---
title: Map offense fields
description: After you have selected the rules, the next step is to map offense, event, or flow fields to the fields in the security incident form.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/qradar-ibm-create-profile-about-mapping.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Setup IBM QRadar profile, Set up instance, IBM QRadar Offense Ingestion Integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Map offense fields

After you have selected the rules, the next step is to map offense, event, or flow fields to the fields in the security incident form.

## Overview of Mapping

For the mapping step, you must first ingest sample offenses for one or more selected IBM QRadar rules. Then you must ensure that all relevant offense field data is mapped to the appropriate place on the SIR incident form and then visualize the SIR incident in the preview section.

Mapping of the sample offense fields involves the following:

-   Fetching and populating of the sample data: See [Ingesting the sample IBM QRadar offenses](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/qradar-ibm-create-profile-ingestion.md).
-   Mapping the offense fields to the security incident: See [Mapping IBM QRadar offense fields to security incident response fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/ibm-qradar-mapping-process.md).