sn_si_incident Table — ServiceNow Reference

Table Reference/sn_si_incident

The sn_si_incident table stores security incident records in the SecOps module, extending the task table with threat intelligence and security-specific fields. Before querying, know that it inherits task's complex state management while adding security-specific workflow states.

What This Table Is

The sn_si_incident table stores security incident records managed through ServiceNow's Security Operations (SecOps) module. These records represent security events that require investigation, analysis, and response - from malware detections to data breaches to suspicious user activity. Unlike standard ITSM incidents focused on service restoration, security incidents emphasize threat containment, forensic analysis, and coordinated response across security teams.

This table extends the task table, inheriting all standard task fields while adding security-specific columns for threat intelligence integration, MITRE ATT&CK mappings, and analyst workflow management. The SecOps module orchestrates the complete security incident lifecycle: detection, triage, investigation, containment, eradication, recovery, and lessons learned documentation.

The table supports complex hierarchical relationships through the standard task parent-child model, allowing security analysts to break down major incidents into investigative subtasks or link related security events. Child tables like sn_si_task extend this table for specialized security task types, while integration with sn_ti_observable provides threat intelligence context for each incident.

In large enterprises, this table typically contains thousands of records monthly, with high-priority incidents generating significant activity through Business Rules, notifications, and integrations with SIEM platforms. Performance considerations become critical when querying across date ranges or aggregating metrics for security dashboards, especially with the complex joins often required to gather threat intelligence context.

When You'll Script Against This Table

You'll primarily script against sn_si_incident in Business Rules handling state transitions, Script Includes building security dashboards, and Scheduled Jobs performing automated threat hunting. Integration scenarios frequently require REST APIs querying recent high-priority incidents or webhook endpoints creating incidents from SIEM alerts. Transform Maps commonly target this table when importing security events from external threat detection platforms.

Access requires the sn_si.user role minimum for read operations, with sn_si.admin required for configuration changes. The SecOps application scope (x_snc_security_in) affects custom scripting, requiring cross-scope access declarations for global Business Rules.

Automated incident creation from SIEM integrations using REST APIs
State change notifications to security analyst groups and external SOC tools
Metrics aggregation for security KPIs and SLA compliance reporting
Threat intelligence enrichment by linking observables and IOCs to incidents
Automated analyst assignment based on incident classification and team workload
Parent-child incident linking for complex multi-stage security events
Escalation workflows triggering executive notifications for critical incidents

Table Gotchas

⚠️

The state field uses security-specific choice values different from standard incidents. Don't assume standard incident state numbers (1=New, 2=In Progress) apply here.

⚠️

Threat intelligence fields like threat_intel_observables reference records in separate application scopes, causing cross-scope access issues in custom Business Rules.

The assignment_group field has reference qualifiers limiting selection to security analyst groups only, which breaks generic task assignment scripts
The classification field drives automated workflow routing but changes trigger expensive Business Rules that query threat intelligence APIs

⚠️

Queries filtering by opened_at across large date ranges perform poorly due to high record volume. Always include state or priority filters to use compound indexes.

Record-level security prevents analysts from seeing incidents outside their assigned security domains, causing incomplete query results in cross-domain reporting
The attack_vector and mitre_technique fields populate asynchronously after incident creation, causing timing issues in immediate post-insert scripts

💡

Use encoded queries when filtering by multiple security-specific fields - the complex choice dependencies make API parameter building error-prone.

Free Newsletter

Enjoying this? Get one deep-dive per week.

Join 1,000+ ServiceNow pros — scripts, GlideRecord patterns, Flow Designer techniques, and career moves. Free.

As a child of the task table, security incidents inherit standard workflow fields and participate in task hierarchy relationships. The sys_user table links through assigned_to for analyst assignment, while sys_user_group connects via assignment_group for team-based workflows.

The sn_ti_observable table provides crucial threat intelligence context, linking IP addresses, file hashes, and domain names to incidents for IOC analysis. Many-to-many relationships through m2m_si_incident_observable enable complex threat hunting queries. The cmdb_ci table frequently joins for asset impact analysis, while sn_si_task extends this table for specialized security investigation workflows.

Integration scenarios commonly involve the sys_attachment table for forensic evidence storage and sys_journal_field for detailed investigation timeline tracking. Developers frequently query these tables together when building security dashboards or automated response workflows that require comprehensive incident context including timeline, evidence, and threat intelligence correlation.

Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher

Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview

Tasks

CMDB

API

Metrics

Monitor

Internals

Instance:sourdoughdev·Version:Yokohama

Instance StateONLINE

System StatusFully Operational

Session Timeout90 minutes

Logged-In Sessions2 (20 active)

Build Nameyokohama-12-18-2024_p1

IP Address10.159.128.43

Instance HealthHealth Score: 90%

🔥 5dSourdough (Chrome Plugin)Dark Mode

Key Fields

Column	Type	Label	Notes
state	choice	State	Security incident workflow state using SecOps-specific values (0=Draft, 1=Analysis, 2=Containment, 3=Eradication, 4=Recovery, 6=Resolved, 7=Closed). Different from standard incident states.
classification	choice	Classification	Security incident type classification (Malware, Phishing, Data Breach, etc.). Drives automated workflow routing and analyst assignment rules.
attack_vector	choice	Attack Vector	Primary attack method used (Email, Web Application, Network, etc.). Populates asynchronously after creation via threat intelligence integration.
mitre_technique	reference	MITRE ATT&CK Technique	References sn_ti_mitre_technique table for ATT&CK framework mapping. May be empty initially and populated during analysis phase.
threat_intel_observables	glide_list	Threat Intelligence Observables	Comma-separated sys_ids referencing sn_ti_observable records. Cross-scope references can cause access issues in custom scripts.
security_domain	reference	Security Domain	References security domain for record-level access control. Analysts only see incidents within their assigned domains.
risk_score	integer	Risk Score	Calculated risk score (0-100) based on threat intelligence and asset criticality. Updated automatically by threat scoring Business Rules.
source_id	string	Source ID	External system identifier (SIEM alert ID, endpoint tool case number). Used for correlation and duplicate prevention in automated creation.
source_system	string	Source System	Originating security tool or system name. Critical for integration mapping and automated enrichment workflows.
containment_status	choice	Containment Status	Threat containment progress (Not Started, In Progress, Complete). Independent of main state field for detailed tracking.
artifacts_collected	boolean	Artifacts Collected	Flag indicating forensic evidence collection status. Triggers retention policy and legal hold workflows when true.
affected_users	integer	Affected Users	Count of impacted user accounts. Automatically calculated from related user security events and CI relationships.
business_impact	choice	Business Impact	Business impact level (None, Low, Medium, High, Critical). Drives SLA timers and executive notification workflows.
sla_due	glide_date_time	SLA Due	Security SLA deadline calculated from classification and business impact. Timezone handling matches assigned_to user preferences.
false_positive	boolean	False Positive	Marks incident as false positive for metrics exclusion. Changing this triggers tuning workflows for source detection systems.
parent_incident	reference	Parent Security Incident	Self-referencing field for incident hierarchy. Uses same table reference with qualified domain restrictions.
investigation_notes	journal_input	Investigation Notes	Analyst investigation journal with automatic timestamping. Searchable across incidents for pattern analysis and threat hunting.
detection_method	choice	Detection Method	How the incident was initially detected (Automated Tool, User Report, Hunting, etc.). Used for detection capability metrics.

Common Queries

Get all active security incidents

// Most basic query - active incidents not resolved or closed
var gr = new GlideRecord('sn_si_incident');
gr.addQuery('active', true);
gr.orderByDesc('opened_at');
gr.query();

while (gr.next()) {
    gs.info('Active incident: ' + gr.number + ' - ' + gr.short_description);
    // Process active security incidents
}

Find high-priority malware incidents assigned to specific team

// Real-world query for SOC dashboard filtering
var gr = new GlideRecord('sn_si_incident');
gr.addQuery('state', 'IN', '1,2,3'); // Analysis, Containment, Eradication
gr.addQuery('classification', 'malware');
gr.addQuery('priority', '<=', '3'); // Priority 1, 2, or 3
gr.addQuery('assignment_group.name', 'SOC Tier 1');
gr.orderBy('risk_score'); // Highest risk first
gr.query();

while (gr.next()) {
    gs.info('High-priority malware: ' + gr.number + ' Risk: ' + gr.risk_score);
}

Find incidents with specific threat intelligence observables

// Query incidents linked to known IOCs for threat hunting
var observableId = 'abc123'; // Known bad IP or hash
var gr = new GlideRecord('sn_si_incident');
gr.addQuery('threat_intel_observables', 'CONTAINS', observableId);
gr.addQuery('opened_at', '>', gs.daysAgoStart(30)); // Last 30 days
gr.addQuery('false_positive', false);
gr.orderByDesc('risk_score');
gr.query();

while (gr.next()) {
    gs.info('IOC match: ' + gr.number + ' Observable: ' + observableId);
    // Process for threat correlation analysis
}

Count incidents by classification for metrics dashboard

// GlideAggregate for security metrics reporting
var ga = new GlideAggregate('sn_si_incident');
ga.addQuery('opened_at', '>', gs.daysAgoStart(30));
ga.addQuery('false_positive', false); // Exclude false positives
ga.groupBy('classification');
ga.addAggregate('COUNT');
ga.query();

while (ga.next()) {
    var classification = ga.classification.getDisplayValue();
    var count = ga.getAggregate('COUNT');
    gs.info('Classification: ' + classification + ' Count: ' + count);
}

Wrong way vs right way to query recent critical incidents

// WRONG: Expensive query without proper indexing
// var gr = new GlideRecord('sn_si_incident');
// gr.addQuery('opened_at', '>', gs.daysAgoStart(1));
// This scans huge date ranges without compound index

// RIGHT: Include state filter to use compound index
var gr = new GlideRecord('sn_si_incident');
gr.addQuery('state', 'IN', '1,2,3'); // Active states first
gr.addQuery('priority', '1'); // Critical priority
gr.addQuery('opened_at', '>', gs.daysAgoStart(1));
gr.query();
// This uses state+priority compound index efficiently

Related Tables

task sys_user sys_user_group cmdb_ci

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue