Security Incident Response Overview
About 15% of the CIS-SIR exam — see all 7 domains.
This domain establishes the product's place in the portfolio, its data model, and its setup.
Product positioning
Security Incident Response is one of the core applications in the Security Operations (SecOps) product family, alongside Vulnerability Response and Threat Intelligence. SecOps connects the security organization to the Now Platform and the CMDB, bridging security tooling and IT operations. SIR is not part of ITSM, CSM, or GRC, though it integrates with them (for example, sharing the CMDB and integrating with Change for remediation).
Core data model
- sn_si_incident — the security incident record (extends Task).
- sn_si_task — response tasks (child work items).
- sn_ti_observable — observables (IPs, hashes, domains, URLs, etc.) managed by Threat Intelligence.
- Security incidents relate to CMDB CIs, users, and affected services.
Setup Assistant
The Security Incident Response Setup Assistant is the purpose-built, guided configuration tool. After activating the application, an implementer uses the Setup Assistant to walk through baseline configuration in organized sections: email/notification accounts for incident creation, default assignment, key system properties, integrations, and feature activation. It is the SIR analog of ITSM Guided Setup. Know that the Setup Assistant — not Flow Designer, not the Upgrade Monitor — is the answer when a question asks for the guided baseline-configuration tool for SIR.
Activation and dependencies
SIR is activated via plugin/Store install and depends on the Security Operations common components. Some capabilities (Threat Intelligence enrichment, integrations from the ServiceNow Store) are licensed and activated separately. (VERIFY) specific plugin names and licensing for your release.
Sample questions from this domain
Three of the 45 in this domain, with the reasoning. The full set is in the question bank.
Which ServiceNow product family does Security Incident Response (SIR) belong to?
- A. Customer Service Management (CSM)
- B. IT Service Management (ITSM)
- C. Governance, Risk, and Compliance (GRC)
- D. Security Operations (SecOps) ✓
Why: Security Incident Response is a core application within the Security Operations (SecOps) product family, alongside Vulnerability Response and Threat Intelligence. It is not part of ITSM, CSM, or GRC, although it integrates with those areas (for example, sharing the CMDB with ITSM).
An implementer wants a guided, repeatable way to configure baseline Security Incident Response settings such as notification email accounts, default assignment, and key system properties after activating the application. Which tool is purpose-built for this?
- A. Flow Designer
- B. The ITSM Guided Setup
- C. The Security Incident Response Setup Assistant ✓
- D. The Upgrade Monitor
Why: The Setup Assistant provides a guided, sectioned configuration experience specifically for Security Incident Response, walking the implementer through foundational settings. ITSM Guided Setup configures ITSM, not SecOps. Flow Designer builds automation flows, and the Upgrade Monitor tracks plugin upgrades; neither is a baseline configuration wizard for SIR.
Which table stores Security Incident records in ServiceNow?
- A. sn_ti_observable
- B. sn_si_incident ✓
- C. incident
- D. sn_vul_vulnerable_item
Why: Security Incidents are stored in the sn_si_incident table. The incident table holds ITSM incidents, sn_vul_vulnerable_item holds Vulnerability Response items, and sn_ti_observable holds Threat Intelligence observables.