Set up a profile for scheduled notable event ingestion
concept australia Updated Sep 10, 2026 1 min read splunk-event-scheduled-security.md
Depending on the profile defined, Splunk ES notable events are automatically ingested into the Security Operations environment of your ServiceNow AI Platform instance.
The following table shows the list of tasks you need to follow to set up a profile for scheduled ingestion of notable events:
| Task | Section |
|---|---|
| Create an event profile | See Create a profile |
| Select notable events based on correlation search name | See Set Correlation rules |
| Map notable event fields | See Explore Mapping |
| Create custom mappings | See Map notable events |
| Preview the security incident | See Preview security incident |
| Schedule and retrieve new and updated notable events | See Schedule and retrieve notable events |
| Automate notable event updates and closure based on SIR incident status | See Automate notable event updates and closures |
31 lines · 2.9 KB
--- title: Set up a profile for scheduled notable event ingestion description: Depending on the profile defined, Splunk ES notable events are automatically ingested into the Security Operations environment of your ServiceNow AI Platform instance. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/splunk-event-scheduled-security.html release: australia product: Security Incident Response classification: security-incident-response topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 1 breadcrumb: [Create an event profile, Splunk Enterprise Security event ingestion integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Set up a profile for scheduled notable event ingestion Depending on the profile defined, Splunk ES notable events are automatically ingested into the Security Operations environment of your ServiceNow AI Platform instance. The following table shows the list of tasks you need to follow to set up a profile for scheduled ingestion of notable events: |Task|Section| |----|-------| |Create an event profile|See [Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-create-profile-sched-security.md)| |Select notable events based on correlation search name|See [Set Correlation rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest-alert-selection-security.md)| |Map notable event fields|See [Explore Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest_mapping-security.md)| |Create custom mappings|See [Map notable events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest-map-alerts-security.md)| |Preview the security incident|See [Preview security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest-preview-security.md)| |Schedule and retrieve new and updated notable events|See [Schedule and retrieve notable events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest-schedule-security.md)| |Automate notable event updates and closure based on SIR incident status|See [Automate notable event updates and closures](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-additional-security.md)|
| title | Set up a profile for scheduled notable event ingestion |
| description | Depending on the profile defined, Splunk ES notable events are automatically ingested into the Security Operations environment of your ServiceNow AI Platform instance. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/splunk-event-scheduled-security.html |
| release | australia |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| breadcrumb | Create an event profileSplunk Enterprise Security event ingestion integrationSecurity Incident Response integrationsSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |