Will SIRs be restored when ServiceNow instance is disrupted

[sath]

Hi,

ServiceNow prod instance went down for a while. Does this kinds of disruption cause SIR to miss security incidents or do they get backlogged and generate when service is restored?

[Satishkumar B]

@sath When a ServiceNow instance goes down, any security incidents generated during the outage will be processed and created once the service is restored, assuming the incidents are still available in source systems. However, if incidents were lost or not captured due to the disruption, some incidents might be missed.

…………………………………………........................................................................................
Please Mark it helpful 👍and Accept Solution ✅!! If this helps you to understand.

…………………………………………........................................................................................

[sath]

@Satishkumar B  By source systems, are you referring to Splunk or Azure systems that we use to capture events to security incidents? And how does the incidents will be restored once service is restored, is there any process that if follows?

Also, you said "if incidents were lost", does that mean if events are not created from Splunk to ServiceNow due to disruption?