---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Create profile

# Create a capability profile {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Create a profile and select the CrowdStrike Falcon Insight capabilities that you want the profile to run.

## Before you begin

Role required: sn_si.admin

## About this task

Consider why you want to create a profile before you add CrowdStrike Falcon Insight capabilities to it. The following table lists the capabilities that you must add to a profile when you want the profile to perform certain queries or actions.  
You can create a single profile that runs queries for Host details, lists logged-in users, fetches running services, fetches running processes, fetches network statistics, isolates the host, and removes the isolated host. Alternatively, you can create multiple profiles, each with its own single capability.  
Note:  
Isolate host, remove isolation, and get file capabilities cannot be merged with any other capabilities while creating a profile.
{#create-a-capability-profile-for-the-crowdstrike-falcon-insight-integration__table_sqk_k1h_p4b__entry__2}

| Profile purpose | CrowdStrike capabilities |
|-|-|
| Gather host details and logged-in users | * Get Host Details * Get Logged On Users {#create-a-capability-profile-for-the-crowdstrike-falcon-insight-integration__ul_bvy_mbh_p4b} |
| Fetch the network statistics, processes, and services running for a host | * Get Network Statistics * Get Running Processes * Get Running Services {#create-a-capability-profile-for-the-crowdstrike-falcon-insight-integration__ul_rhl_lbh_p4b} |
| Isolate a host | Isolate Host |
| Remove isolation for a host | Remove Isolation |
| Obtain a file from a host endpoint | Get File |
[Table 1. Profile types and required CrowdStrike Falcon Insight capabilities]

{#create-a-capability-profile-for-the-crowdstrike-falcon-insight-integration__table_sqk_k1h_p4b}

## Procedure

1. Navigate to AllCrowdStrike Falcon Insight IntegrationCrowdStrike Capability Profiles.
2. Select New.
3. On the form, fill in the fields.  
   {#create-a-capability-profile-for-the-crowdstrike-falcon-insight-integration__table_r1k_4ch_p4b__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name for the new capability profile. This name helps you to identify the profile type and is also the default name for the security tag that is associated with this profile. |
   | Active | Indicates whether the profile is active. When the profile is active, it automatically triggers when a security incident is created that matches the filtering conditions that you have specified in the configuration. |
   | Description | Unique description for the capability profile. |
   | Source | Name of the server. You can only view previously configured servers from the list. |
   | Order | Flow priority. The value for this field indicates the order that flows are executed when two or more profiles share triggering conditions. The flow with the lowest number has the highest priority. To set the order of operation, enter a value. For example, 100, 200, 300, 400. Default: 100 |
   | CrowdStrike Falcon Insight Capabilities | Capabilities of the CrowdStrike Falcon Insight profile. Select the capabilities that you want for this profile from the Available to the Selected column. |
   [ ]

   {#create-a-capability-profile-for-the-crowdstrike-falcon-insight-integration__table_r1k_4ch_p4b}

   The following example shows a complete form for a profile with the Get Host Details capability.
4. Select Next.

## What to do next

Now you can [configure your profile](https://www.servicenow.com/docs/_7XB1AtEPHUnpABhBt_TtA "Configure your profile settings so that the profile triggers only under the conditions that you set."). Verify that you have [reviewed the concepts for configuring profiles and trigger conditions](https://www.servicenow.com/docs/tEcPscjHWYmidgWOKTFjrw "You can configure the profile settings so that a profile runs only when a set of specific conditions is met or you can set up a profile to search for specific field values on a security incident.") before you configure the profile.

*[\>]: and then