Create Security Incidents
About 10% of the CIS-SIR exam — see all 7 domains.
There are several supported creation paths, and the exam expects you to match a scenario to the right method.
Creation methods
- Manual creation — an analyst creates a security incident directly (form or workspace), choosing category, affected CI/user, and details.
- Email parsing / inbound email — inbound email actions parse reported emails (notably phishing reports) and create security incidents automatically, extracting observables from the message. This underpins the phishing playbook.
- Service Catalog — a security incident catalog item lets end users or analysts submit a request that generates a security incident through a record producer.
- Integrations / event-driven — SIEM, EDR, and other security tools create security incidents via integrations, alerts, or the Event Management/alert pipeline. This is the most common enterprise creation path at scale.
- Manually from another record — promotion from a related task, alert, or threat record.
Record producers and catalog
A record producer is the platform mechanism behind a catalog-driven security incident: it presents a simplified form to the submitter and creates the sn_si_incident record with mapped values. Know that catalog creation = record producer.
Email parsing specifics
Inbound email creation relies on configured email accounts and inbound email actions/flows. Reported phishing emails (often forwarded to a dedicated mailbox) are parsed; the body and headers yield observables. Configuring the notification/email account is one of the Setup Assistant steps — tying Domain 2 back to Domain 1.
Sample questions from this domain
Three of the 30 in this domain, with the reasoning. The full set is in the question bank.
Which of the following is a valid method for creating a security incident in ServiceNow?
- A. Approving an ITSM change request
- B. Manually creating a record in the Security Incident form ✓
- C. Running a CMDB Health reconciliation
- D. Editing a CMDB CI relationship
Why: A security incident can be created manually using the Security Incident form. Editing CI relationships, running CMDB Health, or approving change requests do not create security incidents.
Which two channels can automatically generate a security incident without an analyst manually filling out the form? (Choose two)
- A. Inbound email parsing of reported phishing messages ✓
- B. A CMDB import set transform
- C. A manually typed knowledge article
- D. A Service Catalog request item submitted through the portal ✓
- E. A user updating their own profile photo
Why: Inbound email parsing and Service Catalog submissions can automatically create security incidents. Writing a knowledge article, running a CMDB import, or updating a profile photo do not create security incidents.
An organization wants employees to report suspicious emails by forwarding them to a monitored mailbox, which then creates a security incident. Which mechanism enables this?
- A. A discovery probe
- B. An inbound email action that parses the message and creates an sn_si_incident record ✓
- C. A CMDB identification rule
- D. A scheduled import set
Why: An inbound email action parses messages sent to the monitored mailbox and creates a security incident. Import sets, discovery probes, and CMDB identification rules do not perform inbound email-to-incident creation.