With the ServiceNow Security Operations Event Ingestion Addon for Splunk ES, you can forward notable events from Splunk ES Incident Review to ServiceNow to create security incidents in ServiceNow Security Incident Response application. This Splunkbase app works in conjunction with the ServiceNow app store integration located here - https://store.servicenow.com/sn_appstore_store.do#!/store/home (search for Splunk ES to find specific integration)