Version history for the Security Incident Response Workspace on the ServiceNow Store.

Important: For details on system requirements and family compatibility, view the application listing on the ServiceNow Store website.

Version history

Version 1.7.10 - June 2025
  • Fixed:
    • SIT page Related record section in SecOps workspace keeps loading.
    • Runbook articles were not properly applied with dark theme on the SIR workspace.
    • Drop down buttons on investigation tab were not visible properly.
    • Backend name is showing up instead of display name in Reports section of the SIR Workspace.
    • Schedules page in SIR workspace accessible for user with the sn_si.read role.
Version 1.7.9 - May 2025
  • New: On-Call Scheduling: Introduced a new on-call scheduling feature that allows users to efficiently manage and coordinate on-call duties within the SIR workspace.
  • Changed: Relationship Graph Enhancement: Enhanced the Relationship Graph feature by introducing admin-level configuration options, enabling greater customization and control.
  • Fixed: Various bugs have been addressed and resolved as part of this release.
Version 1.7.3 - March 2025
Fixed: Various bugs have been addressed and resolved as part of this release.
Version 1.7.0 - February 2025
  • New:
    • Incident Status Reporting:
      • Executive Summary and Analyst Report Templates
        • Introduced ready-to-use, out-of-the-box templates for streamlined reporting processes.
        • Report Templates: Users can now create reusable templates for consistent and standardized reporting.
        • Report Generation: Effortlessly generate detailed reports for better decision-making and communication.
        • Report Sharing: Seamlessly share reports with stakeholders to ensure alignment and collaboration.
    • Conference call feature
      • Zoom
      • Teams
      • WebEx
    • Relationship graph visualizer
  • Changed: The Discuss button for initiating native sidebar chat has been renamed to Start Chat and is moved under the Collaborate option.
  • Fixed:
    • On the SIR home page widget list, the Assign action did not work for the second time if the page was not refreshed.
    • Response Task - Related Records Pane Is Empty
    • After a SIR is closed, the associated playbooks are displayed as 'Cancelled' with the reason: "Cancelled by system," even though the playbook was completed before the closure.
    • Issue with the assignment group and assigned-to fields lookup (magnifying symbol) within the Security Incident Response workspace on SIT.
    • The Splunk ES-related file is to be removed from the analyst workspace.
Version 1.6.9 - December 2024
  • Fixed:
    • An error where the investigation tab displayed: "Error while fetching entry points data" message.
    • Issue with the assignment group and assigned-to fields lookup (magnifying symbol) within the Security Incident Response workspace on SIT.
Version 1.6.4 - November 2024
  • New:
    • Supporting UI changes for the below skills added for Now Assist for Security Operations:
      • Post-incident analysis
      • Recommended Actions
  • Fixed:
    • Custom new records in SIR are cleared once a reference field is selected from the pop-out in the SIR workspace
    • A Performance Analytics indicator installed with "Security Incident Response Workspace" does not have an indicator source, causing errors in PA job logs.
Version 1.6.2 - August 2024
  • New: Added Native sidebar chat.
  • Fixed:
    • If the response task has an Assignment group field value but not an Assigned to field value, then the assignment details from the security incident are not automatically filled.
    • There are no ACLs on the Sighting Search Details remote table.
    • When a user from another session closes the security incident, the user from the current session sees a closing modal.
Version 1.5.3 - July 2024
The Security Incident Response Workspace is designated as a dependent application for Security Incident Response. Therefore, it cannot be installed directly.
Version 1.5.1 - June 2024
  • New:
    • Now Read and privileged access users will also have access to view the security incidents from the workspace.
    • Security Incident Response workspace(sn_si_aw:1.5.1) will be installed automatically with Security Incident Response (sn_si:13.4.5).
Version 1.5.0 - May 2024
  • New: Added Shift Handover Report
  • Changed:
    • The Risk score configuration in the Security Incident Response workspace has been improved with the following:
      • Ability to set up a Risk Score Calculator from either script or condition builders.
      • Ability to apply multiple conditions while setting up rule-based scoring.
      • Ability to apply weightage to each scoring line.
      • Weights should add up to 100. For rule-based scoring, the ability to select tables/fields and values for setting up the condition.
      • Ability to capture the conditions and scoring via script.
      • Ability to manually execute the risk score calculators to recalculate after making changes.
  • Fixed:
    • The 'Security Incident Overview' page takes longer to load due to the missing null check.
    • The default filter for the 'Visible to Me' list on the SIR workspace is incorrect.
    • The 'Post' action disappears when the Worknotes field is made mandatory by UI Policy or the client script.
    • The Close code choices are not listed per user-preferred language in the closure flow event.
Version 1.4.0 - February 2024
  • New: Added Security Incident Response Request functionality.
  • Fixed:
    • The Playbook and Related record tabstook longer to load than other tabs.
    • When the work notes are mandatory, and the user tries to close a response task without filling in the work notes, an error message is not displayed.
    • The latest result filter data for Running Processes, Running Services, and Net stats is incorrect.
    • The State field in Security Incident Response (GlideChoiceList) displays "Analysis" incorrectly instead of "Identification."
Version 1.3.1 - December 2023
  • New: You can now monitor Scan Requests from the Security Incident Response workspace.
  • Fixed:
    • Changing the Assignment Group of SIT did not refresh the options for Assigned to.
    • The data was not loading when users tried to load the affected services using the SIR workspace.
    • The Create Outage Modal window was not loading on Vancouver instances.
    • The Response Task modal's height did not stay constant when users switched between tabs.
    • The magnifying glass option was not working in a few places.
Version 1.3.0 - November 2023
  • New:
    • Added the "Report Risk Event" action.
    • Security Incident Managers (sn_si.manager) can now edit all dashboards.
  • Fixed:
    • Sent or Received Emails body field was not rendered in HTML format.
    • The playbook context menu item was not visible when the Investigation tab was open.
    • Performance issue on the "Link" action on the Configuration Item-related lists.
    • While scrolling up, the Playbook tab hides the other tabs on the Security Incident form.
    • In the Lists view, while zooming in, the left or right scroll is difficult to find at the bottom of the page (except the Security Incident form).
    • A user with the Security Manager role could not view related records on a security incident in the workspace view.
    • Reference records failed to load.
Version 1.2.2 - August 2023
New:
  • Flow to Process conversion.
  • Core Logic Changes
Version 1.1.0 - May 2023
  • New:
    • Support for CrowdStrike Falcon Host integration.
    • CISO and Manager overview dashboards.
  • Fixed: Performance issues.
Version 1.0.4 - April 2023
Changed: The Security Incident Response workspace is updated to support standard record pages.
Version 1.0.0 - February 2023

Security Incident Response Workspace will be used by Security Analysts and SOC Managers to solve Security Incidents and perform all SOAR related activities.