---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Explore

# Understand how trigger conditions work with a configuration item {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Understand how trigger conditions work with a configuration item

Trigger conditions in ServiceNow allow profiles to run automatically when specific conditions are met during a security incident.
This automation enhances response efficiency by integrating with FireEye capabilities and utilizing the Configuration Item (CI) field to match assets within the CMDB.
Show full answer Show less  

## Key Features

* **Automatic Profile Execution:** Profiles can run automatically when a security incident matches predefined trigger conditions.
* **Manual Profile Execution:** If no trigger condition is set, profiles can be executed manually through the incident form.
* **CI Field Usage:** The CI field on the security incident is used to match asset IDs with the CMDB, facilitating the retrieval of hostname and IP address.
* **Alternate CI Fields:** During profile configuration, you can select alternate fields for endpoint identification, ensuring profiles can run even when the CI field is not populated.

## Key Outcomes

By effectively using trigger conditions and alternate CI fields, ServiceNow customers can ensure that security profiles run efficiently, allowing for timely data retrieval from FireEye HX, enhancing incident management and response. This setup minimizes downtime and increases the likelihood of successful endpoint identification amidst varying data availability.  
After you create a profile and select the FireEye capabilities that you want the profile
to run, configure the profile settings so that it runs only when a set of specific conditions are
met.

You can set trigger conditions so the profile runs automatically whenever a security incident
matching the trigger condition is created. If the trigger condition is not set, these profiles
can be manually run by clicking the form 'Run EDR profile(s)' on the security incident, and
selecting the profile.

By default, the integration uses the Configuration Item (CI) field on the Security incident.
This value is used to match the IDs of your assets with the information stored in the Now
Platform CMDB. When a security incident is created, and a profile is run either automatically or
manually, the CMDB is searched to retrieve the hostname and/or IP address based on the value of
the CI field. The host name and or IP is used to resolve the Agent ID on FireEye HX to identify the endpoint.

In an ideal case, a matching value is found in the database, and data is gathered from the FireEye HX console for the matching asset. The data for various capabilities are
pulled into your ServiceNow AI Platform instance and displayed in the related lists of a security
incidents. When the Configuration item (CI) field is not populated on the security incident with
a host name, or an IP address that matches the database, you can select an alternate field on the
security incident that contains either the host name or the IP to perform the Agent ID
resolution.

During the configuration step of the profile setup, you can select an alternate CI field for
endpoint identification to ensure that the you are able to identify the endpoint on FireEye HX. You can select any field on the security incident as an alternate CI
trigger field including custom fields that you create. By selecting this alternate CI field as a
backup, you ensure that your profiles run even if the CI field is not populated on the associated
security incident upon incident creation.  
Note:  
The alternate CI fields are considered only for capabilities that could be added to a profile. For all the additional actions, the alternate CI is picked from the default settings page.