> ## Documentation Index
> Fetch the complete documentation index at: https://specterops-bed-6715-managed-id-auth-method.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Use Security Incident Response Integration with BloodHound Enterprise

> Learn how to use the ServiceNow Security Incident Response integration to manage security incidents based on BloodHound Enterprise attack path findings.

<img noZoom src="https://mintcdn.com/specterops-bed-6715-managed-id-auth-method/32bGxo1_JbXAaHjs/assets/enterprise-edition-pill-tag.svg?fit=max&auto=format&n=32bGxo1_JbXAaHjs&q=85&s=fdbd03f093f1d5a5597a4d4d994bdee2" alt="Applies to BloodHound Enterprise only" width="225" height="45" data-path="assets/enterprise-edition-pill-tag.svg" />

After [installation and configuration](/integrations/service-now/security-incident-response/configure) are complete, the integration begins fetching attack path findings from the BloodHound Enterprise API. The integration creates a Security Incident Response (SIR) ticket for each attack path finding.

To view and manage security incidents created by the integration:

<Steps>
  <Step title="View the list of security incidents">
    1. Log in to your ServiceNow instance.
    2. Click **All** and enter `sn_si_incident.list` in the search bar to navigate to the list of security incidents.
  </Step>

  <Step title="View and manage a security incident">
    1. Click a number to view attack path findings and remediation documentation in the incident details.

           <Frame>
             <img src="https://mintcdn.com/specterops-bed-6715-managed-id-auth-method/IyUopAk7tFNLASwe/images/integrations/service-now/sir/image2.png?fit=max&auto=format&n=IyUopAk7tFNLASwe&q=85&s=102ebeaba87a63bf9a3d6221a1c87e5d" alt="A view of the ServiceNow user interface showing a list of security incidents created by the integration, with one incident selected to view details." width="1841" height="871" data-path="images/integrations/service-now/sir/image2.png" />
           </Frame>

    2. Update incident fields as required.

           <Frame>
             <img src="https://mintcdn.com/specterops-bed-6715-managed-id-auth-method/IyUopAk7tFNLASwe/images/integrations/service-now/sir/image7.png?fit=max&auto=format&n=IyUopAk7tFNLASwe&q=85&s=e1fd8f65d02a8e79bc4bec7dff2ffac1" alt="A view of the ServiceNow user interface showing the process of updating a security incident." width="1835" height="895" data-path="images/integrations/service-now/sir/image7.png" />
           </Frame>

       For example, you can post comments in the **Work Notes** field.

           <Frame>
             <img src="https://mintcdn.com/specterops-bed-6715-managed-id-auth-method/IyUopAk7tFNLASwe/images/integrations/service-now/sir/image36.png?fit=max&auto=format&n=IyUopAk7tFNLASwe&q=85&s=59058550f96c080645384efdeb9fd39f" alt="A view of the ServiceNow user interface showing the Work Notes field of a security incident." width="1837" height="860" data-path="images/integrations/service-now/sir/image36.png" />
           </Frame>
  </Step>
</Steps>
