Automation and Standard Processes
About 15% of the CIS-SIR exam — see all 7 domains.
Flow Designer is the automation engine
Modern SIR automation is built on Flow Designer, the Now Platform's low-code automation tool, which has replaced legacy Workflow for new SIR content. Flows are composed of triggers, actions, subflows, and the Action Designer for building reusable actions. SIR ships a library of security-specific flow actions (enrich observable, block IP, run lookups, create/close response tasks, notify, etc.) that you assemble into playbooks.
Standard processes and orchestration
Automation standardizes the response process: flows can auto-create response tasks, auto-enrich observables, auto-assign, and drive state transitions. Integration actions reach out to external security tooling through integration capabilities (a SecOps abstraction layer that maps a generic capability like "Block IP" or "Get Network Statistics" to a specific vendor integration). This abstraction means a playbook calls a capability, and whichever integration is configured for that capability executes it, letting you swap vendors without rewriting flows.
Phishing automation (the canonical example)
The automated phishing playbook flow is the most-documented standard process: a reported phishing email is parsed, observables (sender, URLs, attachments, IPs) are extracted, observables are enriched and looked up against threat sources, malicious indicators drive containment actions, and the incident is updated or closed. Know its end-to-end shape; it is a frequent source of automation questions.
Business rules, flows, and when to use what
Understand the distinction: business rules run server-side on database operations; flows are the preferred, maintainable way to orchestrate multi-step response and integration logic; Action Designer builds the reusable building blocks. The exam favors Flow Designer as the modern answer for SIR automation.
Sample questions from this domain
Three of the 45 in this domain, with the reasoning. The full set is in the question bank.
What is the primary purpose of a playbook in Security Incident Response?
- A. To associate published knowledge articles with specific response tasks through a condition on the task
- B. To evaluate an ordered set of conditions that set the Risk score, Business Impact, and Priority fields
- C. To guide responders through a structured, often automated sequence of activities for handling a type of incident ✓
- D. To define the states an incident moves through and the transitions that are allowed between those states
Why: A playbook guides responders through a structured, often partly automated sequence of activities for a given incident type, promoting consistency; analysts work its stages and tasks from the incident. Associating published knowledge articles with tasks through a condition is what a runbook does. Evaluating ordered conditions to set Risk score, Business Impact, and Priority is the job of severity calculators in a calculator group. The states and allowed transitions come from the process definition [sn_si_process_definition].
Which ServiceNow tool is the primary low-code environment for building automated flows that respond to security incident events?
- A. Form Designer
- B. Report Designer
- C. Page Designer
- D. Flow Designer ✓
Why: Flow Designer (part of Workflow Studio) is the primary low-code tool for building automated flows triggered by events such as a security incident being created or updated, and SIR ships its automation as Flow Designer flows, subflows, and actions. Form Designer lays out the fields and sections of forms. Report Designer builds reports and charts. Page Designer lays out Service Portal pages by placing and arranging widgets. None of them builds automation that responds to record events.
Which two are benefits of automating standard response processes with playbooks and flows? (Choose two)
- A. Removal of the need for analyst review on containment
- B. Automatic closure of incidents once the playbook ends
- C. Consistent, repeatable handling that reduces analyst error ✓
- D. Faster response by automating routine steps ✓
- E. Replacement of SLA definitions by playbook timers
Why: Automating standard processes with playbooks and flows gives consistent, repeatable handling that reduces analyst error, and faster response because routine steps run without manual effort. Automation does not remove the need for human review of impactful actions such as containment; good designs keep approval or input steps for them. Finishing a playbook does not close the incident; closure still needs active response tasks closed or canceled, any mandatory post incident review assessments completed, and the closure information supplied. SLA definitions still measure response targets; playbooks do not replace them.