thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

ServiceNow Security Incident Response (SIR)

A ServiceNow application for managing security incidents with workflows, playbooks, threat intelligence and integrations.

Definition

ServiceNow SIR creates security incidents from SIEM alerts, user reports or email, applies risk scoring and assignment rules, runs playbooks and integrates with threat intelligence and vulnerability response. It tracks tasks, SLAs and post-incident reviews on the Now Platform.

Example

A SIEM alert automatically creates a security incident with calculated risk score and an assigned phishing playbook.

Exam tip

Know that SIR calculates risk score from business impact, priority and severity attributes.

Related terms