Which Table would be commonly used for Security Incident Response?

The snsiincident table is the primary table for the ServiceNow Security Incident Response (SIR) application. This table, labeled "Security Incident," is specifically designed to store and manage security incident records. It extends the base Task [task] table and contains all the fields necessary for tracking the lifecycle of a security incident, from detection and analysis to containment, eradication, and recovery. The snsi prefix indicates that it belongs to the "Security Incident" scoped application, which is the standard naming convention for applications within the ServiceNow platform.

A. sysapprovalapprover: This is a core platform table used for managing approval records across all ServiceNow applications, not for storing security incidents.
B. secopsincident: This is not the correct table name for security incidents. The proper application scope prefix for Security Incident Response is snsi.
C. cmdbrelci: This table stores the relationships between Configuration Items (CIs) in the Configuration Management Database (CMDB), not incident data.

1. ServiceNow Product Documentation: "Tables installed with Security Incident Response". This official document explicitly lists snsiincident as the "Security Incident" table.

Source: ServiceNow Documentation

Washington DC Release

Security Incident Response

Reference section. Document ID: cInstalledWithSIR.

Direct Link: https://docs.servicenow.com/bundle/washingtondc-security-management/page/product/security-incident-response/reference/installed-with-sir.html (Refer to the table listing installed components).