Hey there,
Yes - the User Reported Phishing capability has been overhauled (you didn't mention which version of SIR you are coming from or comparing against).
In User Reported Phishing 2.0 - Flow Designer is more heavily used to handle the inbound email action and creation of Security Incidents - and will now require the Security Operations Spoke Store App you mentioned.
There are a lot more features that you will benefit from, especially around the aggregation of the PHISH records you pointed out - and ability for you to control what level of aggregation you want, and how you want it to work (1 suspicious to 1 SIR, for multiple suspicious emails to 1 SIR, etc)
You should check out documentation as you dive in:
https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident-response/concept/urp-about.html#urp-about-
Hi,
The old method was to go from phishing email to SIR.
The new method is to go from phishing email to a PHIS record which could then determine a SIR record or not.
See documentation here: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident-response...
To use the enhanced User Reported Phishing feature, the following plugins and components are required:
- Security Support Common (sn_sec_cmn😞 Includes:
- Inbound action
- New EmailUserReportedPhishing script
- Ingestion Rules table
- Security Incident Response (sn_si): Includes:
- Security incident table (sn_si_incident)
- Security phishing emails table (sn_si_phishing_email)
- Security phishing email headers table (sn_si_phishing_email_header)
- EML upload record producer
- Security Operations Spoke
- Flows and subflows for aggregating emails and transforming phishing emails to security incidents.
Security Operations Spoke comes with your purchase of Security Incident Response
Please see this thread here where an employee from ServiceNow confirms that: https://community.servicenow.com/community?id=community_question&sys_id=ec6e9ddbdb72485cfeb1a851ca96...
Please mark reply as Helpful/Correct, if applicable. Thanks!
