{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44229,"path":"security-management/secops-integration-sightings-search-workflow.md","title":"Security Operations Integration - Sightings Search Flow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Operations Integration - Sightings Search Flow\n\n**Security Operations Integration - Sightings Search** flow is a high-level flow independent of integrations. It uses the configured queries to search for a set of observables based on the configured integrations which support the capability. Use it to fulfill an integration such as Splunk or Elasticsearch.\n\n## Before you begin\n\nRole required: sn\\_si.analyst\n\n## About this task\n\nIf a security incident has an observable attached to it, this flow is triggered when you click on **Run Sighting Search** in the **Actions on selected rows...** drop-down menu in the **Security Incident Observables** tab.\n\n\\[Omitted image \"integration-sightings-search.png\"\\] Alt text: Flow design for Security Operations Integration- Sightings Search\n\nActivities specific to this flow are described here. For more information on other activities, see [Common Security Operations integration flows and orchestration activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/common-wf-activities.md).\n\n-   **[Sightings Search - Determine Observables activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/determine-observables-sightings-search-activity.md)**  \nThe **Sightings Search - Determine Observables** workflow activity determines which observables to include in the workflow.\n-   **[Persistent Observable Sightings activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/persistent-observable-sightings-activity-arcsight-wf.md)**  \nThe **Persistent Observable Sightings** workflow activity retrieves observables from the third-party integration.\n-   **[Get Observable Sightings Queries activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-observable-sightings-queries-activity.md)**  \nThe **Get Observable Sightings Queries** workflow activity retrieves queries from the integration configuration.\n-   **[Security Operations - Arcsight Logger Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/secops-integration-sightings-search-arcsight-workflow.md)**  \n**Security Operations - ArcSight Logger Sightings Search** flow is the implementation for the Splunk integration launched by the **Security Operations Integration - Sightings Search Flow**.\n-   **[Security Operations - Elasticsearch Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/secops-integration-sightings-search-es-workflow.md)**  \n**Security Operations - Elasticsearch Sightings Search** flow is the Elasticsearch implementation launched by the **Security Operations Integration - Sightings Search** flow.\n-   **[Security Operations - McAfee ESM Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/secops-integration-sightings-search-mcafee-workflow.md)**  \n**Security Operations - McAfee ESM Sightings Search** flow is the implementation for the McAfee Sighting Search implementation launched by the **Security Operations Integration - Sightings Search Flow**.\n-   **[Security Operations - QRadar Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/secops-integration-sightings-search-qradar-workflow.md)**  \n**Security Operations - QRadar Sightings Search** flow is the implementation for the IBM QRadar integration launched by the **Security Operations Integration - Sightings Search flow**.\n-   **[Security Operations Integration - Splunk Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/secops-integration-sightings-search-splunk-workflow.md)**  \n**Security Operations - Splunk Sightings Search** flow is the implementation for the Splunk integration launched by the **Security Operations Integration - Sightings Search flow**.\n\n**Parent Topic:**[Create sightings search configuration records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sightings-search-configurations.md)\n\n"}}