We are ingesting Qualys test results from multiple Qualys instance... let's refer to them as Qualys A and Qualys B. Each Qualys instance has different policies and ingesting test results from each instance results in policies being recorded in the sn...
Hello, we have a bunch of tenable plugins that were recast in tenable to a lower severity. None of these recasted severity values are reflected in ServiceNow, even though I see 'Recasted Severity'(true/false), 'Modified Severity', 'Severity' fields o...
Happy Friday SecOps community! We’re running a demo series next month showing how to actually consolidate your cybersecurity and risk tools and get ahead of the chaos. Five sessions, each one diving into different use cases across the cybersecur...
Hello Community, We created custom CI Lookup rules based on OOB. Just adding a query line and else loop with OOB script. There are many Unmatched CI & Unclassed Hardware records are created. Previously I thought that IRE got invoke based on custom CI...
Hi Team, I would like to understand that, how a Vulnerability is mapped or attached with the VIT ticket/on a CI, what process or rule make this happen? Regards,Abz
Hi team,I got inducted in SecOps with zero experience.My first task is to create incidents in the system when integration fails.Can you please help me.I was wondering maybe there is a process to create alert when integration fails and that alert can ...
Our SOC is using the Splunk SIEM known as Mission Control. All of their investigations into notable events are handled through the Splunk SIEM. However, we need to have the data sent to SIR so we can provide reports and metrics of their investigati...
When we setup VulnResp Management, our GRC module wasn't working the way we wanted. So we have exception management setup through VRM. When we migrated to USEM, we wanted to move our policy exception management to GRC. Unfortunately, I found for ...
What are the Key characterisitcs for Developing a SIR Team and what are the things can a SIR Team can do in the SIR Workspace. Give an overview on that topic.
Hi everyone, I’m looking to connect with practitioners who have implemented or currently support Security Incident Response (SIR), especially in public-sector or large-enterprise environments. I’m looking to better understand the real-world experienc...
We have the Teams integration for MSIM.This works correctly to create the Teams and the Channels.However the Renew Subscription and Create Subscription Subflows are failing with Resource not found when the Scheduled Job tries to renew the Subscriptio...
All, I'm trying to figure out the best way to automate an as-built configuration report specifically for configurations done in USEM/VR. I envision this being a report out post-deployment that shows all configurations performed, users/roles created, ...
Hi all,We are currently implementing Vulnerability Response / USEM using the OOTB Tenable.sc integration and are seeing unexpected CI correlation behaviour.Environment:ServiceNow: AustraliaVulnerability Response Integration with Tenable: 30.5.3Tenabl...
Hi everyone,With Armis Centrix and Veza becoming increasingly connected to the ServiceNow security ecosystem, I’ve been trying to understand how customers are thinking about the architecture and responsibilities between these platforms.At a high leve...
What is the main difference between Attack Mode and Attack Pattern. Since both represents Tactics, Techniques and Procedures, we have two difference modules to handles those things. Can someone give a clear difference between these two.
