---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Setup IBM QRadar profile

# Setup IBM QRadar profile {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

As a user with the sn_si.admin role, you create an offense profile in your ServiceNow AI Platform instance and determine which offenses create security incidents.
Before ServiceNow AI Platform
Security Incident Response (SIR) security incidents are
created from offenses, the field values from offenses are displayed on a layout of a ServiceNow AI Platform security incident so that you can preview how the actual security
incident will be created.

## Before you begin

Role required: sn_si.admin

## About this task

From an integration perspective using available APIs, IBM QRadar
offenses are automatically ingested into the Security Operations environment of
your ServiceNow AI Platform instance depending on the profile type defined. The
integration workflows ingest different types of offenses such as unauthorized access
attempts and malware, for example. These offenses are ingested based on the profiles
that you configure in the Security Operations environment of your instance. All
offenses are initially ingested for a configured offense type in a profile. Ingested
offenses can then be further filtered to specify which offenses create security
incidents. For example, you may prefer filters that create security incidents only
for offenses that are identified as high-risk. Before a profile is activated, and it
creates security incidents from ingested offenses, individual field values on the
offenses are mapped to corresponding fields on a layout of security incident for a
preview.

Names for the offense profiles in your ServiceNow AI Platform instance must be
unique. You can create multiple configurations for multiple sources and you can also
create multiple profiles for a single source.