> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Use Security Incident Response Integration with BloodHound Enterprise

> Learn how to use the ServiceNow Security Incident Response integration to manage security incidents based on BloodHound Enterprise attack path findings.

<img noZoom src="https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max&auto=format&n=tTIczgde9H07oLXf&q=85&s=b682a26b342bde12302ec829e265bdb6" alt="Applies to BloodHound Enterprise only" width="225" height="45" data-path="assets/enterprise-edition-pill-tag.svg" />

After [installation and configuration](/integrations/service-now/security-incident-response/configure) are complete, the integration begins fetching attack path findings from the BloodHound Enterprise API. The integration creates a Security Incident Response (SIR) ticket for each attack path finding.

To view and manage security incidents created by the integration:

<Steps>
  <Step title="View the list of security incidents">
    1. Log in to your ServiceNow instance.
    2. Click **All** and enter `sn_si_incident.list` in the search bar to navigate to the list of security incidents.
  </Step>

  <Step title="View and manage a security incident">
    1. Click a number to view attack path findings and remediation documentation in the incident details.

           <Frame>
             <img src="https://mintcdn.com/specterops/kdWektpXPZuKIVCU/images/integrations/service-now/sir/image2.png?fit=max&auto=format&n=kdWektpXPZuKIVCU&q=85&s=1489e53f265f991850a3c8d7748b8c7d" alt="A view of the ServiceNow user interface showing a list of security incidents created by the integration, with one incident selected to view details." width="1841" height="871" data-path="images/integrations/service-now/sir/image2.png" />
           </Frame>

    2. Update incident fields as required.

           <Frame>
             <img src="https://mintcdn.com/specterops/9mfE7C5EYMWJ0NdC/images/integrations/service-now/sir/image7.png?fit=max&auto=format&n=9mfE7C5EYMWJ0NdC&q=85&s=7d4c4decf6dcb723af4bc9fbe002be6e" alt="A view of the ServiceNow user interface showing the process of updating a security incident." width="1835" height="895" data-path="images/integrations/service-now/sir/image7.png" />
           </Frame>

       For example, you can post comments in the **Work Notes** field.

           <Frame>
             <img src="https://mintcdn.com/specterops/9mfE7C5EYMWJ0NdC/images/integrations/service-now/sir/image36.png?fit=max&auto=format&n=9mfE7C5EYMWJ0NdC&q=85&s=ae12cb3e297dd0ad34921ac2ea651ed4" alt="A view of the ServiceNow user interface showing the Work Notes field of a security incident." width="1837" height="860" data-path="images/integrations/service-now/sir/image36.png" />
           </Frame>
  </Step>
</Steps>
