Install and configure

Install and configure the CrowdStrike Next-Gen SIEM integration for Security Operations application from the ServiceNow Store on your ServiceNow AI Platform instance.

시작하기 전에

Role required: sn_si.ingestion_profile_admin

주:

Users with the sn_si.admin role can perform all operations available to a profile admin because this role inherits the required permissions by default.

프로시저

1. Download the CrowdStrike Next-Gen SIEM integration from the ServiceNow Store and install it.
   For more information, see Download an application from the ServiceNow Store for the first time
2. Navigate to Security Operations > Integrations > Integration Configurations.
3. Search for the CrowdStrike Next-Gen SIEM integration tile, and select Configure.
4. On the form, fill in the fields.

   표 1. CrowdStrike Next-Gen SIEM integration form

   Field	Description
   Name	Name of the CrowdStrike Next-Gen SIEM integration.
   Client ID	The client ID that you obtain from the settings section of your account profile in the CrowdStrike portal.
   Client Secret	The client secret key that you obtain from the settings section of your account profile in the CrowdStrike portal.
   Region	Data center to pull data from. Specify the Region: US-1, US-2, EU-1, US-GOV-1, US-GOV-2 By default, the field is set to US-1

5. Select Submit.
   The configured integration tile displays.

다음에 수행할 작업

Create a detection profile