Use capabilities in SIR Workspace

  • Freigeben Version: Australia
  • Aktualisiert 12. März 2026
  • 1 Minute Lesedauer

    • Use the capabilities created using Now Assist for Security Incident Response integrations in the SIR Workspace.

    Vorbereitungen

    Role required: sn_si_int_kit.integration_creator or sn_si.analyst

    Prozedur

    1. Navigate to Workspaces > Security Incident Response Workspace.
    2. From the list view, select any security incident record.
    3. Select the Investigation tab.
    4. Select Associated Observable or Configuration Items.
      The capabilities applicable to observables are available under the Associated Observable section. The capabilities applicable to configuration items are available under the Configuration Items section.
    5. Select the observables on which you want to execute the capabilities.
    6. Select the Capability button.

      A pop-up appears with the list of applications.

      Select capability
    7. Select the application to execute the capability.

      The run() method is called from the SIR Workspace.