How to Trigger Alerts/Incidents for Overseas User Logins in ServiceNow

SerenaK
Tera Contributor

3 weeks ago

Hi ServiceNow Community,
I am looking for advice on implementing a solution in ServiceNow (Zurich release)  to monitor and respond to user logins from overseas locations. Specifically, I would like to:
  1. Detect when a user logs into our ServiceNow instance from outside Australia.
  2. Trigger an alert or send an email notification to our IT team when such an event occurs.

Has anyone implemented a similar solution? If so, what approach did you take?

0 Helpfuls
  • 503 Views
2 REPLIES 2

Joe Wong
Tera Guru

3 weeks ago

Hi Serena,

 

That is a very interesting use case.  I can see how this is a good security measure.  I personally have not implemented something like this but have an idea on how it might be done or at least give you a start.

 

Do you have experience with API calls?  If so, my suggest will be to use an external service such as (https://ip-api.com/) no affiliation, just Googled it.  This will allow you to do a reserve lookup on an IP address.  So you can provide the IP address from entries within the syslog_transaction table.

 

Now this is where you will need to really think about how to implement this, since the syslog_transaction has all pages that is loaded by any user on the system, it get big really quickly, so definitely don't write a business rule on this table to get an answer for all IP address here.  Depending on your needs, maybe if you run a script at a certain interval and pick out unique IP address from syslog_transaction table and run the API call for those particular IP addresses.

 

To further make this process more streamline, you could also create a custom table to will hold IP address you have already looked up, so when filtering for you API call, you can filter only ones that you don't know.  This way, it does not keep looking up the same IP addresses of known origins.  

Lastly, when you get back the API call, you will be able to see where the IP address originated from and you can create a ticket how you see fit.

 

From what I can see, this is a doable project, but definitely not a straight forward one.  And one that will require a lot of testing.

 

I know this might not be a solution, but I hope this will lead you on the right path on finding one.

0 Helpfuls

AlpUtkuM
Mega Sage

3 weeks ago - last edited 3 weeks ago

Hi,

 

If I understand your requirements correctly, this could be done via flow designer.

 

  • I would suggest you to create a flow by using "record created or updated" on "sys_user" table with conditions such as "active is true" and "last login date is today" and "location is not Australia"
  • Then use "for each loop"
  • Then use Create Record / send email action to notify IT Team
0 Helpfuls