ServiceNow Certified Implementation Specialist – Security Incident Response Preparation Details
The CIS-SIR (ServiceNow Certified Implementation Specialist – Security Incident Response) exam validates your ability to configure, implement, and maintain ServiceNow Security Incident Response. This study guide maps official documentation to every exam domain. You can also explore more ServiceNow certification study guides on the ServiceNow Certification category page to keep building your skills.
ServiceNow Certified Implementation Specialist – Security Incident Response Materials
| Coursera | Advanced ITSM with ServiceNow: Optimizing IT Operations |
| Udemy | ServiceNow Security Incident Response Practice Exams |
Domain 1: Security Incident Response Overview and Data Visualization (15%)
Introducing Security Incident Response
Understanding Security Incident Response
Security Incident Response setup
Data Visualization
Security Incident Response Overview dashboard
Security Incident Explorer dashboard
Visual representation of Security Incident Response reporting
Security Incident Response – Components
Components installed with Security Incident Response
Domain 2: Security Incident Creation and Threat Intelligence (14%)
Explore How to Create Security Incidents
Create incident or security incident from an alert
Create Security Incident from a Vulnerability Record
Major Security Incident Management
Major Security Incident Management
Major Security Incident Management workspace
Use Visualizations in Report Templates
Understanding Threat Intelligence
Explore Threat Intelligence Security Center
MITRE ATT&CK Framework
MITRE-ATT&CK framework overview
Domain 3: Security Incident and Threat Intelligence Integrations (14%)
ServiceNow Store and Share
Exploring the ServiceNow Store
Install a ServiceNow Store application
Managing Pre-Built Integrations
Security Incident Response integrations
Security Operations Integration Configurations
Creating Custom Integrations
Integrations Capabilities framework 2.0
Threat Intelligence Service Center
Threat Intelligence Security Center
Explore Threat Intelligence Security Center
View Threat Intelligence Security Center home page
Create a security incident from a TISC case
Threat Intelligence Security Center release notes
Domain 4: Security Incident Response Management (15%)
Security Incident Response Workspace
Standard Automated Assignment Options and Escalation Paths
Security Tags
Set up security tag groups and tags
Edit the start and completion tag names and colors
Process Definitions and Selection
Domain 5: Risk Calculations and Post Incident Response (12%)
Security Incident Calculator Groups and Risk Scores
Define the new Risk Score Calculator Rules
Calculate the severity of a security incident
Post Incident Reviews
Configure an assessment trigger condition
Create post incident review assignment rules
Perform a questionnaire-based post incident review
Manage Post Incident Review Report
Event Management
An overview of alerts for Event Management operators
Domain 6: Automation and Standard Processes (30%)
Automate Security Incident Response Overview
Security Incident Response playbooks
Activate a Security Incident Response flow
Automate CrowdStrike Falcon Sandbox submissions using Flow Designer
Security Incident Process Automation Using Playbooks and Runbooks
Sample Playbooks for SIR Workspace
User Reported Phishing
Create security incidents from User Reported Phishing emails
Wrapping Up ServiceNow Certified Implementation Specialist – Security Incident Response
This ServiceNow Certified Implementation Specialist – Security Incident Response study guide covered all six CIS-SIR exam domains, from data visualization and threat intelligence to playbooks and phishing automation. Work through each documentation link and practice in a ServiceNow instance to build confidence. You can also explore more ServiceNow certification study guides on the ServiceNow Certification category page to keep building your skills. Have a question or tip? Leave a comment below.
Receive Updates on ServiceNow Certified Implementation Specialist – Security Incident Response Exam
Want to be notified as soon as I post? Subscribe to the RSS feed / leave your email address in the subscribe section. Share the article to your social networks with the below links so it can benefit others.
