Thank you for your feedback.
Form temporarily unavailable. Please try again or contact docfeedback@servicenow.com to submit your comments.
Versions
  • London
  • Kingston
  • Jakarta
  • Istanbul
  • Helsinki
  • Geneva
  • Store
Close
Home Kingston Security Incident Management Security Operations Security Operations common functionality Security Operations Integration Reference Integration capabilities Security Operations Integration - Sightings Search capability Sightings Search Configuration View Sightings Search Results Share Sightings Search results
  • Versions
  • Products

Contents

Share Sightings Search results

SAVE AS PDF
Other

Share Sightings Search results

You can share local sightings details or results that are associated with a particular search with your Trusted Security Circle.

Before you begin

Role required: sn_si.analyst

About this task

Sharing can be automated using the following Security Incident Response Properties.
  • Automatically share the results of a sightings search to the default ServiceNow trusted circle
  • Include observables with no local sightings when automatically sharing sightings search results
  • Respond with local sightings whenever a threat share is received from a trusted circle

Procedure

  1. Navigate to a security incident.
  2. Click the Show IoC related list and select the Sightings Search Results tab to view the list of sightings searches.
  3. Click on a sightings search result.
    Share Sightings Search link
  4. On the Sightings Search Result form, click the Share sighting search result related link.
    The Sighting Search Result Share dialog box appears.
    Sightings Search Result Share dialog box
  5. Enter a Name for this observable share record.
  6. Enter a Description of the observables to share.
  7. Choose Circles to share the observables with.
  8. Click Submit.
    The observable(s) are shared with the specified Trusted Circle.

This site is scheduled for a small content update on Tuesday, December 18th, between the hours of 4:00pm and 8:00pm Pacific Time (Dec 19 00:00 – Dec 19 4:00 UTC). Access to this site may be slightly delayed during that time.