URGENT: Security tags in servicenow SecOps not Auto assigning to SIR

Manikandan Subr · ‎03-04-2020

Hi, we have created the security tags and set the security tag rule as Category=“Data exposure”.

So when a security incident is created it needs to automatically set the security tag to Data exposure. After I created the tag, it set the security tag for all the current security incidents however , when I create/update a new Security incident With category Data Exposure it does not auto assign the security tag. What am I missing? How does the security tag auto set to a ticket?

erik_brostrom · ‎04-24-2020

Had to manually implement a after insert BR for Vul when we did this.

After BR w/ the following:

	var strUtil = new sn_sec_cmn.SecurityTagRulesUtil();
	strUtil.addSecurityTagByRules(current);

I'd double check the ordering on the after business rules as well, make sure its at the end.

^ should help get you started.

View solution in original post

Claudio Marango · ‎03-04-2020

Try to check this content, see if it helps:

https://docs.servicenow.com/bundle/newyork-security-management/page/product/security-operations-comm...

Manikandan Subr · ‎03-04-2020

This is how I have set up the security tags, but when I create the security incidents, it does not auto assign.

qcj3 · ‎03-04-2020

I've seen the same issue. They were working just fine until this week, a person that reports on these tags informed me that new tags haven't been created since November. I made a small change the condition, saved it then changed it back and saved it again for it to tag all the SIRs it missed.

I think this is a bug.

Maarten K_ · ‎04-24-2020

@qcj3 That indeed seems to work, but auto assignment is still not working (tested in Orlando, Madrid). I also see no functionality implemented anywhere that should apply those Security Tag Rules on ticket updates. It seems this functionality is only half implemented.

Did you or @Manikandan Subramanian find a solution or log a HI ticket for this?