SIR/VR Training Examples

[CMBPC]

Hi All,

I'm being asked to step in and assist in create/perform some SecOps ServiceNow ITIL user level training in a few weeks. Looking for examples of Sec Analyst/Manager level ServiceNow training anyone has given or just some pointers on key areas to include into the training.

Thanks,

BAinMA

[seanpmcclean · Accepted solution]

Howdy,

My first recommendation would be to look at ServiceNow's Process User or fulfiller training options, as both examples and a possible offering to your customer.  Next suggestion in my arsenal: Within this ServiceNow Community (Security Operations) - look specifically at the “For New Customers” section.  There are documents, slides and videos that you could leverage directly for SecOps Analysts as a starting point.

Rather than recreating the wheel, armed with these resources, if you haven't done so already, do an participant analysis:  Check in with the customer stakeholders and where you are within the implementation to determine (and prioritize) the key tasks:

• General Navigation? (i.e. do they already have navigation experience through other applications on the platform?  Or do they need starting reference? If so send them here…https://community.servicenow.com/community?id=community_article&sys_id=a2dc2a65dbd0dbc01dcaf3231f96197e)
• • Develop minimum standards and skills
  • Create assessments or test around those minimum skills
• SecOps Security Incident Response (SIR) specific navigation?
• • Develop prioritized skill lists (i.e. do they really need to understand escalations?  Or filtered searches? Or promoting Security Requests to Security Incidents?) Though I know you are looking for a finished doc you can leverage, these questions will make a huge difference in the portions of that doc or template that you would need to use, and I think pinning down which activities they will be using might make any doc you find either no longer relevant, or perfect for your purposese.
  • Develop assessment or tests around those key skills
  • Use the Community Links above to provide this
  • Add to the community resources by providing your own additional
• SecOps Security Incident Response Analysis, Containment, Eradication, etc.
• • Repeat the steps above:
  • Determine and prioritize the activities from their Process Guides
  • Develop your test of skill
  • Leverage the community Videos and Articles first
  • Build any additional last

Though I know this isn’t necessarily a “one and done” example you can leverage, I think would be easy and fast to leverage.  This has the added advantage of familiarizing analysts with using the community and the answers found there - and sets them up to maintain their most current knowledge as these sources update - thus making it the best place for them to check, and lets you focus on determining which skills are prioritized for your customer.

SIR response video’s that you might directly leverage for training:

https://community.servicenow.com/community?id=community_video&sys_id=8f470535db989fc09c9ffb651f9619a...

https://www.youtube.com/watch?v=T35aF9Key2U

Still looking for other resources and I'll include these below as I find them, but I believe that these (plus targeted analysis of which skills and which priorities will help make the rest of the training resources you need) fall into place.