--- sourceDocument: Store Version History Release Notes sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/store-release-notes Release : - store ft:locale : - en-US ft:publication_title : - Store Version History Release Notes ft:clusterId : - rnst bundleId : - rnst --- # ServiceNow Otto for Security Incident Response (SIR) release notes # ServiceNow Otto for Security Incident Response (SIR) release notes {#ariaid-title1} Release version: Store Updated October 16, 2025 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of ServiceNow Otto for Security Incident Response (SIR) Release Notes ServiceNow Otto for Security Incident Response (SIR) is an AI-powered application available on the ServiceNow Store that enhances security operations center (SOC) efficiency by automating workflows, generating insights, and improving incident resolution. The release notes detail version updates from February 2025 through October 2025, showcasing incremental feature additions, performance optimizations, and fixes designed to empower SOC analysts and managers. Show full answer Show less ## Key Features * **Generative AI Workflows:** Introduced agentic workflows such as generating shift handover reports, resolving security incidents by leveraging past runbooks and historical cases, and assisting in closing incidents with automated post-incident analysis and closure notes. * **Security Operations Metrics Analysis:** Capabilities to track and analyze key performance indicators including case volume, Mean Time to Assign (MTTA), and Mean Time to Resolve (MTTR) over customizable date ranges, helping SOC managers assess team performance and optimize operations. * **Enhanced Correlation Insights:** Expanded correlation insights functionality to generate multi-item insights based on configuration items and affected users, viewable in a flexible dialog interface within the Security Incident Response Workspace. * **AI Agent Assistance:** SOC analysts and managers can interact with an AI agent via the Now Assist panel to receive guidance on resolving incidents, improving response times and decision-making. * **Security and Access Control Improvements:** Added access control lists (ACLs) for all existing skills and agents to enhance security and governance. * **Multi-Model AI Support:** Support for integration with multiple AI models including Azure Open AI, Now LLM, Google Gemini, and Amazon Bedrock, providing flexibility in AI capabilities. ## Improvements and Fixes * Performance optimizations in the dependent Now Assist for Platform application (version 9.2.2v). * Fixed issues with recommended actions refresh to prevent retention of outdated entries. * Removal of obsolete UI elements such as the Generate Insights button from the Related Records tab for cleaner interfaces. * Stabilization of the Resolve Security Incident workflow for more reliable automation. * Added feedback mechanisms on recommended actions to enable continuous improvement in AI-generated guidance. ## What ServiceNow Customers Can Expect With these updates, ServiceNow customers using Otto for Security Incident Response can expect enhanced automation and AI-driven workflows that streamline incident handling, improve SOC efficiency, and provide actionable metrics and insights. The integration of multiple AI models and improved access controls ensures flexibility and security in deployment. SOC teams benefit from AI assistance directly within their workspace, enabling faster, data-driven decisions and better management of security incidents from detection to closure. Version history for the ServiceNow Otto for Security Incident Response (SIR) application on the ServiceNow Store. Important: For details on system requirements and family compatibility, view the application listing on the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website. ## Version history Version 4.0.0 - October 2025 : * Changed: Updated the dependent applications "Now Assist for Platform" versions to 9.2.2v (performance optimizations). * Fixed: * Recommended actions refresh is not removing old entries. * Remove the Generate Insights button from the Related Records tab. {#store-secops-rn-sir-now-assist__ul_ynh_b11_zgc} Version 3.5.0 - September 2025 : * New: Added a new agentic workflow, "Generate Shift Handover Report for a Security Incident". * Changed: Added ACLs for all the existing skills and agents. Version 3.3.0 - August 2025 : * New: Support for both skills and agents with all 4 models (Azure Open AI, Now LLM, Google Gemini, Amazon Bedrock). * Fixed: Stabilized the Resolve Security Incident Workflow. Version 3.2.2 - June 2025 : * New: * Security Incident Resolving: This agentic workflow helps security analysts resolve security incidents by leveraging existing runbooks and historical security incidents. By analyzing similar past cases, it generates a clear and effective plan to resolve ongoing security incidents. * SOC Efficiency Analyzing: This agentic workflow helps SOC managers assess the quality of security incidents and track the key performance metrics, providing insights to explain and improve SOC operations. * Generate Key Metrics for Security Incident Response (SIR): Track case volume, Mean Time to Assign (MTTA), and Mean Time to Resolve (MTTR) over a customizable date range. * Metrics Analysis and Insights: Receive actionable insights into how to optimize MTTR, MTTA, and case volume, along with recommendations for improvement based on the data. {#store-secops-rn-sir-now-assist__ul_nvn_bdn_nfc} {#store-secops-rn-sir-now-assist__ul_q5n_bdn_nfc} * Changed: * Recommended Actions: * Enhanced to incorporate a feedback option on the overall recommendation provided, enabling continuous improvement of future recommendations. * Additionally, the top (N) number of recommendation cards are displayed based on the configuration settings. {#store-secops-rn-sir-now-assist__ul_sfz_cdn_nfc} {#store-secops-rn-sir-now-assist__ul_bq5_cdn_nfc} {#store-secops-rn-sir-now-assist__latest-store-secops-rn-sir-now-assist} {#store-secops-rn-sir-now-assist__latest-store-secops-rn-sir-now-assist} Version 3.0.1 - May 2025 : * New: * Analyze security operations metrics * The Analyze security operations metrics agentic workflow empowers security managers to evaluate their team's performance. * Generate Key Metrics for Security Incident Response (SIR): Track case volume, Mean Time to Assign (MTTA), and Mean Time to Resolve (MTTR) over a customizable date range. * Metrics Analysis and Insights: Receive actionable insights into how to optimize MTTR, MTTA, and case volume, along with recommendations for improvement based on the data. {#store-secops-rn-sir-now-assist__ul_jyk_mwq_cfc} {#store-secops-rn-sir-now-assist__ul_uwy_mwq_cfc} * The Resolve security incident agentic workflow can help your SOC teams resolve security incidents. * SOC analysts and managers can chat with an AI agent in the Now Assist panel to help them resolve security incidents. {#store-secops-rn-sir-now-assist__ul_fbg_nwq_cfc} {#store-secops-rn-sir-now-assist__ul_v3c_mwq_cfc} * Changed: * Enhancements to correlation insights * * You can generate and view results for correlation insights in the Security Incident Response Workspace. * Correlation insights are not limited to the primary configuration item (CI) or affected users associated with a security incident. You can base your correlation insights on any CI or affected user for a security incident. * You can generate correlation insights from the Investigation tab for a security incident in any state in the Security Incident Response Workspace. * You can generate insights for multiple items simultaneously for Associated Observables, Configuration items, and Affected Users. * Results are displayed in a modeless dialog that you can size and move. {#store-secops-rn-sir-now-assist__ul_oqt_4wq_cfc} {#store-secops-rn-sir-now-assist__ul_qbj_4wq_cfc} {#store-secops-rn-sir-now-assist__ul_nzv_lwq_cfc} Version 2.0.3 - March 2025 : * New: * The "Close Security Incident" use case assists analysts in closing a security incident from the "Now Assist panel" by generating the Post Incident Analysis, Closure notes, and close code, while overriding all mandatory task closures and assessments. * Additionally, it supports closing a security incident as a false positive, which skips the generation of Post Incident Analysis, Closure notes, and close code, and directly closes the incident by marking it as False Positive. {#store-secops-rn-sir-now-assist__ul_lxg_nxx_42c} {#store-secops-rn-sir-now-assist__ul_rgt_mxx_42c} Version 2.0.1 - February 2025 : Empower your SOC team with Generative AI capabilities for Security Incident Response.