---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# ServiceNow Security Operations add-on for Splunk overview

# ServiceNow
Security Operations add-on for Splunk
overview {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The ServiceNow
Security Operations add-on for Splunk allows a Splunk software
administrator to collect data and create incidents and events in the ServiceNow AI Platform.  
The add-on is installed from [Splunkbase.](https://splunkbase.splunk.com/)  
Important:  
Splunk is also supported for Managed Service Provider (MSP) environment.

[Setup Splunk environment](https://www.servicenow.com/docs/_xX3lChn2~PHN4ueFGuqnA "ServiceNow Security Operations Integration enables seamless integration between Splunk and ServiceNow Security Operations. To set up or change the ServiceNow instance where new security incidents and security events are created, use the setup action in the application list.")

[Configure Application Registry on the ServiceNow instance](https://www.servicenow.com/docs/JZaCMLkvJhHbC7o7vbogQA "Register the application with the instance to use OAuth authorization.")

[Using ServiceNow Security Operations Integration add-on](https://www.servicenow.com/docs/EKFAC00lkuVzLlk0Idhmcg "Create security events and incidents directly from Splunk alerts after setting up ServiceNow Security Operations Integration add-on.")