---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/security-management

 Release :

    - australia

ft:locale :

    - pt-BR

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Using Sighting Search Parameters

# Using Sighting Search Parameters {#ariaid-title1}

* Versão de lançamento: Australia
* 
* Atualizado 12 de mar. de 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 min. de leitura

You can use sighting search parameters that define more complex queries, which include logic and other operators supported by the specified log store.

## View Sighting Search Parameters {#manage-sighting-search-parameters__section_osj_lv3_pzb}

Role required: sn_sec_tisc.admin  
To view the sighting search parameters, perform the following steps:

1. Navigate to WorkspacesThreat Intelligence Security CenterIntegrations.
2. From the Integrations page, navigate to Enrichment IntegrationsSighting Search.
3. Look for the integration for which you want to view the Sighting Search Configuration, and click Edit.
4. Select the Sighting Search Configurations tab.

   You can view the list of sighting search configurations.
5. Click on the required Sighting Search Configuration to view the details of the configuration.

6. Select the Sighting Search Parameters tab.

   You can view the list of sighting search parameters.
7. Click on the required Sighting Search Parameter to view the details of the parameter.
8. You can also perform the following actions on the Sighting Search Parameters tab:
   1. To refresh the list of sighting search parameters, click ![Refresh option]() icon.
   2. To perform a list action on the sighting search parameters, click the ![List actions]() icon.

      Edit columns: You can use this action to add or remove existing columns and modify the order according to your requirements.
   3. To filter sighting search parameters based on conditions, click the ![Filter panel]() icon.

      The value 1 indicates that one condition is used for the filtering.
   {#manage-sighting-search-parameters__ol_urc_n33_pzb}
{#manage-sighting-search-parameters__ol_rsq_vv3_pzb}

## Create Sighting Search Parameter {#manage-sighting-search-parameters__section_nbc_nv3_pzb}

`Example for query generation`

    Configured Query: ${Observable}​

    Observables Substitutes for Sightings search: Obs1 , Obs2​

    Query: {Before each Value}Obs1{After each Value}{Between each value}{Before each Value}Obs2{After each Value}​

    ​

    Let observables are: 172.32.31.41 & 192.168.10.12​

    Query Formed with below configuration will be: "ip_address = 172.32.31.41 OR ip_address = 192.168.10.12"

To create a sighting search parameter, perform the following steps:

1. Navigate to WorkspacesThreat Intelligence Security CenterIntegrations.
2. From the Integrations page, navigate to Enrichment IntegrationsSighting Search.
3. Look for the integration for which you want to view the Sighting Search Configuration, and click Edit.
4. Select the Sighting Search Configurations tab.

   You can view the list of sighting search configurations.
5. Click on the required Sighting Search Configuration to view the details of the configuration.
6. Select the Sighting Search Parameters tab.

   You can view the list of sighting search parameters.
7. To create a sighting search parameter, click New.

8. On the form, fill the fields.{#manage-sighting-search-parameters__table_zw2_g53_pzc__entry__2}

   | Field | Description |
   |-|-|
   | After each value | The sighting search parameter after each observable when the search query is generated. |
   | Between each value | The sighting search parameter between each observable when the search query is generated. For example, OR. |
   | Before each value | The sighting search parameter before each observable when the search query is generated. |
   | Configuration | The configuration details of the search parameter. |
   | Observable type | Defines the type of observable category. |
   | Substitution variable | Specifies the name of the variable that is replaced by an observable value. |
   [Tabela 1. Create a sighting search parameter]

   {#manage-sighting-search-parameters__table_zw2_g53_pzc}
9. Click Save.
{#manage-sighting-search-parameters__ol_dq3_5fj_pzb}