---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/security-management

 Release :

    - australia

ft:locale :

    - pt-BR

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Close security incident agentic workflow

# Security Incident Response AI agent collection close security incident agentic workflow {#ariaid-title1}

* Versão de lançamento: Australia
* 
* Atualizado 12 de mar. de 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 min. de leitura

The Close security incident agentic workflow enables security analysts to close a security incident.

## Close security incident agentic workflow overview {#now-assist-sir-close-incident-usecase__section_b4k_b3h_m2c}

Using the Close security incident agentic workflow, cancel the associated response tasks, generate resolution notes, close notes, close code and post incident analysis (PIA) during a security incident closure, and provide feedback
and adjust content in natural language​ from the Now Assist panel.

If you want to modify this agentic workflow, you can [duplicate](https://www.servicenow.com/docs/access?context=clone-aia-usecase&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) it, adjust the settings to suit your specific needs, and activate the duplicated version of the agentic workflow instead.

## Agent used in Close security incident agentic workflow {#now-assist-sir-close-incident-usecase__section_bbr_g3h_m2c}

The Security incident wrap-up generator expert is used in the Close security incident agentic workflow.

## Tools mapped to Close security incident agentic workflow {#now-assist-sir-close-incident-usecase__section_y5h_p3h_m2c}

The following tools are mapped to an AI agent that is used in the Close security incident agentic workflow.{#now-assist-sir-close-incident-usecase__table_fdf_cmx_p2c__entry__4}

| Tool type | Execution mode | Name | Description |
|-|-|-|-|
| Scripts | Autonomous | Fetches security incident details | Tool to fetch the security incident details from security incident number. |
| Scripts | Autonomous | Gets close code values | Tool to get available close code values for the security incident. |
| Scripts | Autonomous | Closes the security incident as false positive | Tool used when the incident is being closed as false positive. |
| Scripts | Autonomous | Updates the security incident | Tool to update a field of the security incident. |
| Subflow | Autonomous | Generates close notes | Tool to generate closure notes for the security incident. |
| Subflow | Autonomous | Generates post-incident analysis | Tool to generate post incident analysis for the security incident. |
[Tabela 1. Tools mapped to close security incident]

{#now-assist-sir-close-incident-usecase__table_fdf_cmx_p2c}

## Triggers for the Close security incident agentic workflow {#now-assist-sir-close-incident-usecase__section_egc_rkx_p2c}

There are no triggers for this agentic workflow. If required, you can add a trigger to invoke the agentic workflow automatically.