---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Format alert values

# Use the script editor to format alert values for the Splunk Enterprise Security
Event Ingestion integration {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

In addition to the directly mapped fields from the ingested notable event values, and
the values you enter manually, use the script editor to format field values on the security
incident during the mapping step.

## Before you begin

Role required: sn_si.ingestion_profile_admin  
Note:  
Users with the sn_si.admin role can perform all operations available to a profile admin, as the sn_si.admin role inherits the required permissions by default.

## About this task

In certain cases, Splunk Enterprise Security notable event values are mapped to
the Category, Configuration item (CI), and Observable fields on the SIR incident are not supported. You might prefer to edit
the mapped values. If you want to translate the value of a Splunk Enterprise Security notable event to a value that is supported by these
fields on the SIR security incident, use the script
editor.

## Procedure

1. With the mapping form displayed, click the link to open the script editor.  

   <br />

2. From the choice list, select a destination field for the value that you want to edit.
3. Alternatively, in the SIR Incident Field Mapping section, click the bracket icon <kbd class="ph userinput">[{}]</kbd> next to a field to open the script editor for that field.  
   In certain instances, a script include may be appropriate for the Configuration
   item field. For an notable event, for example, a value for the Configuration item
   may not be matched.

   As shown in the following figure, if a match for a host name cannot be found in
   the ServiceNow AI Platform® CMDB for the Configuration item field, you
   can edit the rule so that if an IP address is found, it populates the
   Configuration item field. If there is no value for the alarm, the field on the
   security incident is set to null.  
   The editor opens with the field displayed in Destination Field. The following image shows the editor with the Configuration item field as the Destination Field.  

   <br />

4. Enter any changes to then script, and click Update to save your changes.  
   The Splunk Field Translations table is displayed.
5. Close the table to return to the Mapping form.
{#splunk-event-ingest_script_editor-security__steps_lrm_wvh_5gb}