Major Security Incident Management is Live on the ServiceNow Store!

[AntonioChallita]

3/31/2022 Update: Check out this new blog post for additional guidance on configuring MSIM: Getting Started Guide + Video Configuration Walkthrough

Dear SecOps Community Members, 

We’re excited to announce that Major Security Incident Management (MSIM) is now live on the ServiceNow Store (here)!

MSIM offers you a Virtual War room for driving a collaborative response to critical security incidents. 

MSIM is designed to help track and resolve major security incidents, working in conjunction with the existing Security Incident Response (SIR) and Vulnerability Response (VR) product capabilities. 

The enterprise-wide collaboration enabled in MSIM evolves the major security incident remediation process, leveraging the following capabilities: 

1. Dedicated Workspace for managing major security incidents specifically designed for the major security incident "Manager" persona. 
2. Visual Task Board to organize major security incident response tasks across linked security incidents, vulnerabilities, and teams. 
3. Automated Workflows to auto-notify stakeholders, create collaboration folders and chat channels once a major security incident is created. 
4. File Explorer component to organize and track collection of artifacts (files or logs) related to the major security incident via Microsoft SharePoint integration.
5. Activity Stream and chat channel manager to manage communications across multiple Security, IT, and other teams (such as Legal or PR) via Microsoft Teams integration.
6. Reporting of impact metrics with a roll-up of affected assets, users and locations as well progress metrics for tasks and collaboration activity.
7. Timeline of significant events for a high-level end-to-end visibility on incident progress (without getting overwhelmed by the details).

More information about MSIM is available on the product documentation here.

You can also see MSIM in action in the following 5-minute demo:

MSIM helps your teams not only centralize and accelerate their response actions but also reduce their cyber risk. We look forward to speaking with you more about the feature over the coming days and into the New Year! 

Wishing you a happy and safe holiday season! 

[qcj3]

My org has been looking forward to this app.  Is there a way around the sn_sp_spoke requirement so that I can test drive this in my personal instance?

Great work, Team!

[Anil Kumar Thal]

MSIM application is not dependent on sn_sp_spoke (security Operations Spoke).

Here you can identify the dependent applications and plugins list from store:

https://store.servicenow.com/sn_appstore_store.do#!/store/application/d591deb12806201057b7a6460e6132c3/

[Sherif Elmoafi]

I am actually having the same issue, unable to activate on my developer instance because of the sn_sp_spoke. 

[Anil Kumar Thal]

HI Sherif Elmoafi,

Initially, i thought you were asking about security operations spoke. that's why I have mentioned that it's not needed. Sorry I misunderstood.

sn_sp_spoke (Microsoft Sharepoint Spoke application) is must needed to install MSIM application. Please entitle to this application.

[Anil Kumar Thal]

HI Sherif Elmoafi,

Could you please check now. are you still getting the same error?

[Arpit Modi1]

Hi Anil, I am facing the same issue. I am not able to install "sn_sp_spoke (Microsoft Sharepoint Spoke application)" dependency plugin on my personal developer instance. Can you please guide? 

Thanks!

[Anil Kumar Thal]

Hi @Arpit Modi,

Could you please create a Case Task and provide access to the instances. we will check and get back.

[Sherif Elmoafi]

Hi Anil, 

Just checked still getting the same error as the sn_sp_spoke plugin has to be purchased from the store and I do not believe you can do that on a developer instance.

Thank you !

[Anil Kumar Thal]

Yes @Sherif Elmoafi, We have shared the issue you were facing with our pricing team.

We are waiting for their response. We are checking that MSIM bundle will include ‘Microsoft Teams Graph spoke’ and ‘Microsoft SharePoint spoke’ as well.

If we have access to your instance we will check once the pricing team confirms the same.

[Anil Kumar Thal]

HI @Sherif Elmoafi & @Arpit Modi, 

Please share the case/case task once it is created. 

This is one suggestion from our ServiceNow IHub team: visit the Store page for the spoke and request it. Then try installing the MSIM application.

If the above one doesn't work, could you also try installing the dependent application (sn_sp_spoke:2.0.2) directly? Just search and confirm if that app is visible on the plugin list and if it exists then try installing the version (2.0.2) and let us know the error/issue observed.

[MattSN]

@Anil Kumar Thallapalli 

Will the sn_sp_spoke be entitled to PDI's (or removed as a dependency) so that we can install this in a PDI for testing/documenation? 

Thanks

[mmgauvin]

Any news with the Sharepoint Spoke (sn_sp_spoke)?  We are not able to activate the MSIM plugin in our PDI instance.

Thanks.

[mortenkschoeler]

Having exactly same issue with the sn_sp_spke on my PDI.

Haven't been able to find any way around it. Would greatly appreciate that the sharepoint spoke could be released for PDIs so we could get a hands-on insight

[mmgauvin]

Hi @Anil Kumar Thallapalli ,

Did you get any news from your pricing team?  We are still not able to install the MSIM app.

Thanks.

[Asal M]

Did anyone get the chance to activate MSIM on their PDI? the issue the sn_sp_spke is still the same on PDIs and I did not find any solutions for it yet.

[Anil Kumar Thal]

@Asal M We have checked with spoke team. "sn_sp_spoke" will not be available on PDI instances but they will be available on sub-prod instances for exploration.

Could you please try to activating/using MSIM on sub-prod instance and it will install the sn_sp_spoke.

[Inespolo]

Thank you so much for the updated information about this cool app. I purchased this version of this app about six months ago and am still actively using this app. I find it very convenient to use. I also conduct penetration testing brisbane together with this application to check various sites of our company for viruses or threats. This application helps our IT department to work with massive data and quickly respond to various threats and virus attacks. It is important for us to maintain our websites and the Internet page of our company, so we work hard and this application makes our life much easier. Thanks!

[Anil Kumar Thal]

@mmgauvin We have checked with spoke team. "sn_sp_spoke" will not be available on PDI instances but they will be available on sub-prod instances for exploration.

Could you please try to activating/using MSIM on sub-prod instance and it will install the sn_sp_spoke.