---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Configure CrowdStrike NextGen SIEM sighting search

# Configure CrowdStrike NextGen SIEM sighting search {#ariaid-title1}

Release version: Australia  
Updated August 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Configure the CrowdStrike NextGen SIEM integration with your
Falcon API credentials so that analysts can search CrowdStrike log data for activity that
matches an observable.

## Before you begin

Download CrowdStrike NextGen SIEM integration from the ServiceNow Store and install it.

Role required: sn_sec_tisc.admin  
Important:  
* Obtain the CrowdStrike API base URL, client ID, and client secret from your Falcon subscription.
* To add a link from each sighting back into the Falcon console, obtain the Falcon console URL. This URL is different from the API base URL.

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security Center.
2. Select IntegrationsEnrichment IntegrationsSighting Search.
3. Select Configure new enrichment.
4. In the configuration window, select CrowdStrike NextGen SIEM.
5. In Enrichment Integration, enter the Name and Description.  
   The Integration Category, Integration type, and Vendor Name fields are read-only.
6. Complete the integration configuration fields.  
   {#tisc-crowdstrike-ngsiem-integration__table_csngsiem_config_fields__entry__2}

   | Field | Description |
   |-|-|
   | CrowdStrike API Base URL | Base URL of the CrowdStrike API for your Falcon cloud region. |
   | Console URL | Base URL of the Falcon web console. Used only to build the sighting search link on each sighting so that an analyst can reopen the same search in Falcon. If this field is empty, no link is added. |
   | Repository | List of Falcon repositories to run the search, for example: * search-all * investigate_view * third-party * falcon_for_it_view * forensics_view * 3pi_parsers {#tisc-crowdstrike-ngsiem-integration__ul_ywg_2kc_hkc} |
   | Client ID | Client ID of the OAuth 2.0 client credentials grant. |
   | Client Secret | Client secret of the OAuth 2.0 client credentials grant. The value is stored encrypted. |
   | Max Result | Maximum number of log events that a sighting search returns. |
   | Default lookback period for automated runs (days) | Default number of days of log data that a sighting search covers. A run-time search window overrides this value. Default value is 7. |
   | Include raw data samples in search results | Select this option to store the matched raw events and attach them to the sighting record as a JSON file. When the option is cleared, only counts, and occurrences are kept. |
   [Table 1. CrowdStrike NextGen SIEM configuration fields]

   {#tisc-crowdstrike-ngsiem-integration__table_csngsiem_config_fields}  
   Note:  
   The API base URL, client ID, and client secret are required. The
   remaining fields are optional and fall back to their default
   values.
7. Save the configuration tile.
8. Select Enable to turn on the configuration.
{#tisc-crowdstrike-ngsiem-integration__steps_csngsiem}

## Result

When a sighting search against CrowdStrike NextGen SIEM finds a match, the result is saved as a Sighting record. Open the record to view the Sighting Configuration Items related list, which shows the
configuration items (CIs) associated with the sighting. The system uses <var class="keyword varname">ComputerName</var> if available; otherwise, it uses the <var class="keyword varname">host</var> field.

## What to do next

Select one or more CI rows from the Sighting Configuration Items list and select Add As Configuration Itemto link the selected CI(s) to the sighting's Observable record. These
records appear under the Related Configuration Items related list on the Observable form. For information on how to run a sightings search, see [Run Sighting Search](https://www.servicenow.com/docs/Rh_7IFDcqdqutqORRGGq0w "Perform Run Sighting Search related integration.").

*[\>]: and then