Hello, I need to send ServiceNow's system & audit logs to an Azure Sentinel. What is the best approach?From the documentation (Log Export Service (LES) (servicenow.com)) it would seem to be to use Kafka cloud-to-cloud (at least for Splunk) but I can ...
Experts, How is the email parser rule different from the Email Parsing properties? How is it going to retrieve emails from the inbox for processing? Email Parsing Inbox:Security Operations detection tools send email reports to these addresses to be...
Hello,does anyone know how to create a condition in a Vulnerability Assignment Rule which looks into the Vulnerable Item proof in the Vulnerable Item Detection? We can't find this field under "Vulnerability" in the condition builder in the assignment...
Hello Community,Could not connect to the environment. [Method failed: (/api/sn_pipeline/pipeline/validate_connection) with code: 400].I'm getting this message when trying to Create a connection with with Test Environment.How to Fix this?Thanks,Daiva
Hello Experts, I wanted to ask about a feature of Vulnerability Response that was introduced not very long time ago, which is the option to add an Exclusion Rule. I understand the overall concept and how it works, but I'm having difficulty finding on...
Hi, How to extract data from Vulnerable items(sn_vul_vulnerable_item) table for servers and workstations by using filters. Any one please help me on this.1. Exploitable & Actively Exploitable2. CISA KEV3. Backlog ( Vuln on or before march 12th)4. Act...
Has anyone tested PCRS 2.0 or know when this will be available for Configuration Compliance? We are looking to utilize the excludeInactiveControl parameter. Inactive controls are being created as false negatives which is causing a lot of extra work.
We're seeing CVITs created that do not have a risk rating assigned. We suspect that it has to do with the fact NVD has yet to assign a rating, yet the vendor has. We've upgraded our NVD plug-in to the latest version, same issue. Anyone else seeing...
In Risk assessment, the assess and all other buttons are greyed out. Checked all the roles, did not find anything, Any reason behind this? I have attached the screenshot.
I have found the bulk edit button works for doing bulk deferrals for VITs. I also need this for AVITs, CVITs and CTRs as well as their remediation tasks. Can someone assist and provide some documentation?
We're setting Configuration Compliance Remediation Tasks to group by Assignment Group and Configuration Item. We're wanting to utilize certain fields from the CI in our approval rules for CRGs and so are hoping to set the CI on the CRG itself. I was ...
We came across a scenario where we need to verify the integrity of the AWS SNS messages in HTTP API at ServiceNow APP. When I say integrity of the message particularly, I am talking about verifying whether the messages are coming from AWS SNS only an...
- KB1349923 mentions that after reapplying the CI lookup rules, there will be records within unclassed hardware/incomplete IP with no use. - In The more you know - SecOps and CMDB Interactions - YouTube, Scenario 4, it states that incomplete IP class...
Can someone please share the VR Tenable calculator configuration in ServiceNow Vulnerability Response. I am not able to find certain attributes in ServiceNow and having difficulties on Tenable VPR attribute that matches in ServiceNow. DO we also filt...
Hi, I created a new assignment rule (Server Group) for vulnerable items to assign them to a particular group. However, existing vulnerable items are currently being assigned to a different group by an existing assignment rule (Support CI Group). How ...
