---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Select correlation events

# Select correlation events for ArcSight ESM event ingestion
integration {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Based on the ArcSight ESM source and the Query Viewer configured,
select a correlation event rule for the profile.

## Before you begin

Role required: sn_si.admin

## About this task

View the available correlation events listed in the Correlation Event Selection in your ServiceNow AI Platform instance so you can determine which correlation events you want to ingest and create security incidents. You can only select one correlation rule type from the list for each profile.

The Query Viewer ID and the
Query Viewer Name as specified in the Query Viewer form is displayed. Select a
correlation event from the list that you can use to create a configuration mapping
for the ingested correlated event.

Click on the drop down list in the
Correlation Events List field. A list of correlation events that are present in the
ArcSight ESM Query Viewer Console is displayed.

Click
Continue to proceed to the next step in the
wizard.