View, edit, and assign high priority incidents with the Security Incident Response Mobile app

  • Release version: Australia
  • Updated March 12, 2026
  • 3 minutes to read

    • From your mobile device, view, edit, and assign high priority Security Incident Response (SIR) incidents. View related lists and the audit trail of work notes for more details about incidents.

    Before you begin

    Role required: sn_si.analyst

    About this task

    From the list of records, assign an open, critical security incident to yourself or to another analyst in your group. Alternatively, view the details and related lists of the record or add a work note prior to assignment. Time to complete this task: 5-10 minutes.

    Procedure

    1. If you are not logged in to your ServiceNow AI Platform instance on your mobile device, for more information see Log in to the Security Incident Response Mobile app.
    2. With the Security Incidents landing screen displayed, tap High Priority Incidents.

      If you navigate away from the Security Incident Response Mobile app after you have logged in, tap the Now Agent app at any time to return to the last screen you had displayed.

      High priority incidents applet highlighted.
      The High Priority Incidents screen is displayed with a list of critical (high priority) security incidents.
      High Priority security incidents list.
    3. Optional: Refer to Search for security incidents with the Security Incident Response Mobile app to search for security incidents that match specific criteria.
      Alternatively, with the filter icon (Filter.) displayed, Set filters to limit the number of records on the list. Filtering records on screens in the mobile app works like filtering with a condition builder on the ServiceNow AI Platform.
    4. With the list of open high priority security incident records displayed, swipe left on a record to open the menu.
      High Priority incidents swipe menu.
    5. Choose one to continue.
      OptionDescription
      Assign to Me Assign the security incident to yourself. If the security incident is already assigned to you, this option is not displayed.
      Reassign To assign or reassign the assignment group:
      1. Tap Assignment group
      2. Tap a group from the list that is displayed, or enter text in the search field. The group must be a security-related assignment group.

      To assign or reassign the security incident to a member of the assignment group:

      1. Tap Assigned to.
      2. Tap a name from the list that is displayed, or enter text in the search field.

      Tap the send icon (Send in Android.) or Submit to save and submit your changes.
    6. To view the details of an open security incident record and to see more associated records and related lists, with the High Priority Incidents screen displayed, tap a record on the list.
    7. On the open record that is displayed, choose one option from the following table to continue.
      High Priority security incident record with tabs highlighted.
      OptionDescription
      Tap the menu icon (Menu.) on the upper right of the screen. From the menu that is displayed, choose from the following options.
      • Tap Edit. With the Edit Security Incident screen displayed, tap a field to expand it and choose one or more of the options that are displayed. Alternatively, tap the search icon and enter text.
      • To reassign the incident, tap Reassign or Assign to Me. Follow the instructions described in the previous table.

      After you complete your edits, tap the send icon (Send in Android.) or Submit to save your changes and update the security incident.
      Activity Stream tab

      With the Activity tab selected, review the audit trail of work notes, activities, and additional comments of the record. Tap the plus icon (Plus.) to add a work note or attach a file.
      Related List tab

      With the Related List tab selected, view the items on any of the Related Lists that are populated on the security incident. Tap an item on the list that is displayed to view the details for a related list. From the lists of items that are displayed, tap an item to continue to view the activity streams and related lists associated with the parent security incident.
      Tap a screen icon at the bottom of the screen. On the bottom of the screen, choose one to continue.
      • Tap the Security Incidents icon to return to the landing screen.
      • If displayed, tap an icon to open another ServiceNow® mobile app.
      • Tap Notification to view notifications from the ServiceNow AI Platform and the Security Incident Response Mobile app.
      • Tap Settings and choose one to continue.
        • View information about the ServiceNow AI Platform instance on your device.
        • Log out of the current ServiceNow AI Platform instance.