> ## Documentation Index
> Fetch the complete documentation index at: https://specterops-bp-2641-crowdstrike-integration.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Use Security Incident Response Integration with BloodHound Enterprise

> Learn how to use the ServiceNow Security Incident Response integration to manage security incidents based on BloodHound Enterprise attack path findings.

<img noZoom src="https://mintcdn.com/specterops-bp-2641-crowdstrike-integration/_rZ1zFkP5xLBuV5I/assets/enterprise-edition-pill-tag.svg?fit=max&auto=format&n=_rZ1zFkP5xLBuV5I&q=85&s=4a7cab6298d422be44331dd276b8e56d" alt="Applies to BloodHound Enterprise only" width="225" height="45" data-path="assets/enterprise-edition-pill-tag.svg" />

After [installation and configuration](/integrations/service-now/security-incident-response/configure) are complete, the integration begins fetching attack path findings from the BloodHound Enterprise API. The integration creates a Security Incident Response (SIR) ticket for each attack path finding.

To view and manage security incidents created by the integration:

<Steps>
  <Step title="View the list of security incidents">
    1. Log in to your ServiceNow instance.
    2. Click **All** and enter `sn_si_incident.list` in the search bar to navigate to the list of security incidents.
  </Step>

  <Step title="View and manage a security incident">
    1. Click a number to view attack path findings and remediation documentation in the incident details.

           <Frame>
             <img src="https://mintcdn.com/specterops-bp-2641-crowdstrike-integration/vlps5wCDdMS1HpNk/images/integrations/service-now/sir/image2.png?fit=max&auto=format&n=vlps5wCDdMS1HpNk&q=85&s=f57db1a96851deb55375df24d47e0547" alt="A view of the ServiceNow user interface showing a list of security incidents created by the integration, with one incident selected to view details." width="1841" height="871" data-path="images/integrations/service-now/sir/image2.png" />
           </Frame>

    2. Update incident fields as required.

           <Frame>
             <img src="https://mintcdn.com/specterops-bp-2641-crowdstrike-integration/vlps5wCDdMS1HpNk/images/integrations/service-now/sir/image7.png?fit=max&auto=format&n=vlps5wCDdMS1HpNk&q=85&s=054cea7579028b727c60739cf9bc5ed3" alt="A view of the ServiceNow user interface showing the process of updating a security incident." width="1835" height="895" data-path="images/integrations/service-now/sir/image7.png" />
           </Frame>

       For example, you can post comments in the **Work Notes** field.

           <Frame>
             <img src="https://mintcdn.com/specterops-bp-2641-crowdstrike-integration/vlps5wCDdMS1HpNk/images/integrations/service-now/sir/image36.png?fit=max&auto=format&n=vlps5wCDdMS1HpNk&q=85&s=1db76080258dba64da480d2b07ae0578" alt="A view of the ServiceNow user interface showing the Work Notes field of a security incident." width="1837" height="860" data-path="images/integrations/service-now/sir/image36.png" />
           </Frame>
  </Step>
</Steps>
