Set up a profile for manual event forwarding
Depending on the profile defined, Splunk ES notable events are forwarded manually as discrete notable events into the Security Operations environment of your ServiceNow AI Platform instance.
To set up a profile for manual forwarding of notable events:
| Task | Section |
|---|---|
| Create an event profile | See Create a profile |
| Map notable event fields | See Explore Mapping |
| Create custom mappings | See Create mappings for Splunk ES notable event incident review and contributing event details (manual forwarding) |
| Preview the security incident | See Preview security incident |
| Set up your Splunk environment for manual ingestion | Create a profile |
| Automate notable event updates and closure based on SIR incident status | See Automate notable event updates and closures |