Splunk ES 8.x – ServiceNow Integration: Incident Sync & Mission Control Updates Context We are implementing Splunk Enterprise Security (ES) 8.x integration with ServiceNow using the Splunk Add‑on for ServiceNow and the ServiceNow Incident Integration adaptive response action. The add‑on is installed and configured successfully. Connectivity between Splunk and ServiceNow is verified. We can create ServiceNow incidents from Splunk ES notables using the adaptive response action. Requirements Automatically create a ServiceNow incident when a Splunk ES detection generates a notable. After the incident is created, update the corresponding Splunk ES Mission Control notable with the generated ServiceNow Incident Number (INCxxxxxx). When the ServiceNow incident is closed, the corresponding Splunk ES notable should also be updated/closed. We are considering a polling‑based approach (Splunk querying ServiceNow periodically) rather than inbound API calls. Current Status Add‑on installed and configured. ServiceNow account connectivity test successful. REST API connectivity verified. Adaptive Response “ServiceNow Incident Integration” available in correlation searches. Test incident creation from Splunk ES to ServiceNow successful. Correlation join between Splunk notables and ServiceNow incidents implemented (except storing into a lookup). In detection searches, we added a new field specifically for Correlation ID and mapped it as the identifier between Splunk notables and ServiceNow incidents. Issues / Clarifications Needed Is adding a new field in detection searches and mapping it as the Correlation ID the recommended approach? Is there any other way we could set up  correlation_id After a ServiceNow incident is created, how can the generated Incident Number (INCxxxxxx) be automatically updated back into the Splunk ES Mission Control notable? How can the Mission Control notable be closed once the ServiceNow incident is closed? Environment Splunk Enterprise Security: 8.x Splunk Add‑on for ServiceNow: ServiceNow Incident Integration Adaptive Response Authentication to ServiceNow working successfully Incident creation from Splunk ES to ServiceNow successful Any guidance, or reference approaches from the community  would be greatly appreciated. Thank you! Splunk Enterprise Security Splunk Add-on for ServiceNow  ... View more