Automation and Standard Processes
About 15% of the CIS-SIR exam — see all 7 domains.
Flow Designer is the automation engine
Modern SIR automation is built on Flow Designer, the Now Platform's low-code automation tool, which has replaced legacy Workflow for new SIR content. Flows are composed of triggers, actions, subflows, and the Action Designer for building reusable actions. SIR ships a library of security-specific flow actions (enrich observable, block IP, run lookups, create/close response tasks, notify, etc.) that you assemble into playbooks.
Standard processes and orchestration
Automation standardizes the response process: flows can auto-create response tasks, auto-enrich observables, auto-assign, and drive state transitions. Integration actions reach out to external security tooling through integration capabilities (a SecOps abstraction layer that maps a generic capability like "Block IP" or "Get Network Statistics" to a specific vendor integration). This abstraction means a playbook calls a capability, and whichever integration is configured for that capability executes it — letting you swap vendors without rewriting flows.
Phishing automation (the canonical example)
The automated phishing playbook flow is the most-documented standard process: a reported phishing email is parsed, observables (sender, URLs, attachments, IPs) are extracted, observables are enriched and looked up against threat sources, malicious indicators drive containment actions, and the incident is updated or closed. Know its end-to-end shape — it is a frequent source of automation questions.
Business rules, flows, and when to use what
Understand the distinction: business rules run server-side on database operations; flows are the preferred, maintainable way to orchestrate multi-step response and integration logic; Action Designer builds the reusable building blocks. The exam favors Flow Designer as the modern answer for SIR automation.
Sample questions from this domain
Three of the 45 in this domain, with the reasoning. The full set is in the question bank.
What is the primary purpose of a playbook in Security Incident Response?
- A. To rebuild the threat feed
- B. To store CMDB relationships
- C. To guide responders through a structured, often automated sequence of activities for handling a type of incident ✓
- D. To calculate the instance time zone
Why: A playbook guides responders through a structured, often partly automated sequence of activities for a given incident type, promoting consistency. It does not store CMDB relationships, calculate time zones, or rebuild feeds.
Which ServiceNow tool is the primary low-code environment for building automated flows that respond to security incident events?
- A. The Service Portal theme builder
- B. The Knowledge Base editor
- C. The CMDB Health dashboard
- D. Flow Designer ✓
Why: Flow Designer is the primary low-code tool for building automated flows triggered by events such as security incident creation or updates. CMDB Health, the Knowledge editor, and the theme builder are not flow-building tools.
Which two are benefits of automating standard response processes with playbooks and flows? (Choose two)
- A. Automatic elimination of the need for any analysts
- B. Permanent deletion of the CMDB
- C. Consistent, repeatable handling that reduces analyst error ✓
- D. Faster response by automating routine steps ✓
- E. Removal of all notifications
Why: Automation yields consistent, repeatable handling and faster response by automating routine steps. It does not eliminate the need for analysts, delete the CMDB, or remove notifications.