Verify CrowdStrike Falcon Insight profile trigger conditions

  • Freigeben Version: Australia
  • Aktualisiert 12. März 2026
  • 1 Minute Lesedauer

    • Test the profile and verify that the trigger condition filters that you have configured work as expected.

    Vorbereitungen

    Role required: sn_si.admin

    Warum und wann dieser Vorgang ausgeführt wird

    Activate the profile that is based on the configured trigger conditions you specified so that you can view the query results in the ServiceNow AI Platform security incidents.

    Prozedur

    1. Navigate to All > Security Incidents > Show All Incidents.
    2. Select New to create a security incident.
    3. To create a security incident, fill in the required information and click Save.
    4. Review the work notes and activities section to view the profile-initiated and profile-completed tags.Reviewing work notes for automation activity.
    5. Review the details in the CrowdStrike Falcon Insight Details related lists such as Get File, Host Details, Logged on Users, Running Processes, Running Services, Network Statistics, and so on.
      Review therelated lists for details.