Joe is on the SIR Team and needs to be able to configure Territories and Skills. What role does he need?

The snsi.admin (Security Admin) role is required to perform administrative and configuration tasks within the Security Incident Response (SIR) application. This includes configuring foundational elements like Territories and Skills, which are used by Advanced Work Assignment (AWA) to route security incidents to the appropriate analysts. This role contains all other snsi. roles and provides the necessary permissions to modify the application's behavior and settings, which is beyond the scope of user-level roles like Analyst or Manager.

A. Security Basic (snsi.basic): This role grants read-only access to SIR records and is the most fundamental user role, lacking any configuration capabilities.
B. Manager (snsi.manager): This role is for overseeing security incidents, managing teams, and reporting, but it does not include permissions for system-level configuration of features.
C. Security Analyst (snsi.analyst): This role is for users who actively investigate and resolve security incidents. It does not grant the privileges needed to configure application settings.

1. ServiceNow Product Documentation - Security Incident Response roles: The official documentation explicitly defines the snsi.admin role. It states, "Users with this role can administer the Security Incident Response application. This role contains all the roles in the Security Incident Response application." This administrative function inherently includes the configuration of application features. (ServiceNow, Security Incident Response roles, Doc ID: f281e399c33122002841b63b12d3ae6c).

2. ServiceNow Product Documentation - Configure skills for Security Incident Response: The procedure for configuring skills and other Advanced Work Assignment (AWA) features like territories requires administrative privileges to access modules like Skills Management and Assignment Rules. The snsi.admin role is the designated administrator for the SIR application, granting these permissions. (ServiceNow, Configure skills for Security Incident Response, Doc ID: 01148d825386101034c8ddeeff7b123d).