Hi team,I got inducted in SecOps with zero experience.My first task is to create incidents in the system when integration fails.Can you please help me.I was wondering maybe there is a process to create alert when integration fails and that alert can ...
Our SOC is using the Splunk SIEM known as Mission Control. All of their investigations into notable events are handled through the Splunk SIEM. However, we need to have the data sent to SIR so we can provide reports and metrics of their investigati...
When we setup VulnResp Management, our GRC module wasn't working the way we wanted. So we have exception management setup through VRM. When we migrated to USEM, we wanted to move our policy exception management to GRC. Unfortunately, I found for ...
What are the Key characterisitcs for Developing a SIR Team and what are the things can a SIR Team can do in the SIR Workspace. Give an overview on that topic.
Hello Experts! Not sure I'm posting this on the correct forum, but here goes. Who has some experience with integrating ServiceNow with Entra? We use Entra as our SSO provider, and have been given a requirement to allow the help desk to send a user an...
Hi everyone, I’m looking to connect with practitioners who have implemented or currently support Security Incident Response (SIR), especially in public-sector or large-enterprise environments. I’m looking to better understand the real-world experienc...
We have the Teams integration for MSIM.This works correctly to create the Teams and the Channels.However the Renew Subscription and Create Subscription Subflows are failing with Resource not found when the Scheduled Job tries to renew the Subscriptio...
All, I'm trying to figure out the best way to automate an as-built configuration report specifically for configurations done in USEM/VR. I envision this being a report out post-deployment that shows all configurations performed, users/roles created, ...
Hi all,We are currently implementing Vulnerability Response / USEM using the OOTB Tenable.sc integration and are seeing unexpected CI correlation behaviour.Environment:ServiceNow: AustraliaVulnerability Response Integration with Tenable: 30.5.3Tenabl...
Hi everyone,With Armis Centrix and Veza becoming increasingly connected to the ServiceNow security ecosystem, I’ve been trying to understand how customers are thinking about the architecture and responsibilities between these platforms.At a high leve...
Hi Team, I would like to understand that, how a Vulnerability is mapped or attached with the VIT ticket. Regards,Abz
What is the main difference between Attack Mode and Attack Pattern. Since both represents Tactics, Techniques and Procedures, we have two difference modules to handles those things. Can someone give a clear difference between these two.
Hi all, I am getting the error 'Read operation on table 'sn_si_calculator_group' from scope 'Security Support Common' was denied. The application 'Security Incident Response' must declare a Restricted Caller Access privilege. Please contact the appli...
Hi all, We created some vulnerable item exclusion rules, and it closed some and did not close others. the condition was simple. it was looking for some VITs where the vulnerability is XYZ. what could be the reason for some VITs not getting closed? t...
Hi all. We have implemented Vulnerability response for servers and the process as a whole is working great. However, from the reporting perspective, we are looking to get a little than what I think is offered out of box. Leadership would like to see ...
