question Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting in SecOps forum

Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

Richbrowne — Wed, 10 Mar 2021 10:26:14 GMT

Hi,

Is there an approach to integrating a third party's Penetration Testing vulnerabilities into ServiceNow to provide vulnerabilities management and reporting please?

The Penetration Test results are not from an automated vulnerability scanning system they are from a third party Penetration testing consultancy that has performed exploitative tests to assess systems security status.

Re: Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

chrismcdevi — Wed, 10 Mar 2021 13:59:28 GMT

Hi,
I was on a team of people who just implemented this for a Customer. We designed a standard format that the findings would be in (we settled on JSON as the data container). The customer's Pentesting teams (internal and external) will provide their result in this standard JSON format.
We then created a Record Producer that parses the data (Attachment to the Record Producer form) and creates the Vulnerabilities leveraging the VR framework.

We also added NIST and PCI to the Thrid-Party Libraries (you will need to decide on a standard format that will be identified in the Pentest finding)

It would be nice if the Pentest community would come up with a standard... if you come across one, I would love to hear about it!
Hopes this helps.

Re: Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

Richbrowne — Wed, 10 Mar 2021 15:56:31 GMT

Hi Chris,

Thank you for your response.

How long did this solution take from design to implementation please and was this a bespoke module developed for the client? I assume this is not possible with an existing ServiceNow module?

Thank you for your help.

Kind regards,

Richard.

Re: Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

chrismcdevi — Wed, 10 Mar 2021 19:57:51 GMT

Hi,

It took us about +/-80 hours to do this.

No, we used the Vulnerability Response module.

Here is the key: The Pentest owner needs to agree that Pentest findings need to fit into the VR framework and NOT try and make the VR Framework fit Pentest.

🙂

New components:

Record Producer

Custom fields (on VR)

UI Policies

ACL's

Custom script include

Third-Party Integration Record

CI Lookup Rules

Transform Scripts

Record Producer (Attachment with json) -> Transform Map (CI Lookup Rules + Match one or create Third-Party) Create VI. From there, Assignment Rules, Risk, and Grouping rules run.

Re: Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

Richbrowne — Thu, 11 Mar 2021 09:58:25 GMT

Hi Chris,

Thank you again for the reply, much appreciated.

With regards the circa 80 hours timeframe to provide this service, was that 80 man hours or was that how long it took a team working in parallel please?

In addition, were the resource(s) that provided the solution skilled ServiceNow developers/engineers?

Thanks again.

Kind regards.

Re: Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

chrismcdevi — Thu, 11 Mar 2021 12:56:55 GMT

There were three of us working in parallel.

Skilled? Well... the more I learn about ServiceNow, the more I realize there is a lot more to learn.
🙂

I would say you will need someone who has worked building customization integration into the Vulnerability Framework before. The rest of the team needs to have good ServiceNow development skills.

As I mentioned before, all this depends on your design fitting into Vulnerability Response and not the other way around. This is a critical point to figuring out how long things will take to do.

Re: Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

Richbrowne — Fri, 12 Mar 2021 10:52:39 GMT

Thank you Chris, very helpful.

Re: Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

Richbrowne — Fri, 12 Mar 2021 13:26:51 GMT

Apologies Chris, a few more queries...

Did the solution that your team provided enable the full management of the imported Penetration Testing vulnerabilities in ServiceNow?
Did the solution provide the ability to provide full in-depth reports on vulnerability statistics from within ServiceNow?

Thank you for your help.

Re: Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

chrismcdevi — Fri, 12 Mar 2021 20:18:01 GMT

These are complex questions, so this answer is; It depends.

"Did the solution that your team provided enable the full management of the imported Penetration Testing vulnerabilities in ServiceNow?"

- How does your organization define "full management"?

One thing that comes to mind; The pentest result became a Vulnerable Item and then follow the VR lifecycle. Except..... Normally a VR scanner is the final judge on whether or not something was truly resolved. Manually generating pentest results does not have the same mechanism. This part will need to be worked out.

"Did the solution provide the ability to provide full in-depth reports on vulnerability statistics from within ServiceNow?"

- How does your organization define "full in-depth reports"? Does your organization have Performance Analytics? As the data matures does your organization have the skill set to enhance the reporting?

Re: Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

chrismcdevi — Tue, 09 Aug 2022 20:21:39 GMT

Hi,

I have an update for this.... I took everything I built, and I have extended it to now be brought in via an Import Set through the Import Set API.

https://docs.servicenow.com/bundle/tokyo-application-development/page/integrate/inbound-rest/concept/c_ImportSetAPI.html

Baby steps... I tell all my customers, "let's take baby steps first."

First, they were doing a low volume of Pentest into VR using the Record Producer. Once the process was successful... guess what? The customer wanted more...

We shifted left in their process, and now the Pentest teams push their findings into SN VR via the Import Set API.

Re: Pen test Vulnerabilities Integrated into ServiceNow for Vulnerability Management and Reporting

Rohitkumar01 — Thu, 25 Jan 2024 07:35:55 GMT

Certainly! Integrating a third party's Penetration Testing vulnerabilities into ServiceNow for robust management and reporting is possible. Utilize ServiceNow's integration capabilities or custom scripts to import exploitative test results. Design a custom data model, map relevant fields, and automate ticketing for remediation workflows. For expert guidance, consider consulting a specialized Penetration Testing service to optimize the integration within ServiceNow, ensuring a seamless and efficient vulnerabilities management process.