---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Process Mining Workspace for Security Incident Response

# Process Mining Workspace for Security Incident Response {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Process Mining scan through security incident audit logs and identify factors contributing to inefficiencies such as multiple reassignments, prolonged hold times, and periods of inactivity for security incidents. Organizations
can use this information to address the inefficiencies.  
With process mining, you can identify the following opportunities of improvements for your security incidents.{#sir-process-mining__table_ix2_rvw_bfc__entry__2}

| Opportunity | Description |
|-|-|
| Incidents with at least two assignment group changes | Incidents for which the assignment group changed for two or more times. |
| SIRT (Max repetitions is 2) |   |
| Incidents took over 5 hours to escalate to high priority | Incidents for which the priority was escalated to a higher priority after five hours. |
| Incidents took more than 5 hours to analyze | Incidents that were in analysis state for more than five hours. |
| Incidents analyzed within 30 minutes | Incidents that were in analysis state for less than 30 minutes. |
| Review (Max repetitions is 2) | Incidents that were move to review state for two times. |
| Eradicate (Max repetitions is 2) | Incidents that were move to eradicate state for two times. |
[Table 1. Opportunities with process mining]

{#sir-process-mining__table_ix2_rvw_bfc}

The Process Mining Content Pack for Security Incident Response adds a prebuilt project that includes a predefined process model definition for security incidents. To create a project, see [Create process mining project for security incidents](https://servicenow-prod.fluidtopics.net/GiMJ0ZL2eBlQGBNa1ifmkQ "Create a project in Process Mining Workspace using the pre-build process models definitions from the content pack to scan through audit logs of security incident records and identify inefficiencies in your security incident life cycle.").  
Note:  
To use the Process Mining in Security Incident Response, download and install the content pack. For more information, see [Content pack for Security Incident Response](https://www.servicenow.com/docs/access?context=sir-proc-min-content-pack&version=australia&pubname=australia-now-intelligence&ft:locale=en-US).