create_security_incident
Create a Security Operations incident in ServiceNow to document and track security events like malware, phishing, or data breaches with severity levels and assignment details.
Instructions
Create a Security Operations incident (requires WRITE_ENABLED=true)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| short_description | Yes | Brief description of the security event | |
| category | Yes | Incident category (e.g., "Malware", "Phishing", "Data Breach", "Unauthorized Access") | |
| subcategory | No | Incident subcategory | |
| severity | No | 1=High, 2=Medium, 3=Low | |
| description | No | Detailed description of the security incident | |
| affected_cis | No | List of affected CI sys_ids | |
| assignment_group | No | SOC team or assignment group |