question Not able to see security incidents in my serviceNow instance in Developer forum

Not able to see security incidents in my serviceNow instance

Gopi22 — Sat, 29 Jun 2024 03:21:51 GMT

Hi Team,

I am not able to see security incidents in my instance. I have added all roles starting with sn_si to my user account. Still not able to see even one record in the table sn_si_incident.

I have run a background script to understand if there are any records in the table and it does have. So something might be restricting my view, may be.

Any pointers would be helpful.

Thanks,

Gopi

Re: Not able to see security incidents in my serviceNow instance

Sid_Takali — Sat, 29 Jun 2024 03:55:45 GMT

HI @Gopi22 Refer this Docs https://docs.servicenow.com/bundle/washingtondc-security-management/page/product/security-incident-response/task/t_ViewRelatedAlerts.html

https://docs.servicenow.com/bundle/washingtondc-security-management/page/product/security-incident-response/concept/si-creation.html

Re: Not able to see security incidents in my serviceNow instance

SN_Learn — Sat, 29 Jun 2024 07:18:05 GMT

Hi @Gopi22 ,

My recommendation would be to use the debug security.

As an admin user, navigate to:

System Diagnostics > Session Debug > Debug Security

Click on it, Now navigate back to the form and scroll down you will be able to view ACLs which are executing like below:

The ACLs resulting to false(denying access) will show as below:

You can click on the ACL and find the root cause of it.

Once done, search for 'Stop Debugging' and click on it to stop the debugging.

Mark this as Helpful / Accept the Solution if this helps

Re: Not able to see security incidents in my serviceNow instance

Dr Atul G- LNG — Sat, 29 Jun 2024 07:55:05 GMT

Hi @Gopi22

Are you trying in PDI? Might be try

Create a new user and give sn_si role to user and check.

Sometime, if you have admin role can cause an issue.

Re: Not able to see security incidents in my serviceNow instance

Gopi22 — Tue, 30 Jul 2024 02:26:27 GMT

*Sharing this information here to be useful for others*
Hello,
Thank you for sharing this approach of enabling Debug Security. I tried using that but no luck though. There were no ACLs which were causing the restriction.

Later, I found out that there were few 'Display Business Rules' which were activated on the table, which caused the restriction. Only users part of a particular group were enabled to see the list.

Thanks,

Gopi