Automation alone carries 30 percent of CIS-SIR while five other domains share the rest. That lopsided blueprint should decide where your ServiceNow Security Incident Response study time goes.
ServiceNow CIS-SIR Study Guide: Security Incident Response
