Hi All, So I'm getting Security Operations setup and running into an issue with threat intelligence and observable enrichment. I have our IoC getting data from various sources and I have activated the workflows for automated phishing template and use...
Hi, I would like to know if the field Password2 of Client Secret is visible to Admin role unlock the padlock beside the field. Thanks in advance Alex.
Hello All, We have a situation where in we have integrated Configuration Compliance with Qualys on OOB parameters. It works fine when we pull in present data. The job times out when historical data is being pulled. When we put start time more than a ...
For example, Playbook A is triggered, then the SIR record's Category changes, which triggers Playbook B. When this happens, I want Playbook A to stop running.
Hi , how does Event Management works with SIR module in Sec ops? end to end guidance is helpful
Hello Friends, I have a requirement to give write access to a specific field on form. I have created three acls for a role 1. Write --> table name --> --None-- 2.Write --> table name --> * 3.write -- >table name --> field_name But the user is able to...
Hi All, We want to exclude those Test Results and Discovered Items to ServiceNow from Qualys, which meet some DNS or IP Address. We checked Qualys PC Results, where we found Rest Message "Qualys PC Posture Info" and its method "List". In the "List" m...
Hi! I have set up a remediation task rule, that groups based on assigned_to field and vulnerability. When I click the reapply button, it correctly deletes all existing VULs related to the rule and creates new, which contain any VIT meeting the condit...
I am curious how others are leveraging the Assignment Rule feature in AVR to ensure the correct teams are getting the AVIT's assigned to them. Reviewing the SNow documentation hasn't helped put a confidence level on what needs to happen/will happen...
Hi, When I use "Mark as False Positive" button in Remediation Task, all associated VIs states got changed to Closed. RT status is Closed. And if I use Reopen button in RT, Remediation Task status changes from Closed to Open, but all associated Vuln...
Hi, I have a doubt regarding licensing of the Vulnerability Response module. My question is about the Vulnerability Response Integration with Tenable plugin. If client already have VR module, is the Vulnerability Response Integration with Tenable plu...
Hello - I am trying to understand the 'severity' in the NVD records ('sn_vul_nvd_entry') to use in the Vulnerability Calculator. Currently the OOB is using the field severity of the NVD record but I am noticing that not all records have this field po...
I need to know which modules, as broken down as possible, come with SIR Standard, as well as the additional modules included in a Pro license. Attached is the ITSM version.
We're on Quebec, and I followed this article to integrate SIR playbooks with Workspace: https://docs.servicenow.com/bundle/quebec-servicenow-platform/page/administer/workspace/task/integrate-playbook-workspace.html I've activated this out of box flow...
Hi, my organization is working to mature our Security incident process and are a relatively new team in terms of using Security Incident Response. I'm wondering if there's an "out of box" list of security incident categories (like malware, email, vu...