Data Loss Prevention integration with ServiceNow

[Saravanan Kris1]

Hi All,

We are in need of integrating the DLP DB with ServiceNow to perform the DLP operation in ServiceNow Itself. 

Ticket handling also will have to do it in the ServiceNow. 

According to my plan. I have to create new application for DLP through studio and have to create forms and fields whatever is available in the DLP management console. So that it will populate the data's in the fields same like in DLP console. We have plan to integrate the DLP repository to ServiceNow once we create the DLP applicatoin, forms and fields in the ServiceNow. 

Please let me know after the integration will the ServiceNow populate the data's from DLP Repository and will the fields gets populated with the appropriate information from DLP DB?

Kindly let me know what are the procedures and technical process to integrate the DLP application with ServiceNow.

Your suggestion may help my request.

Regards

Saravanan K

[Alex Cox]

Hi Saravanan,

I have a few questions that may help the community provide the best help with this:

First off - which DLP DB are you using? Is there a vendor/product we can use to understand the third party platform?  Do you know what kind of APIs they have?

Next - what type of DLP data are you trying to gather? Is this for working on alerts, or performing confiuration changes?

Alex

[Saravanan Kris1]

Hi Alex,

Thank You for your response on this.

We have Forcepoint DLP and also we have customized application which will take the data from DLP DB and populate in the customized application.

We have ADO.net connectivity for DLP DB and customized application.

We have plan to populate the same data in ServiceNow by integrating the DLP DB.

Analyst will login and work on DLP incidents and investigation inside ServiceNow Platform instead of customized application.

Regards

Saravanan K

[SanjivMeher]

I have created an integration between ServiceNow and Symantec DLP. I had created a separate field and whenever we receive a DLP alert from Splunk, I would do a SOAP call the DLP and get the incident details and stored in a separate table.

So you should check, if there is an API, which you can utilize to pull the data.

But careful with PCI, Payments data. If you bring those data as well to ServiceNow, ServiceNow will also become PCI payments compliant and will go through audit.

There is no OOB integration. So you need to build something custom.

[Saravanan Kris1]

Hi Sanjiv,

Thank You for your response. It helps me a lot. Now i got some ideas on this. So you mean to say that we need to create a "New Application" in ServiceNow Studio for DLP Application. And seperate Table, Forms?

Regards

Saravanan K