Security Incident Response Notification ConfigurationIssue Information about what triggers the following Security Incident Response notifications can be found below. Click on a notification name to learn more. sir.task.changed - Notification - Security Incident Response Task changedsir.incident.email.creation - Notification - Security Incident created, emailsir.request.email.creation - Notification - Security Request created, email You were not able to find Business rule, Script include or Workflow which triggers the events. Event registry table has empty "fired by" Field. Notification is not working as these event not trigger. sir.task.changed As the sn_si_task table extends sm_task table and so the notifications are fired through the Business Rule below:https://<instance_name>/nav_to.do?uri=%2Fsys_script.do%3Fsys_id%3D7006cc30d7313100561583e80e6103ed%26sysparm_record_target%3Dsys_script%26sysparm_record_row%3D1%26sysparm_record_rows%3D1%26sysparm_record_list%3DscriptCONTAINSsm.task.changed%5EORDERBYnameThe notification event is called programmatically through a business rule on the sm_task table: Notification for task. It is programmatically called by configProcessor.sendNotifications(current, previous, "sm.task.changed");This sm.task.changed will eventually call the associated notification from that configuration page that you can find in the Security Incident Configuration module. It is under Security Incident > Administration > Configuration. sir.incident.email.creation Based on a search in the Background Script, the following Inbound Email Actions that create security incident that triggers sir.incident.email.creation in the script: https://<instance_name>/nav_to.do?uri=%2Fsysevent_in_email_action_list.do%3Fsysparm_query%3Dsys_idIN0f97c663ff123100158bffffffffff84,c797c663ff123100158bffffffffff84 sir.request.email.creation Based on a search in the Background Script, the following Inbound Email Actions that create security request that triggers sir.request.email.creation in the script: https://<instance_name>/nav_to.do?uri=%2Fsysevent_in_email_action_list.do%3Fsysparm_query%3Dsys_idIN976c235bdf02020068c32df36bf263aa,bdbfab5bdf02020068c32df36bf263cf