Security Incident Response (SIR) Implementation

Security Incident Response Implementation is a two-day instructor-led course designed for professionals who configure, administer, and implement the ServiceNow Security Incident Response application.

The course covers the common technical aspects of a SIR implementation, from initial application setup and form configuration to playbook design, threat intelligence, integrations, and major security incident management. Structured in a lecture, demo, lab, and discussion format, participants work in their own student instance through real-world scenarios to build practical implementation skills. Learners also get an overview of Now Assist for SecOps and the Threat Intelligence Security Center application.

Note: Successful attendance requires participation in at least 75% of dedicated class time for instructor-led sessions.

The following prerequisites are mandatory:

• Welcome to ServiceNow
• ServiceNow Administration Fundamentals
• Get Started with Now Create
• ServiceNow Platform Implementation
• Security Operations Fundamentals

The following prerequisites are optional but recommended for a stronger implementation foundation:

• Automated Test Framework (ATF) Fundamentals
• Common Service Data Model (CSDM) Fundamentals
• Configuration Management Database (CMDB) Fundamentals
• Flow Designer Fundamentals
• IntegrationHub Fundamentals
• Mobile Development Fundamentals
• Service Portal Fundamentals
• Introduction to Playbooks and Process Automation Designer
• Playbooks and Process Automation Designer Fundamentals

• Duration: 2 days (16 hours of instruction)
• Format: Instructor-led training (in-person and virtual)
• Platform Support: ServiceNow platform including Security Incident Response, Security Incident Response Workspace, Threat Intelligence, MITRE ATT&CK framework, Major Security Incident Management, Now Assist for SecOps, and DLP-IR

This course is designed for professionals working on ServiceNow implementations of the Security Incident Response application, including:

• Process Owners who will champion their process domain
• Technical Consultants and Administrators configuring, developing, or supporting Security Incident Response applications
• IT Project, Program, and Engagement Managers leading SIR implementations
• Operations Managers overseeing work facilitated through Security Incident Response in ServiceNow

By the end of this course, learners will be able to:

• Identify the goals of Security Incident Response
• Understand and meet customer goals in an SIR Implementation
• Create Security Incidents
• Use and configure dashboards and reports 
• Use the MITRE-ATT&CK framework in SIR
• Use the Security Incident Response Workspace
• Create and apply Security Tags
• Identify Calculators and apply Risk Scores
• Enhance Process Definitions and Selection
• Complete Post Incident Reviews
• Use SIR Automation Capabilities

After completing this course, learners can apply their SIR implementation skills to real-world security operations deployments and continue building expertise across the broader ServiceNow Security Operations suite.

N/A

#1. What prerequisites are required for this course? 

The mandatory prerequisites are Welcome to ServiceNow, ServiceNow Administration Fundamentals, Get Started with Now Create, ServiceNow Platform Implementation, and Security Operations Fundamentals. A range of optional courses covering ATF, CMDB, Flow Designer, IntegrationHub, and Playbooks are also recommended for a stronger implementation foundation.

#2. Who is this course designed for? 

This course is designed for Technical Consultants, Administrators, Process Owners, Project Managers, and Operations Managers who work on ServiceNow Security Incident Response implementations.

#3. Will I get hands-on practice during the course? 

Yes. The course follows a lecture, demo, lab, and discussion format across all seven modules. Participants work in their own student instance with step-by-step lab exercises and have access to live instructor assistance throughout both days.

#4. Is there an attendance requirement for this course? 

Yes. For instructor-led sessions, participants must attend at least 75% of dedicated class time to be considered as having successfully completed the course. On-demand participants must complete all on-demand modules.