---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# View Sightings Search Data

# View Sightings Search Data {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Review the aggregate data of all sighting searches.

## Before you begin

Role required: sn_si.analyst

## Procedure

1. Navigate to a security incident.
2. Select the Sightings Search Data tab from Show All Related Lists Related List group to view the list of sightings searches.  
   Note:  
   This data can be shared with Trusted Security Circle.  
   {#view-sightings-search-data__table_lg3_dm5_vy__entry__2}

   | Result | Description |
   |-|-|
   | End date range | Time to stop looking for sightings. |
   | External Sightings | Aggregated count of external sightings. (Received from threat sharing.) |
   | Internal Sightings | Aggregated count of internal sightings. |
   | Is Local | Indicates whether the sightings came from the current or a shared environment. |
   | Observable | List of all observables searched for by query. |
   | Sighting count | Number of sightings searched for. |
   | Sighting search | Sightings Search identifier. |
   | Sighting search detail | Aggregate detail of the sighting search. |
   | Sighting search link | Link pointing to the Sighting search portal. The search query is automatically applied upon clicking the Sighting search link. |
   | Sighting search query | Query to identify the instance. 172.10.0.171 is substitutable and gets substituted in the observable selected. (search 172.10.0.171 \| head 10) Note: Selection of days will not be applicable to Saved search. |
   [Table 1. Sightings Search Data]

   {#view-sightings-search-data__table_lg3_dm5_vy}