Scanning of Attachments

[kurt9]

Does ServiceNow do any scanning of attachments for malware/viruses when they are uploaded by a user?   If so, what is done?

[kurt9]

OK.   Got it.   Its not a list of types which are to be excluded.   Its a list of which extensions are allowed.  

[eddy42]

 If you specify one extension, then you cannot make any attachments?

I'm hoping this is clear now:

• Leave the specified extensions blank: ALL extensions will be allowed
• Specify ANY extensions: The allowed uploads will be restricted to ONLY those extensions (ie. if you only specify one extension then that will be the only extension allowed)

This makes perfect sense to me as you cannot possibly know all the extension types that unscrupulous users will upload.   If I only want people to upload .doc, .pdf, .xls - then I will specify these and no others will be allowed.

[eurban]

I contacted ServiceNow with this same question.

Their response was:

Service-now does not filter out emails in our email servers, as each company has their own email requirements and we would not be able to create a specific enough set of rules for this. 

The support tech provided info about the Security Operations offering that includes the ability to scan threats.   It looks like from the documentation on it that you would be able to integrate with a third party scanner.

Specifically he called out Threat Intelligence with threat scanner integration.   "Threat Scanners provide the ability to send data to external malware scanners to determine if that data is malicious."

Threat Intelligence

Third-party threat scanners