Configuring Now Assist for Security Incident Response
Summarize
Summary of Configuring Now Assist for Security Incident Response
The Now Assist for Security Incident Response application enhances the Security Incident Response Workspace and the legacy Core UI (UI16) with generative AI capabilities. It helps streamline security incident management through AI-driven summarization, recommended actions, metrics analysis, and other skills. Configuration is performed via the Now Assist Admin console, which centralizes installation and setup of AI features.
Show less
Key Features
- Role-Based Access Control: AI agents use role masking to control user access. Specific roles included with the application must be configured in security controls when restricting access to users with certain roles.
- Default AI Skills and Workflows: Some Now Assist skills, agents, and workflows are enabled by default to provide immediate value upon installation.
- Data Sharing for AI Improvement: Sharing instance data with ServiceNow’s AI development program enhances prediction accuracy and user experience. Customers can opt out of data sharing per instance through the Now Assist Admin console.
- Generative AI Skills Available: Includes security incident summarization (for incidents beyond Draft state), resolution notes generation, security operations metrics analysis, recommended actions (requires AI Search enabled), correlation insights (all states), post-incident analysis, shift handover content generation, resolution planning, and quality assessment.
- Automated Dependency Updates: Updating the Now Assist for Security Incident Response application automatically updates its dependent applications.
Configuration and Setup
- Install required plugins: Now Assist for Security Incident Response (snsecgenai) and Security Incident Response Core (snsi).
- Use the guided setup within the Now Assist Admin console to install applications, configure AI skills, and manage agentic workflows.
- Ensure AI Search is enabled to fully utilize the Recommended Actions skill; verify via AI Search Status in the instance settings.
- Manage skill activation status—deactivate, configure, and reactivate generative AI skills as needed through guided setup.
Practical Benefits for ServiceNow Customers
By configuring Now Assist for Security Incident Response, customers can automate and enhance key aspects of their security incident workflows. This leads to faster incident summarization, actionable insights via recommended actions, improved incident resolution planning, and enhanced quality assessments. The role-based access control ensures secure and appropriate use of AI capabilities aligned with organizational policies. The integrated setup and automatic updates simplify maintenance and ensure the latest features are available.
The Now Assist for Security Incident Response application is supported in the Security Incident Response Workspace and in the legacy Core UI (UI16). Use the guided setup in the Now Assist Admin console to configure Now Assist for Security Incident Response.
Configuration overview
AI agents use role masking to determine which users can access them. Ones installed with Now Assist applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see Define security controls for an AI agent.
By sharing data with the ServiceNow® AI development program, you provide relevant data to help improve prediction accuracy, user experience, tailor products to your business needs, and reduce hallucinations for your activated Now Assist skills.
You can opt out of a ServiceNow instance from sharing data from the Now Assist Admin console. See Opt out of data sharing for Now Assist. Repeat the opt-out process for all instances that use the Now Assist functionality.
The following table lists the features and skills that you can access from the Now Assist Admin console.
| Now Assist Technology product | Security incident skills |
|---|---|
| Now Assist for Security Incident Response | Security incident summarization Note: The incident summarization supports security incidents in any state other than Draft. |
| Resolution notes generation. | |
| Security operations metrics analysis | |
| Security incident recommended actions The security incident recommended actions skill supports security incidents in any state other than Closed and Cancelled. Note: The AI Search application must be enabled so that the Recommended Actions skill works for security incidents. To verify AI Search is enabled on your instance, navigate to . Contact support if the page indicates that AI Search is not enabled. Correlation insights support security incidents in all states. |
|
| Post-incident analysis | |
| Generate content for shift handover | |
| Security incident resolution plan | |
|
Security incident quality assessment |
- Install Now Assist plugins.
Install the Now Assist for Security Incident Response application (sn_sec_gen_ai) and Security Incident Response Core [sn_si] applications.
Note:When you update the Now Assist for Security Incident Response application, its dependency applications are automatically updated.
- Configure a skill for Now Assist for Security Incident Response
You can deactivate, configure, and reactivate generative AI skills and agentic workflows in the Guided Setup.