Security Incident Response Overview
About 15% of the CIS-SIR exam — see all 7 domains.
This domain establishes the product's place in the portfolio, its data model, and its setup.
Product positioning
Security Incident Response is one of the core applications in the Security Operations (SecOps) product family, alongside Vulnerability Response and Threat Intelligence. SecOps connects the security organization to the Now Platform and the CMDB, bridging security tooling and IT operations. SIR is not part of ITSM, CSM, or GRC, though it integrates with them (for example, sharing the CMDB and integrating with Change for remediation).
Core data model
- sn_si_incident: the security incident record (extends Task).
- sn_si_task: response tasks (child work items).
- sn_ti_observable: observables (IPs, hashes, domains, URLs, etc.) managed by Threat Intelligence.
- Security incidents relate to CMDB CIs, users, and affected services.
Setup Assistant
The Security Incident Response Setup Assistant is the purpose-built, guided configuration tool. After activating the application, an implementer uses the Setup Assistant to walk step by step through the base system setup: the process definition, security incident groups, calculator groups and calculators, risk score weights, SLAs, runbooks, and user-reported phishing rules (phishing email address and email matching rules). Notifications and manual or auto-assignment are configured afterward as optional procedures. It is the SIR analog of ITSM Guided Setup. Know that the Setup Assistant (not Flow Designer, not the Upgrade Monitor) is the answer when a question asks for the guided baseline-configuration tool for SIR.
Activation and dependencies
SIR is activated via plugin/Store install and depends on the Security Operations common components. Some capabilities (Threat Intelligence enrichment, integrations from the ServiceNow Store) are licensed and activated separately. (VERIFY) specific plugin names and licensing for your release.
Sample questions from this domain
Three of the 45 in this domain, with the reasoning. The full set is in the question bank.
Which ServiceNow product family does Security Incident Response (SIR) belong to?
- A. Integrated Risk Management (IRM)
- B. IT Operations Management (ITOM)
- C. Customer Service Management (CSM)
- D. Security Operations (SecOps) ✓
Why: Security Incident Response is part of the Security Operations (SecOps) product family, alongside Vulnerability Response, Threat Intelligence, and Configuration Compliance; activating any of them also activates the shared Security Support Common plugin. Integrated Risk Management covers governance, risk, and compliance work, not incident response. IT Operations Management supplies capabilities SIR can consume, such as Event Management alerts that become security incidents, but SIR is not an ITOM product. Customer Service Management cases can be linked to security incidents, yet SIR does not belong to that family.
An implementer wants a guided, repeatable way to configure baseline Security Incident Response settings such as the process definition, security incident groups, calculators, and SLAs after installing the application. Which tool is purpose-built for this?
- A. The Security Incident Administration Configuration page
- B. The ITSM Guided Setup for incident management
- C. The Security Incident Response Setup Assistant ✓
- D. The Security Incident Response Process Selection
Why: The Security Incident Response Setup Assistant is a wizard-like application that guides the implementer step by step through the base system setup: the process definition, security incident groups, calculator groups and calculators, risk score weights, SLAs, runbooks, and user-reported phishing rules. It requires the sn_secops_setup.admin role, which sn_si.admin users inherit. The Configuration page under Security Incident > Administration holds the optional procedures done after the Setup Assistant (request life cycle, catalogs, notifications, and manual and auto-assignment), so it is not where groups, calculators, or SLAs are set up. Process Selection only chooses which process definition is in use and lists records in invalid states. ITSM Guided Setup configures IT Service Management, not Security Incident Response.
Which table stores Security Incident records in ServiceNow?
- A. sn_si_request
- B. sn_si_incident ✓
- C. sn_msi_incident
- D. sn_ti_observable
Why: Security incidents are stored in the Security Incident [sn_si_incident] table, which also links their response tasks and the changes, problems, and incidents related to them. sn_si_request is the Security Request table for security-related requests made to the security team. sn_msi_incident holds Major Security Incident records used by Major Security Incident Management. sn_ti_observable holds Threat Intelligence observables such as IP addresses and file hashes.