Start a conference call in Security Incident Response

Security Incident Response > <a class="link" href="../../../product/secops-analyst-workspace/reference/sir-workspace-landing-page.html" title="The ServiceNow Security Incident Response Workspace is a reimagined interface that provides a next-gen user experience for the security analysts and SOC managers. The security analysts can use this to manage the life cycle of security incidents from an initial analysis to containment, eradication, and recovery.">Security Incident Response Workspace > Using SIR Workspace > Working with Security Incident Records >

Using conference call, security analysts can collaborate with other analysts and affected users in real-time. These calls facilitate the exchange of information to help resolve incidents.

Make sure you’ve done the installed and activated the following apps and plugins: Notify plugin (com.snc.notify). Notify UI Components for Configurable Workspaces app. Visual Task Board plugin (com.devsnc.snb_vtb)

Role required: sn_si.analyst or sn_si.manager

Navigate to Workspaces > Security Incident Response Workspace . Open a security incident for which you want to initiate a conference call. Select Collaborate , and then select Start a Call , or you can select the conference call icon and then select the + icon. The Start conference call pop-up appears.

Select a conference bridge in the Conference bridge field. Provide a title for the conference call in Title . Note: By default, the title of the incident is populated as the title of the call. You can modify the default title.

Add or remove call participants in Add participants . Note: Based on the configuration in Conference Call settings, a pre-populated list of participants is added to Add participants or a Recommendations list of participants is available. For more information, see Manage Conference Call users and groups .

Provide a brief description for starting the conference call. Select Start . The conference call starts in the selected conference bridge. All the participants receive notification through email and through the conference bridge. The participants can use the link or notification to join the call.

Open the associated incident in Security Incident Response application to view the conference call details. Optional: Select Copy invite to add participants in an active call. Select End call . When the final participant leaves the conference call, the call ends Optional: To restart a conference call, navigate to the Completed section and select the Reinitiate option of the required conference call.

Parent Topic: Collaborate using conference call or chat in Security Incident Response