---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Inputs and triggers

# Inputs and triggers {#ariaid-title1}

* Release version: Australia
* 
* Updated July 30, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Inputs and Triggers

Inputs and triggers in generative AI skills within ServiceNow enable you to define the data sources and conditions that control how and when these skills operate.
Inputs specify the tables and fields that provide the data a skill uses, while triggers determine the events that initiate the skill's actions.
Although you can customize inputs and triggers to tailor the skill's behavior, the underlying data sources remain fixed and cannot be modified.
Show full answer Show less  

## Key Features

* **Inputs:** Identify specific tables and fields that supply data for AI skills, such as security incident details and related records.
* **Triggers:** Define when an AI skill activates, for example, automatically generating summaries or notes based on incident updates.
* **Data Source Integrity:** The core data sources (tables and fields) that skills rely on are fixed to ensure data consistency and accuracy.

## Inputs by Skill Type

* **Security Incident Summarization Skill:** Uses the **Security Incident \[snsiincident\]** table with fields like short description, description, state, priority, work notes, additional comments, and related tables such as Affected CIs, Users, Incident Response Tasks, and Observables marked as malicious or suspicious.
* **Resolution Notes Generation Skill:** Also based on the **Security Incident \[snsiincident\]** table, utilizing fields including short description, description, work notes, and additional comments to generate resolution notes.
* **Security Incident Recommended Actions Generation Skill:** Relies on the **Security Incident \[snsiincident\]** table to produce recommended actions post-incident.
* **Post Incident Analysis Generation Skill:** Uses data from the **Security Incident \[snsiincident\]** table for analysis after incident resolution.
* **Correlation Insights Generation Skill:** Integrates multiple tables such as **Security Incident \[snsiincident\]** , **Configuration Item \[cmdbci\]** , **Incident \[incident\]** , **Change Request \[changerequest\]** , **Problem \[problem\]** , **Vulnerable Item \[snvulvulnerableitem\]** , and **Associated Observable \[sntiobservable\]**. Access permissions to these tables are required.
* **Security Incident Quality Assessment:** Incorporates data from several tables including **Security Incident \[snsiincident\]** , **Configuration Item \[cmdbci\]** , **Task CI \[taskci\]** , **Associated Observable \[sntiobservable\]** , **Affected Users \[snsim2mtaskaffecteduser\]** , **Security Incident Task \[snsitask\]** , **Task SLA \[tasksla\]** , **Email \[sysemail\]** , and **Playbook Activities \[syspdactivitycontext\]**, subject to access permissions.

## What This Enables You to Do

By configuring inputs and triggers appropriately, you can automate and optimize the generation of summaries, resolution notes, recommended actions, and insights related to security incidents. This ensures your AI skills interact with relevant and authorized data, trigger at the right times, and deliver meaningful, actionable outputs that enhance your incident response and management processes.  
You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.

## Inputs and triggers {#input-triggers-now-assist-security-incident__section_bkt_wh3_1cc}

Inputs identify the data used for a skill. Inputs include the table and fields used to generate a security incident summary. A trigger initiates an action. For example, triggers determine when the system generates a summary.

You can modify inputs and triggers, but you can't modify a skill's data source. The data source contains the tables and fields that the skill relies on.

## Security incident summarization skill {#input-triggers-now-assist-security-incident__section_lqj_d33_1cc}

Inputs for the security incident summarization skill identify the table and fields used when a security incident summary is generated. The following table lists the inputs for the Security Incident summarization skill from the
Choose Input page in the AI Admin Hub console.
{#input-triggers-now-assist-security-incident__table_arz_fk3_1cc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. |
| Input fields | * Short description * Description * State * Priority * Work notes * Additional comments {#input-triggers-now-assist-security-incident__ul_o2w_jk3_1cc} |
| Related Input tables | * Affected CIs - configuration item * Affected Users - Users * Security Incident Response Task - Short description * State - Any state other than Cancelled. * Associated Observables - Observable finding is Malicious or Suspicious. {#input-triggers-now-assist-security-incident__ul_nfq_pk3_1cc} |
[ ]

{#input-triggers-now-assist-security-incident__table_arz_fk3_1cc}

## Resolution notes generation skill {#input-triggers-now-assist-security-incident__section_pk4_bl3_1cc}

Inputs for the Resolution notes generation skill identify the table and fields that are used when the resolution notes are generated for a security incident. The following table lists the inputs for the resolution notes generation
skill from the Choose Input page in the AI Admin Hub console.
{#input-triggers-now-assist-security-incident__table_il3_sfj_1cc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. |
| Input fields | * Short description * Description * Work notes * Additional comments {#input-triggers-now-assist-security-incident__ul_pq5_xfj_1cc} |
[ ]

{#input-triggers-now-assist-security-incident__table_il3_sfj_1cc}

## Security incident recommended actions generation skill {#input-triggers-now-assist-security-incident__section_q44_2kd_ycc}

{#input-triggers-now-assist-security-incident__table_b4z_gkd_ycc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. |
[ ]

{#input-triggers-now-assist-security-incident__table_b4z_gkd_ycc}

## Post incident analysis generation skill {#input-triggers-now-assist-security-incident__section_rby_3kd_ycc}

{#input-triggers-now-assist-security-incident__table_sp5_kkd_ycc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. |
[ ]

{#input-triggers-now-assist-security-incident__table_sp5_kkd_ycc}

## Correlation insights generation skill {#input-triggers-now-assist-security-incident__section_l1b_cl5_pdc}

Your correlation insights for a security incident can contain records from the following tables, but you must have permission to access these tables and records.  
{#input-triggers-now-assist-security-incident__table_ytl_2l5_pdc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. Configuration item \[cmdb_ci\] table. Incident \[incident\] table. Change request \[change_request\] table. Problem \[problem\] table. Vulnerable item \[sn_vul_vulnerable_item\] table. Associate observable \[sn_ti_observable\] table. |
[ ]

{#input-triggers-now-assist-security-incident__table_ytl_2l5_pdc}

## Security Incident Quality Assessment {#input-triggers-now-assist-security-incident__section_ksn_tc4_jhc}

Your Quality Assessment report for a security incident can contain records from the following tables, but you must have permission to access these tables and records.
{#input-triggers-now-assist-security-incident__table_k2k_zc4_jhc__entry__2}

| Input | Description |
|-|-|
| Data source | Security Incident \[sn_si_incident\] table. Configuration item \[cmdb_ci\] table. Task CI \[task_ci\] Associated Observable \[sn_ti_observable\] Affected Users \[sn_si_m2m_task_affected_user\] Security Incident Task \[sn_si_task\] Task SLA \[task_sla\] Email \[sys_email\] Playbook Activities: sys_pd_activity_context |
[ ]

{#input-triggers-now-assist-security-incident__table_k2k_zc4_jhc}