create_security_incident
Create a Security Operations incident in ServiceNow with category, severity, and assignment group to streamline SOC response and tracking.
Instructions
Create a Security Operations incident (requires WRITE_ENABLED=true)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| category | Yes | Incident category (e.g., "Malware", "Phishing", "Data Breach", "Unauthorized Access") | |
| severity | No | 1=High, 2=Medium, 3=Low | |
| description | No | Detailed description of the security incident | |
| subcategory | No | Incident subcategory | |
| affected_cis | No | List of affected CI sys_ids | |
| assignment_group | No | SOC team or assignment group | |
| short_description | Yes | Brief description of the security event |