Security Incident Response
Quick answer
Run SecOps incidents: intake from SIEM, enrichment, containment tasks and the split from IT incident.
Key takeaways
- Security incidents are a separate table with restricted access
- Enrichment saves the analyst the first twenty minutes
- Playbooks keep containment consistent
- Impact reporting depends on linked CIs and users
Separate from IT incident
Security incidents live in sn_si_incident, not in the incident table. That separation matters because access is restricted, fields differ, and the service desk should not see the detail of an investigation.
Intake and enrichment
Incidents arrive from SIEM integrations, email parsing, the security catalog or manually. Enrichment actions pull threat intelligence, CI and user context automatically so the analyst starts with a picture rather than a line of text.
Response process
Playbooks and response tasks structure the work.
- Use playbooks so containment steps are consistent under pressure
- Link affected CIs and users, that is what makes impact reporting possible
- Keep post incident actions as tasks with owners
- Restrict roles tightly, sn_si.analyst is not a general ITIL role
Want to learn this properly?
Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.
Check your understanding
Which table holds security incidents?
- A. incident
- B. sn_si_incident
- C. sn_vul_vulnerable_item
- D. sn_grc_issue
Show answer
B. sn_si_incident
SecOps uses its own restricted tables.
What standardises containment steps?
- A. A knowledge article
- B. A playbook
- C. An SLA
- D. A dashboard
Show answer
B. A playbook
Playbooks drive consistent response tasks.