Security and risk · LessonBy Sneha I, ServiceNow Trainer, 8 yrs · Published · ServiceNow · all levels
Security Incident Response
Run SecOps incidents: intake from SIEM, enrichment, containment tasks and the split from IT incident.
Quick answer
Run SecOps incidents: intake from SIEM, enrichment, containment tasks and the split from IT incident.
Key takeaways
- Security incidents are a separate table with restricted access
- Enrichment saves the analyst the first twenty minutes
- Playbooks keep containment consistent
- Impact reporting depends on linked CIs and users
Separate from IT incident
Security incidents live in sn_si_incident, not in the incident table. That separation matters because access is restricted, fields differ, and the service desk should not see the detail of an investigation.
Intake and enrichment
Incidents arrive from SIEM integrations, email parsing, the security catalog or manually. Enrichment actions pull threat intelligence, CI and user context automatically so the analyst starts with a picture rather than a line of text.
Response process
Playbooks and response tasks structure the work.
- Use playbooks so containment steps are consistent under pressure
- Link affected CIs and users, that is what makes impact reporting possible
- Keep post incident actions as tasks with owners
- Restrict roles tightly, sn_si.analyst is not a general ITIL role
Practice challenge
+0 XPStreak ×0
Question 1 of 2
Which table holds security incidents?
Frequently asked questions
Should a security incident create an IT incident?
Only when service restoration work is needed by IT. Keep the investigation in SecOps and use a linked incident for the operational work.
Where does threat intelligence come from?
Threat intelligence sources configured in the Threat Intelligence application, queried through enrichment actions during triage.