---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# HPE ArcSight Logger - Incident Enrichment integration

# HPE ArcSight Logger - Incident
Enrichment integration {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The HPE ArcSight Logger -
Incident Enrichment integration searches your logs and adds relevant sighting information to
your security incidents.

|-|-|
| Explore [Security Incident Response integrations](https://servicenow-prod.fluidtopics.net/RhaRoT0Fn_2fkoMqo0mGDA "Security Incident Response (SIR) integrates with third-party security tools to create security incidents.") | Set up * [Get started with the HPE ArcSight Logger](https://servicenow-prod.fluidtopics.net/w51S77cHjTvr85W_qaF38w "HPE ArcSight Logger streams real-time data and categorizes them into specific logs and easily integrates with Security Operations. Before you can use the HPE ArcSight Logger - Incident Enrichment integration, you must download it from the ServiceNow Store and add API URL and login credentials.") * [Create sightings search configuration records](https://servicenow-prod.fluidtopics.net/~C_EZsSWY13JtBYZ0oNFWA "Create multiple sightings search configuration records and use them while querying multiple log stores or varying the search parameters.") {#arcsight-logger-landing-page__ul_kmj_mrn_lw} |
| Use * [Run a Sightings Search](https://servicenow-prod.fluidtopics.net/PhrwoCC1EliI1442kisZFw "Determine the prevalence of a threat over time or test remediation or eradication efforts. You can select individual or multiple observables and the date range for your search from a security incident. Results are included in the Security Incident Observables related list.") * [Security Operations Integration - Sightings Search Flow](https://servicenow-prod.fluidtopics.net/h_dAICTJQ0lbJ~eF~zxSLA "Security Operations Integration - Sightings Search flow is a high-level flow independent of integrations. It uses the configured queries to search for a set of observables based on the configured integrations which support the capability. Use it to fulfill an integration such as Splunk or Elasticsearch.") * [Security Operations - Arcsight Logger Sightings Search Flow](https://servicenow-prod.fluidtopics.net/FQJwjT30bP8xH1D85Mf~6w "Security Operations - ArcSight Logger Sightings Search flow is the implementation for the Splunk integration launched by the Security Operations Integration - Sightings Search Flow.") * [View Sightings Search Details](https://servicenow-prod.fluidtopics.net/30fRGbtB5hByCzMuxWAS~Q "Review the aggregate details of all sighting searches.") * [View Sightings Search Results](https://servicenow-prod.fluidtopics.net/Lu11DWRNYB~z1UzlENAuSw "You can review Sightings Search Results for internal and external malicious indicators.") {#arcsight-logger-landing-page__ul_qkh_cpj_dx} | Develop * [ServiceNow Security Operations integration development guidelines](https://servicenow-prod.fluidtopics.net/bvG2Jf6vlu8fw3IEOvGdMg "The ServiceNow platform provides several mechanisms for developing integrations with external systems. The ServiceNow Security Operations product suite adds integration capabilities intended to streamline the process of integrating with security-focused external systems.") * [Tips for writing integrations](https://servicenow-prod.fluidtopics.net/WrftS4_aOuJx7CfDqNBj1g "Avoid some of the pitfalls you can encounter when writing your own integrations by following these guidelines.") * [Developer training](https://developer.servicenow.com/app.do#!/training/landing) * [Developer documentation](https://developer.servicenow.com/app.do#!/documentation) * [Find components installed with an application](https://www.servicenow.com/docs/access?context=find-components&version=australia&pubname=australia-platform-administration&ft:locale=en-US) {#arcsight-logger-landing-page__ul_zsn_wnv_qx} |
| Troubleshoot and get help * [Integration troubleshooting](https://servicenow-prod.fluidtopics.net/_DwvxRbS3tQogK5A_dB8UQ "These troubleshooting suggestions can help you resolve common issues you can encounter when setting up or running integrations.") * [Ask or answer questions in the Security Operations community](https://community.servicenow.com/community/security-operations) * [Search the Known Error Portal for known error articles](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0597477) * [Contact Customer Service and Support](https://support.servicenow.com/now?draw=case) {#arcsight-logger-landing-page__ul_zyk_3j4_qx} |   |
[ ]

{#arcsight-logger-landing-page__simpletable_g33_wwg_vt}