---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Security Operations Integration - Sightings Search Flow

# Security Operations Integration - Sightings Search Flow {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Security Operations Integration - Sightings Search flow is a high-level flow independent of integrations. It uses the configured queries to search for a set of observables based on the configured
integrations which support the capability. Use it to fulfill an integration such as Splunk or Elasticsearch.

## Before you begin

Role required: sn_si.analyst

## About this task

If a security incident has an observable attached to it, this flow is triggered when you click on Run Sighting Search in the Actions on selected rows... drop-down menu in the
Security Incident Observables tab.  
Figure 1. Sightings Search

Activities specific to this flow are described here. For more information on other activities, see [Common Security Operations integration flows and orchestration activities](https://www.servicenow.com/docs/0QdgUFam~XYP1p38XC3fCg "Many of the flows associated with third-party integrations include the same activities. For example, activities for beginning and completing processing.").
* **[Sightings Search - Determine Observables activity](https://www.servicenow.com/docs/Fcp~ONtEJ8JZ_zzjyM2SPA)**   
  The Sightings Search - Determine Observables workflow activity determines which observables to include in the workflow.
* **[Persistent Observable Sightings activity](https://www.servicenow.com/docs/PPhCfWXoEIIMQEuRmPPlDQ)**   
  The Persistent Observable Sightings workflow activity retrieves observables from the third-party integration.
* **[Get Observable Sightings Queries activity](https://www.servicenow.com/docs/7p4jALbpe4rWELaGh12c4Q)**   
  The Get Observable Sightings Queries workflow activity retrieves queries from the integration configuration.
* **[Security Operations - Arcsight Logger Sightings Search Flow](https://www.servicenow.com/docs/Tk9i9umUUQQRav7539QA_A)**   
  Security Operations - ArcSight Logger Sightings Search flow is the implementation for the Splunk integration launched by the Security Operations Integration - Sightings Search Flow.
* **[Security Operations - Elasticsearch Sightings Search Flow](https://www.servicenow.com/docs/dyx52_AT_OcBW__jv5Jt1Q)**   
  Security Operations - Elasticsearch Sightings Search flow is the Elasticsearch implementation launched by the Security Operations Integration - Sightings Search flow.
* **[Security Operations - McAfee ESM Sightings Search Flow](https://www.servicenow.com/docs/SOSCEfJZlhZCIIZx~UZYYQ)**   
  Security Operations - McAfee ESM Sightings Search flow is the implementation for the McAfee Sighting Search implementation launched by the Security Operations Integration - Sightings Search Flow.
* **[Security Operations - QRadar Sightings Search Flow](https://www.servicenow.com/docs/BWJr_Yn2LfMSzu3wcRlyvg)**   
  Security Operations - QRadar Sightings Search flow is the implementation for the IBM QRadar integration launched by the Security Operations Integration - Sightings Search flow.
* **[Security Operations Integration - Splunk Sightings Search Flow](https://www.servicenow.com/docs/KIQ~1fpHwnXp6akCe2pC5w)**   
  Security Operations - Splunk Sightings Search flow is the implementation for the Splunk integration launched by the Security Operations Integration - Sightings Search flow.