Skip to content
CrowdStrike Next-Gen SIEM integration › Security Incident Response integrations › Security Incident Response › Enterprise security case management applications › Security Operations
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Automate detection updates and closures

Automate detection updates and closures based on the Security Incident Response incident status. The CrowdStrike Next-Gen SIEM integration enables detections to create security incidents and also to update the incidents after they are created or closed.

Before you begin

Role required: sn_si.ingestion_profile_admin

Note: Users with the sn_si.admin role can perform all operations available to a profile admin because the sn_si.admin role inherits the required permissions by default.

Procedure

  1. If you are not continuing from the previous section of the Scheduling process, access the profile you are defining.

    1. Navigate to All > CrowdStrike Next-Gen SIEM > Detection Profile.

    2. Select the profile you are continuing to define.

    3. Select Additional Options in the progress bar.

  2. On the form, fill in the fields.

    CategoryFieldDescription
    Security Incident Creation UpdatesUpdate CrowdStrike Next-Gen detection Status upon SIR Incident CreationOption to use the automated detection update functionality. The CrowdStrike Next-Gen SIEM detection status is updated in CrowdStrike Next-Gen SIEM detection with the comments after the SIR incident is created in the ServiceNow AI Platform.
    Initial detection status updateInitial detection status that is updated in the CrowdStrike Next-Gen SIEM environment, either New or In Progress.
    Initial comments posted back to detectionInitial comments that are posted to the detection in the CrowdStrike Next-Gen SIEM environment.
    Detection Closure UpdatesClose CrowdStrike Next-Gen detection upon SIR Incident ClosureOption to use the automated detection status update functionality. CrowdStrike Next-Gen SIEM detections are closed in the CrowdStrike Next-Gen SIEM portal with the comments given after the SIR incident is closed in the ServiceNow AI Platform.
    Closure detection status updateStatus update in the CrowdStrike Next-Gen SIEM detection when the security incident is closed in SIR.
    Closure Comments Posted back to detectionComments posted to the detection in the CrowdStrike Next-Gen SIEM detection when the security incident is closed in SIR.
    Pull Closed detectionsPull Closed detectionsOption to fetch closed detections during ongoing ingestion and one-time retrieval. Closed SIR incidents will not be updated with new data from CrowdStrike Next-Gen SIEM
    Detection Comments and SIR Work notes synchronizationUpdate SIR Automation Activity with CrowdStrike Next-Gen detection commentsOption to update your CrowdStrike Next-Gen SIEM comments in the SIR Automation Activity. The comment in the SIR Automation Activity appears with the prefix Comment from CrowdStrike.
    Update CrowdStrike Next-Gen SIEM detection comments with SIR work notesOption to update your SIR work notes in the CrowdStrike Next-Gen SIEM detection comments. The comment in CrowdStrike Next-Gen SIEM appears with the prefix Comment from ServiceNow.

  3. Select Finish.

  4. Activate the profile.

    1. Select the Name section of the progress bar.

    2. Select the Active check box.

    3. Select Continue.