ArcSight ESM Event Ingestion for Security Operations
Create Security Incidents automatically from ArcSight ESM Correlated Events.
Install Trend
View Install Data
| Date | Install Count | Change |
|---|---|---|
| 2026-09-09 | 0 | - |
| 134 days of no change | ||
| 2026-04-27 | 8 | -8 |
About
ArcSight ESM is a market-leading solution for collecting, correlating, and reporting on security event information. This integration with ArcSight ESM enables you to automate the ingestion of correlated events from ArcSight and improve the ability to automate the creation of security incidents in the ServiceNow platform through dynamic mapping.
Key Features
This integration includes the following key features:
- Create multiple event profiles in your Now Platform instance that permit you to ingest and select sample-fired correlated events.
- Map Arcsight fired correlated events values to associated SIR security incident fields with dynamic drag-and-drop mapping.
- Aggregate (append) fired correlated events to existing security incidents when you determine that the new correlated events are related to existing security incidents.
- Validate your mapping with a preview of the event values in a security incident. You can modify the fields if you are not satisfied with the mapping.
- Retrieve historical events with the one-time retrieval feature, or schedule and ingest ongoing, future alerts at configurable intervals.