--- sourceDocument: Australia Security Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Integration architecture and external systems connection # Integration architecture and external systems connection {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Integration architecture and external systems connection This integration architecture supports the ingestion of triggered alerts from the Splunk Enterprise console into the ServiceNow AI Platform, specifically for use with the Security Incident Response (SIR) application. It enables automated pulling of triggered alerts and associated events from Splunk to create and update security incidents within ServiceNow. The integration requires initial setup before installing the application from the ServiceNow Store and includes optional components like the ServiceNow Splunkbase Addon for manual event forwarding. Show full answer Show less ## Key Features * **Triggered Alert Ingestion:** Automatically pulls triggered alerts and related events from Splunk Enterprise or Splunk Cloud into ServiceNow AI Platform to create security incidents. * **Event Profile Configuration:** Allows creation of event profiles which define how and when Splunk alerts are retrieved, mapped to SIR incident fields, scheduled for retrieval, and activated. * **Alert Field Mapping and Preview:** Provides default field mappings between Splunk alerts and SIR security incidents that can be customized and previewed to ensure completeness. * **Aggregation of Alerts:** Enables aggregation of new triggered alerts into existing security incidents based on matching criteria, preventing duplicate incidents and ensuring updated incident records. * **MID Server Usage:** Facilitates communication between ServiceNow and on-premises Splunk instances; not required for Splunk Cloud integration. * **Splunk API Integration:** Uses Splunk API via outbound HTTPS from the MID Server for reliable data retrieval. * **Profile Export/Import:** Supports exporting and importing event ingestion profiles between ServiceNow instances to streamline deployment and reuse configurations. ## External Systems Connection The integration requires establishing an event profile that specifies the connection and criteria for pulling alerts from Splunk. After alerts are ingested, users with appropriate roles can select which alerts create or update security incidents. Scheduling and activation of profiles automate ongoing ingestion of current and historical alerts. ## Practical Setup Considerations * Installation of the ServiceNow Event Ingestion Integration add-on is required on the Splunk console or Splunk Cloud instance. * For on-premises Splunk, a MID Server must be configured to enable secure communication. * Saved searches in Splunk must be configured by a Splunk administrator to identify relevant alerts. * Script editor tools are available to format alert field values during mapping for accurate incident creation. * Role assignments such as security incident admin, analyst, and profile admin control configuration, analysis, and management of the integration and security incidents. ## Benefits for ServiceNow Customers * Streamlines security incident management by integrating Splunk alert data directly into ServiceNow's Security Incident Response workflows. * Reduces manual effort and error by automating alert ingestion and incident creation. * Improves incident accuracy and context through customizable field mappings and aggregation features. * Supports scalable deployment with capabilities to manage multiple Splunk connections and reuse configurations across instances. The following topic outlines the integration architecture developed to support the ingestion of triggered alerts from the Splunk Enterprise console. This information clarifies, at a high level, the conceptual operation of the integration. It also explains why there are setup steps that are required prior to installing the application from the ServiceNow Store. ## Key terms used for this integration {#splunk-event-ingest-integration-architecture__section_ns1_3l4_n2b} The following key terms are used during the installation and configuration. For more information about these terms, see the [ServiceNow Product Documentation website](https://www.servicenow.com/docs) and the [Splunk website](https://www.splunk.com/) and resources on [Splunk Resources](https://www.splunk.com/en_us/resources/getting-started.html) page. ServiceNow AI Platform : An enterprise ServiceNow product. The ServiceNow AI Platform is the base upon which individual components such as Security Incident Response (SIR), IT Service Management (ITSM), and other products are built. ServiceNow Splunkbase Addon : A ServiceNow application that is installed on your Splunk Enterprise console that supports the manual event forwarding option of the integration. Manual event forwarding is an optional feature of the integration. This ServiceNow Splunkbase addon is not required for the automated alert ingestion that is provided by the integration. Security Incident Response (SIR) : A ServiceNow AI Platform application that tracks the progress of security incidents from discovery and initial analysis, through containment, eradication, and recovery, and into the final post incident review and closure. Splunk Enterprise : An automated security incident event management (SIEM) product or cloud service that collects data used for incident analysis and management. This service is on a host that is sometimes also referred to as a Splunk console in this guide. Splunk alert : A search that you configure and save in Splunk to scan for specific data based in the parameters you set up in the Splunk Enterprise service. When you pull alerts from Splunk, you also pull all the events associated with that alert. Splunk triggered alert : A configured search in the Splunk Enterprise console that returns results and flags these results as triggered alerts. The triggered alerts are ingested from the Splunk console into your ServiceNow AI Platform instance for this integration. Triggered alerts have one or more Splunk events. Splunk event : One or more data elements that result in the triggered alerts of the Splunk service. From your ServiceNow AI Platform instance, you can look up which Splunk events triggered ServiceNow AI Platform security incidents. MID Server : This application facilitates communication and movement of data between the ServiceNow AI Platform and external applications, data sources, and services. This application is typically required for integration with on-premises technologies, and, for this Splunk Enterprise Event Ingestion integration, the MID Server facilitates communication between the ServiceNow AI Platform and the on-premises instance of Splunk Enterprise. A MID Server is not required if you are integrating your ServiceNow AI Platform instance with a Splunk Cloud instance. Security incident admin (sn_si.admin) : The user with this role oversees the configuration of the integration with the SIR product in your ServiceNow AI Platform instance. Security incident analyst (sn_si.analyst) : The user with this role interacts with and analyzes security incidents in the ServiceNow Security Incident Response product. Security incident profile admin (sn_si.ingestion_profile_admin) : The user with this role configures the plugin, create, edit, delete and maintain ingestion profiles for Azure Sentinel, Splunk and Splunk ES Integration for the SIR product in your ServiceNow AI Platform instance. ## External systems connection {#splunk-event-ingest-integration-architecture__section_yzp_p44_n2b} An event profile is a container that you create, name, and configure for a singular connection and call to the Splunk service to pull the most current triggered alerts that match specific criteria. After triggered alerts that match your profile have been pulled from Splunk, you select which of these alerts you want displayed as a ServiceNow AI Platform Security Incident Response SIR security incident. A default view of the Splunk Enterprise alert fields is available, and you edit this mapping of alert fields to the fields on a SIR security incident to meet your needs. You preview your mapping to verify that you have all the required alert field values populated on the SIR security incident. To complete the configuration of the alert profile, you schedule the retrieval of alerts and then activate the profile. After you activate the profile in the ServiceNow AI Platform, you are ready to ingest historical and on-going Splunk alerts automatically. As a user with the sn_si.admin role, if you determine that a new triggered alert is similar to alerts previously ingested, you can aggregate new triggered alerts to existing SIR security incidents. You set criteria to specify matching target field values in the Splunk Enterprise alert profile that define when an existing security incident is updated and when a new security incident is created. If the aggregation feature is enabled in your event profile, when the import set is transformed, your ServiceNow AI Platform instance checks for an existing record in the target table that has the same value in the target and source fields. If an existing record with a matching value in the target table is found, that record is updated. If no matching record is found, a new record is created in the target table. If enabled, the aggregation option updates existing security incidents with new triggered alerts, and you avoid creating multiple security incidents. For more information about updating records using aggregation options, see [Updating records using coalesce](https://www.servicenow.com/docs/access?context=c_ImportSetCoalesce&version=australia&pubname=australia-integrate-applications&ft:locale=en-US). This application uses the Splunk API service to retrieve information from the Splunk service. An outbound HTTPS connection from the MID server to this environment is necessary for the integration to work properly. After it is connected to the Splunk service, the integration supports the pulling and ingestion of triggered alerts and events that trigger security incidents. The basic data flow is illustrated in the following figures. In each figure, your ServiceNow AI Platform is pulling (ingesting) data. Splunk is not pushing data for scheduled alerts. Figure 1. Connection to on premises Splunk enterprise service with single MID server Figure 2. Connection to a Splunk enterprise cloud instance Figure 3. Multiple connections to the Splunk enterprise service using multiple MID servers * **[Copy Splunk Enterprise Event Ingestion profiles from one instance to another using export/import functionality](https://servicenow-prod.fluidtopics.net/Mr0bsoGrsIiH5FfrWGTZFg)** You can export and import Splunk Enterprise Event Ingestion profiles settings from one ServiceNow AI Platform instance to a different ServiceNow AI Platform instance. * **[Copy an event profile for the Splunk Enterprise Event Ingestion integration](https://servicenow-prod.fluidtopics.net/8ZmGADviGEAxOLbeBYPkYQ)** Copy an existing profile and its associated settings instead of creating new profiles. If you're creating multiple profiles, and you want to reuse the settings of an existing profile, you might prefer to copy alarm profiles to save time. * **[Set up ServiceNow Event Ingestion Integration add-on](https://servicenow-prod.fluidtopics.net/bilmNKpYai8R3CQx9ZTJmw)** Install and set up the ServiceNow Event Ingestion Integration add-on in your Splunk enterprise console or Splunk Cloud instance. * **[Using ServiceNow Event Ingestion Integration add-on](https://servicenow-prod.fluidtopics.net/adQQYrmU2~rBnVmEIEquzA)** Map alerts from Splunk console to create a Security Incident Response (SIR) on the ServiceNow instance. * **[Save searches in your Splunk Enterprise console for the Splunk Enterprise Event Ingestion integration](https://servicenow-prod.fluidtopics.net/0VDphX3DlcGaqk1W8jcgWQ)** The following steps for saving searches in your Splunk Enterprise console are provided for a user with the Splunk Enterprise administrator role. * **[Use the script editor to format alert values for the Splunk Enterprise Event Ingestion integration](https://servicenow-prod.fluidtopics.net/29HdmbD6tHKEf8WYQ5FIvw)** Use the script editor to format field values on the security incident during the mapping step. * **[Checklist for the Splunk Enterprise Event Ingestion integration](https://servicenow-prod.fluidtopics.net/rlWVUu3g4c5PH_q44xuvug)** Use this checklist to guide you through all the tasks of the integration. The following checklist includes setup and installation tasks and examples of use cases that include expected results for the integration. **Previous topic:** [Schedule and retrieve alerts for the Splunk Enterprise Event Ingestion integration](https://servicenow-prod.fluidtopics.net/QzEbpAlPeGW5QVBXYujLJQ "For automated alert ingestion profiles, this step is final step of the event profile configuration. During this step, you can verify the default settings for alert retrieval or modify the scheduling as needed. This step permits you to filter your alert retrieval based on a date range.") **Next topic:** [Copy Splunk Enterprise Event Ingestion profiles from one instance to another using export/import functionality](https://servicenow-prod.fluidtopics.net/Mr0bsoGrsIiH5FfrWGTZFg "You can export and import Splunk Enterprise Event Ingestion profiles settings from one ServiceNow AI Platform instance to a different ServiceNow AI Platform instance.")