---
title: Set up a profile for scheduled notable event ingestion
description: Depending on the profile defined, Splunk ES notable events are automatically ingested into the Security Operations environment of your ServiceNow AI Platform instance.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/splunk-event-scheduled-security.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Create an event profile, Splunk Enterprise Security event ingestion integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Set up a profile for scheduled notable event ingestion

Depending on the profile defined, Splunk ES notable events are automatically ingested into the Security Operations environment of your ServiceNow AI Platform instance.

The following table shows the list of tasks you need to follow to set up a profile for scheduled ingestion of notable events:

|Task|Section|
|----|-------|
|Create an event profile|See [Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-create-profile-sched-security.md)|
|Select notable events based on correlation search name|See [Set Correlation rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest-alert-selection-security.md)|
|Map notable event fields|See [Explore Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest_mapping-security.md)|
|Create custom mappings|See [Map notable events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest-map-alerts-security.md)|
|Preview the security incident|See [Preview security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest-preview-security.md)|
|Schedule and retrieve new and updated notable events|See [Schedule and retrieve notable events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest-schedule-security.md)|
|Automate notable event updates and closure based on SIR incident status|See [Automate notable event updates and closures](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-additional-security.md)|