Hi all, We are starting with our USEM migration journey.I had a few doubts on step 1. Which specific app do I need to install from the application manager? Is it 'Unified Security Exposure Management (App id: sn_vul_usem_common)'? There are a few app...
Hello SIR Experts,Does anyone have a tried and true/battle-tested documented procedure for what to exclude/preserve/cleanup in a clone from production down to the lowers to prevent security incident data from being exposed anywhere other than product...
Hello Experts! Not sure I'm posting this on the correct forum, but here goes. Who has some experience with integrating ServiceNow with Entra? We use Entra as our SSO provider, and have been given a requirement to allow the help desk to send a user an...
Hello All, As you know, we have recently launched AI security exposure management (part of USEM) with integrations supported for Palo Alto Prisma AIRS, Cisco AI Defense, and Wiz. I also published a blog about this here We would appreciate your fe...
Hi, For Vulnerability response integration, I read that CI are created in Unmatched CI class if the IRE encounters an error while creating an Unclassed Hardware or Incomplete IP Class CIs.My question is how can we know what was the error that IRE enc...
Hi ServiceNow Experts, We have a ServiceNow Vulnerability integration with Rapid7. I wanted to understand the process after the raw CMDB data gets ingested into ServiceNow. When Integration runs, what data (and format of data) for CMDB CI are ingeste...
We are ingesting Qualys test results from multiple Qualys instance... let's refer to them as Qualys A and Qualys B. Each Qualys instance has different policies and ingesting test results from each instance results in policies being recorded in the sn...
Hello, we have a bunch of tenable plugins that were recast in tenable to a lower severity. None of these recasted severity values are reflected in ServiceNow, even though I see 'Recasted Severity'(true/false), 'Modified Severity', 'Severity' fields o...
Happy Friday SecOps community! We’re running a demo series next month showing how to actually consolidate your cybersecurity and risk tools and get ahead of the chaos. Five sessions, each one diving into different use cases across the cybersecur...
Hello Community, We created custom CI Lookup rules based on OOB. Just adding a query line and else loop with OOB script. There are many Unmatched CI & Unclassed Hardware records are created. Previously I thought that IRE got invoke based on custom CI...
Hello, I want to understand what exactly is the difference between the Third party vulnerability entries and NVD, what kind of data are stored, is Third party vulnerability is alternative to NVD? Or does it store the actual instance of Vulnerability ...
Hi all,I need to map the modified Severity field from our third-party vulnerability entries to a new custom field, u_risk_category. I'm seeking advice on the best table structure to use for this customization.Should the custom field be created on the...
Hi Team, I would like to understand that, how a Vulnerability is mapped or attached with the VIT ticket/on a CI, what process or rule make this happen? Regards,Abz
Hi team,I got inducted in SecOps with zero experience.My first task is to create incidents in the system when integration fails.Can you please help me.I was wondering maybe there is a process to create alert when integration fails and that alert can ...
Our SOC is using the Splunk SIEM known as Mission Control. All of their investigations into notable events are handled through the Splunk SIEM. However, we need to have the data sent to SIR so we can provide reports and metrics of their investigati...
