What is the best way to expose ServiceNow logs to external SIEM (security) tool?

[Suggy]

Hi,

Our security team wants to have all of the ServiceNow LOGS for monitoring purpose. Looking for best way to expose logs tables.

Export from ServiceNow? or Allow to read via API? Any other recommenced approach?

Thnx!

[mdash]

Hi,
It is not recommended to export the logs due to sheer size of the files based on instance maturity. However, if you need to export anyhow, then Scheduled Export is a great option.(assumption: You are using MID Server)
Link:
https://docs.servicenow.com/en-US/bundle/tokyo-platform-administration/page/administer/export-sets/t...

1. You can create an Export Definition, mention Log table and add filter condition.
2. Create an Export Target. Here you need to specify MID Server and File path.
3. Create a Schedule Export to send the log data periodically. 

This would a suitable low code/no code option in my opinion.

Thanks.

[Suggy]

Thank you!

[Suggy]

If anyone else is doing this differently, please let me know

[HarshTimes]

I have the same query and was looking for some options. I Understand this is an old post and you may have found the solution.

The below answer may be helpful if someone has a similar query.

I found that ServiceNow provides a sysLog probe to export log messages from ServiceNow to log servers sing MIDServer. The below Servicenow Docs link will provide more details.

https://docs.servicenow.com/bundle/utah-platform-administration/page/integrate/vendor-specific-integ...