How does ServiceNow protect its inbox from phishing emails, preventing that incidents are created?

[Bock]

I want to know how ServiceNow protects its inbox from phishing emails, preventing that they are converted to Incidents via inbound email action.

We have a few phishing emails that generated incidents in the platform. We thought ServiceNow would identify phishing emails automatically and wouldnt create incidents for them.

I tried to find KB articles that explains it, but I couldnt find them.

Should we run the phishing detection on our own or does the Platform offers somehing OOTB?

[vaishali231 · Accepted solution]

Hey @Bock 

ServiceNow does not provide an out-of-the-box phishing detection engine that automatically identifies and blocks phishing emails before they are processed by Inbound Email Actions.

Inbound Email Actions process emails that have already been delivered to the ServiceNow mailbox. If an incoming email meets the conditions of an active Inbound Email Action, the platform will process it (for example, by creating an Incident), regardless of whether the email is legitimate or malicious.

In most environments, phishing and spam protection is handled upstream by the organization's email security solution (such as Microsoft Defender for Office 365, Proofpoint, Mimecast, or Cisco Secure Email) before messages reach ServiceNow.

If phishing emails are generating Incidents, consider implementing one or more of the following controls:

1. Review your email security gateway configuration to ensure phishing and spam emails are filtered before reaching ServiceNow.
2. Restrict inbound record creation to trusted domains, known users, or authenticated senders.
3. Add validation logic to your Inbound Email Actions to verify sender addresses, email headers, or other message attributes before creating records.
4. Route suspicious emails to a review or quarantine process instead of automatically creating Incidents.
5. Use Business Rules or Flow Designer to identify and flag potentially suspicious emails for manual review.

*************************************************************************************************************************************

If this response helps, please mark it as Accept as Solution and Helpful.

Doing so helps others in the community and encourages me to keep contributing.

Regards

Vaishali Singh

Servicenow Developer
Linkedin - https://www.linkedin.com/in/vaishali-singh-2273361bb

[Tanushree Maiti]

Hi @Bock 

Refer: 

Create security incidents from User Reported Phishing emails 

Refer: KB0957760 Inbound Email FAQ 

4. We just received what seems to be a phishing attempt email or SPAM.  How do we stop the instance from processing these messages? 

First, let's address customers using ServiceNow mail servers.  Every message sent through ServiceNow email servers is assessed for the likelihood of being spam. Based on the scoring assessment, ServiceNow adds headers to each message that can be used for filtering within the customer instance using the Email Filters plugin. 

Within the Email Filters module, there is a SPAM Assassin filter or a Move spam to junk folder filter. Update the filter conditions in order to enable filtering on the spam headers. Either one or both of the following headers may appear in an email: 

X-ServiceNow-Spam-Flag:YES 

X-ServiceNow-Virus:INFECTED 

The filter condition should, therefore, include an OR condition for both of those headers. 

After an email is moved to the Junk mailbox, no inbound actions are run against the email. 

Note that if you are using your own mail server, the SPAM headers will not be present.  Perhaps your mail server does add similar headers.  We recommend you reach out to your email administrator to request this information. 

For more information about this method of email filtering, see  Email Spam Scoring and Filtering

For information on other email security hardening options, please see Email security (instance security hardening)

[jeffreybell]

That sounds really annoying let us know what you came up with @Bock , usually I would expect your upstream email security solution to tackle this.