager (role: snsi.manager): Gains clear visibility into overall security incident states and volumes, with the ability to modify assignment group members to improve response.
• Security Response Administrator (role: snsi.admin): Quickly identifies critical areas, manages all Security Incident Response data, and adjusts risk calculation parameters to prioritize relevant vulnerabilities.
• Security Response Analysts (role: snsi.analyst): Focus on prioritizing vulnerabilities based on organizational criticality; Tier 1 and 2 analysts can create and update incidents, requests, tasks, and related problems or outages.

Key Indicators and Metrics

The dashboard contains multiple tabs with interactive widgets and indicators designed to measure and improve incident management efficiency:

• Process by State and Process by Age Tabs: Include indicators such as Average Age of open incidents (in days), Average Reassignment Times, Average Age of Last Update, and the percentage of incidents not updated in the last 5 days.
• Data Quality Tab: Features interactive filters for incident Category, Risk, Priority, and Severity levels, applied simultaneously to indicators including:
  • Security Incidents Open > 30 Days by Assignment Group and State
  • Open Incidents with inactive or no assignee
  • Incidents not updated in the last 30 days
• KPI Tab: Displays critical performance indicators such as:
  • Percentage of new critical security incidents
  • Average Age and Close Time of open incidents
  • Percentage of incidents reassigned, closed on first assignment, closed via self-service
  • Percentage of incidents not solved
  • Average close time of incident tasks

Breakdowns

Indicators can be broken down by the following attributes to provide detailed insights:

• Security Group
• Security Incident Age
• Security Incident Category
• Security Incident Priority
• Security Incident State

Practical Benefits

ServiceNow customers can expect to achieve improved visibility into the security incident lifecycle, enabling faster prioritization, better resource allocation, and enhanced risk management. The dashboard supports proactive decision-making by identifying stale or poorly managed incidents and ensuring critical vulnerabilities receive timely attention.