{"id":771044,"date":"2025-10-14T13:47:09","date_gmt":"2025-10-14T11:47:09","guid":{"rendered":"https:\/\/www.devoteam.com\/expert-view\/whats-new-in-the-servicenow-zurich-release-for-secops-sir-vr-and-spc\/"},"modified":"2025-10-14T13:47:09","modified_gmt":"2025-10-14T11:47:09","slug":"whats-new-in-the-servicenow-zurich-release-for-secops-sir-vr-and-spc","status":"publish","type":"expert-view","link":"https:\/\/devoteam.info\/en-nl\/expert-view\/whats-new-in-the-servicenow-zurich-release-for-secops-sir-vr-and-spc\/","title":{"rendered":"What\u2019s new in the ServiceNow Zurich release for Security Operations: SIR, VR, and SPC updates"},"content":{"rendered":"\n

The pace of threat analysis and remediation is constantly accelerating. To keep security teams ahead of the curve, ServiceNow’s Zurich release delivers a powerful suite of updates across Security Incident Response (SIR), Security Posture Control (SPC), and Vulnerability Response (VR). This release is engineered to tackle two core problems facing security teams: manual overhead and prioritisation fatigue. So, let’s have a look in detail at the most interesting updates.<\/p>\n\n\n\n

Security Incident Response<\/h2>\n\n\n\n

Closing multiple incidents at once<\/h3>\n\n\n\n

ServiceNow Zurich release<\/a> introduces a brand new feature that allows analysts to efficiently close multiple security incidents at once. In the Security Incident Response Workspace, using the new \u201cClose\u201d<\/strong> button on the Security Incident list view, analysts can review the incidents and apply Close codes and notes to several incidents in bulk. This significantly reduces manual effort, especially when managing incidents with a common root cause. <\/p>\n\n\n\n

Ultimately, this enhancement streamlines case management, ensures consistent documentation, and frees up security teams to focus on proactive threat mitigation.<\/p>\n\n\n\n

\"\"
SIR Workspace – Bulk close security incidents feature, Source: ServiceNow<\/figcaption><\/figure>\n\n\n\n

Core enhancements<\/h3>\n\n\n\n

The release also brings key core enhancements to the Security Incident Response workspace, designed to improve efficiency, visibility, and collaboration across teams. One of the desired requests was to link multiple ITSM records<\/strong> to a single SIR record. That is now possible, enabling richer context and stronger correlation between incidents, changes, and service requests.<\/p>\n\n\n\n

Additionally, the new user presence feature provides real-time visibility<\/strong> into who is actively viewing or working on SIR or SIT records within the workspace, helping teams avoid duplicate efforts and improve collaboration. These core updates enhance situational awareness, streamline workflows, and strengthen coordination across security and IT operations, empowering analysts to respond faster and more effectively to security incidents.<\/p>\n\n\n\n

\"\"
SIR Workspace – Linking incidents feature, Source: ServiceNow<\/figcaption><\/figure>\n\n\n\n
\"\"
SIR Workspace, Source: ServiceNow<\/figcaption><\/figure>\n\n\n\n

Integration updates<\/h3>\n\n\n\n

Another new addition to SIR is the new CrowdStrike Falcon Next-Gen SIEM Integration<\/strong>, creating security incidents in ServiceNow from high-value CrowdStrike detections. It supports bidirectional data synchronisation, ensuring security teams always have complete context for faster, smarter action across both platforms.<\/p>\n\n\n\n

The new release also presents Splunk<\/strong> enhancements, like adding a new role to manage profiles in SIEM integrations (sn_si ingestion_profile_admin), Splunk Sighting Search integration enhancements and other Splunk ES integration enhancements.<\/p>\n\n\n\n

AI-assisted Shift Handover Reports<\/h3>\n\n\n\n

One of the Now Assist features is the Manage Shift Handover Records<\/strong> feature to significantly improve continuity and efficiency across security shifts. Analysts can now create, edit, and manage structured handover records directly tied to specific shift names, replacing previous manual, unstructured notes. <\/p>\n\n\n\n

This enhancement standardises the transfer of incident history, open actions, and priorities, making past handovers fully traceable and preventing information loss or duplicate work. Furthermore, Now Assist for SIR<\/strong> provides intelligent automation by adding relevant incident details to these reports, ensuring comprehensive context transfer and elevating overall shift-to-shift collaboration.<\/p>\n\n\n\n

Security Posture Control<\/h2>\n\n\n\n

Maintaining a strong security posture isn’t a one-time task; it’s a continuous journey. Organisations struggle with a constantly shifting attack surface, an influx of new vulnerabilities, and the pressure to comply with an array of regulatory standards. Traditional, fragmented security tools often lead to blind spots, manual overhead, and delayed remediation, ultimately increasing the risk of breaches.<\/p>\n\n\n\n

ServiceNow’s Security Posture Control<\/strong> was designed to address these challenges by providing a unified platform for security teams. With Zurich, the capabilities have been expanded to offer even greater automation and actionable intelligence.<\/p>\n\n\n\n

Editable policies and automated closures<\/h3>\n\n\n\n

In previous versions, managing security policies could be a rigid process. Zurich changes this by making policies always editable<\/strong>. This new flexibility allows security teams to adapt quickly to changes in security standards, business needs, or regulatory requirements. More importantly, this feature comes with robust version tracking<\/strong>, giving you a complete audit trail of every change made to a policy.<\/p>\n\n\n\n

The true game-changer, however, is the automated closure of related test results<\/strong>. When a new policy version is published or a policy is deleted, the system can be configured to automatically close all associated security findings (test results).<\/p>\n\n\n\n

This functionality streamlines policy management and ensures that your security findings are always aligned with the latest policies. It eliminates the manual, time-consuming task of cleaning up outdated findings, allowing your security team to focus on relevant, high-priority issues.<\/p>\n\n\n\n

Enhanced asset search and CMDB filtering<\/h3>\n\n\n\n

One of the most notable improvements that came with the ServiceNow Zurich release for security analysts is definitely an enhanced asset search and CMDB filtering<\/strong>. The CMDB connection condition builder now includes powerful new criteria, such as:<\/p>\n\n\n\n