Need to know from where and how records are updated in MITRE ATT&CK Card tab under Security incident

MSIM Workspace SharePoint Integtation

MSIM workspace has a tab called "Collaboration" once you open a major security incident. On this tab I can not get the SharePoint library to display despite having configured it correctly. If I open the workspace in UI Building, this section has a de...

Qualys Integration issues for Vulnerability Response and Configuration Compliance, Host Detection

We are running two integration instances in our environment, one for Qualys Vulnerability Response and one for Qualys Configuration Compliance. Below are the jobs running for Qualys VR and Qualys CC. We started seeing duplicate VITs in our production...

Set record-level permissions in the Security Incident application

In the Security Incidents application. I’m looking for a technique on how to restrict access to the records. A user who is currently login can see and edit only records that he assigned to.

Incident placed on hold pending Problem

Thoughts on the following configuration for incident and problem handling. The tool has been configured so that a major incident can be placed on hold Pending Problem. When you link an Incident to a Problem and set this status, the cause and fix info...

Reopening of security incident

Hi,Our team is looking for an option to reopen a Security Incident which is in closed state. Currently once you close the Security incident you cant reopen or edit any fields. Basically team is looking for an option to edit fields on a security inci...

Demo Incident Data

Hi all ,I wanted to try task intelligence for ITSM in my PDI but the required number of incidents needed are 10k.so is there any way I can create or get some demo incidents data.Thanks, 

instance security hardening - glide.security.url.whitelist - need details for this system property

glide.security.url.whitelist - created this system property (snapshot attached) to check its nature of operation but turned out as a fail. When logout from the admin user or a newly created user from the PDI, its not working as expected (enforces val...

Splunk ES Integration- field mapping to a choice value on sn_si_incident

Hey all-we have a working Splunk ES integration configured previously by ServiceNow implementers- but the 'source' field is currently populating to the SNow form default of 'phone', and the secops folks want it adjusted to SIEM.  instead of changing ...

Risk calculator doesn't work

Hi, I have a second question related to risk calculator.As per my understanding and the knowledge I have from community, when a new Vulnerable item got created (from integration), a Business rule "Calculate risk score" got executed and the risk ratin...