Setup Assistant reference
The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.
Create a Security Incident Response process definition
You can create a process definition to define the way security incidents transition from one state to the next. Process definitions give service desks and end users help tracking the problem throughout its life cycle.
Before you begin
Role required: sn_si.admin
Procedure
Understanding Security Incident Response process definition
Security Incident Response Process Definition replaces state flows and provides end users and service desks with the status of a problem. A process definition helps track the problem through its life cycle. Security Incident Response is a Service Management (SM) application, which has its own set of states. Invalid states are reported as part of Process Selection.
Security Incident Response Process Definition
| State | Description |
|---|---|
| Draft | The request initiator adds information about the security incident, but it isn’t yet ready to be worked on. |
| Analysis | The incident has been assigned and the issue is being analyzed. |
| Contain | The issue has been identified and the security staff is working to contain it and perform damage control. These actions can include taking servers offline, disconnecting equipment from the internet, and verifying that backups exist. |
| Eradicate | The issue has been contained and the security staff is taking steps to fix the issue. |
| Recover | The issue is resolved and the operational readiness of the affected systems is being verified. |
| Review | The security incident is complete and all systems are back to normal function, however, a post incident review is still needed. |
| Closed | The incident is complete but before a security incident can be closed, you must fill out the information on the Closure Information tab. |
Security Incident task process definitions
The following process definitions are used for security incident tasks.
| State | Description |
|---|---|
| Ready | The task is ready to be worked on after it’s assigned to an agent. |
| Assigned | The task is assigned to an agent. |
| Work In Progress | The assigned agent is working on the task. |
| Complete | The task is complete. |
| Canceled | The task was canceled. |
NIST supports the following two models:
- NIST Stateful
This process definition enables analysts to move from one state to another in a sequential order without skipping any step. For example, if the Analyst starts with the Draft state, then the sequential order of this process definition is Draft>Analysis>Contain>Eradicate>Recover. So, the NIST Stateful process definition is unidirectional and enables analysts only to progress only to the forward states.
Here’s another example, if the Analyst starts with the Analysis state, then the sequential order of this process definition is Analysis>Contain>Eradicate>Recover.
- NIST Open
This process definition enables analysts to move from one state to another, either forward or backward. For example, if the Analyst starts with the Analysis state, then the order of the process definition can either be Analysis>Contain>Eradicate>Recover or Analysis>Draft. So, the NIST Open process definition is bidirectional and enables analysts to move to the forward or backward states depending on their requirements.
Security Incident Response Process Selection
Security Incident Response Process Selection lists processes with invalid states for security incidents and response tasks.
An administrator can correct the incident or task to valid states either manually or by using a script. An empty related list (no incidents; no tasks) indicates that every active task is in a valid state. Available states vary based on the current state of the incident. For more information, see Correct an invalid security incident or task state with process definition.
Select a Security Incident Response process definition
You can select the process definition to use for the appropriate states for your company security incidents and response tasks.
Before you begin
About this task
Procedure
-
Select the search icon to list the available process definitions.
Create a custom Security Incident Response process definition script include
Create a custom Process Definition script for the appropriate states for your company security incidents and response tasks.
Before you begin
About this task
Procedure
Process Definition script include
The Process Definition script include provides methods for defining a process definition.
Implement the constants, attributes, arrays, and method calls described here to customize a process definition script include.
Where to use
Use this script include to create a process definition.
Script include body
- Constants: Initial state definitions
- Security Incident and Response Task: Process definition arrays
- Method calls: Retrieving information
Constants
Constants are used to define the initial states of security incidents and response tasks.
INITIAL_INCIDENT_STATE: 10,
INITIAL_TASK_STATE: 1,
Which are later used by the following methods:
getInitialIncidentState: function() {
return this.INITIAL_INCIDENT_STATE;
},
getInitialTaskState: function() {
return this.INITIAL_TASK_STATE;
},The next set of constants defines the states for both security incidents and response tasks.
Each array also contains the definition of which states are available when the incident or task is in a specific state.
TASK_STATES: [{state:1, label:"Draft", choice:[1, 10]},
{state:10, label:"Ready", choice:[10, 16]},
{state:16, label:"Assigned", choice:[16, 18]},
{state:18, label:"Work in Progress", choice:[18, 3]},
{state:3, label:"Close Complete", choice:[]},
{state:7, label:"Cancelled", choice:[]},
],The example is an array of objects. Each object defines a state and possible transition states.
The order of the state's object determines the desired order for the flow.
When the task is in the 'Draft' state (value 1), possible states are: 1 (Draft, which is no change) and 10 (Ready, the next step in the process).
There is no limit on the number of transitions out of a state. The 'Close Complete' and 'Canceled' state are final states and therefore have no possible state transitions.
The order of the attributes in the object is not important. If it makes the definition clearer, put the label first.
Attributes
- state: numerical value of the state
- label: human readable text associated with the state
- choice: an array of state values the state can transition to (determines the content of the state dropdown)
- mandatory: list of field IDs that become mandatory in this state
- readonly: list of field IDs that become read-only in this state
- visible: list of field IDs that become visible in this state
- notmandatory: list of field IDs that become non-mandatory in this state
- notvisible: list of field IDs that would no longer be visible in this state
If optional attributes are used, it is the author's responsibility to ensure that fields are made visible/invisible, mandatory/non-mandatory, visible/hidden, or readonly appropriately between states.
For example, hiding a field in one state does not make it visible in another state later unless the 'visible' attribute is used.
Process flow definition arrays
To define the information displayed in the process flow formatter (the bar at the top of the Security Incident and Response task forms), the system requires information on what to display for each state.
TASK_PF: [{label:"Draft", condition:"state=1^EQ", description:"<p>Security Incident Response Task is in draft</p>"},
{label:"Ready", condition:"state=10^EQ", description:"<p>Security Incident Response Task is ready to be assigned</p>"},
{label:"Assigned", condition:"state=16^EQ", description:"<p>Security Incident Response Task is assigned</p>"},
{label:"Work in Progress", condition:"state=18^EQ", description:"<p>Work has started on this Security Incident Response Task</p>"},
{label:"Closed", condition:"state=3^ORstate=4^ORstate=7^EQ", description:"<p>Security Incident Response Task is complete</p>"},
],The TASK_PF array is a collection of labels, conditions, and descriptions used to determine the text displayed in the process formatter bar (including order and activity).
In the example, the text 'Ready' is the second item displayed. It is highlighted when the task satisfied the condition 'state=10^EQ'.
When the pointer hovers over the text, the description 'Security Incident Response Task is ready to be assigned' is displayed.
States can be combined to a single formatter state.
In the example, both the 'Close Complete' and the 'Canceled' states show up as 'Closed' in the top bar.
Method calls
| Return type | Method summary | Description |
|---|---|---|
| String | getInitialIncidentState: function() | return the initial incident state numerical value |
| String | getInitialTaskState: function(): | return the initial task state numerical value |
| Array of string | getIncidentStates: function(): | return the incident state's array |
| Array of string | getTaskStates: function(): | return the task state's array |
| Array of objects | getIncidentProcessFlows: function(): | return the incident process flow definition array |
| Array of objects | getTaskProcessFlows: function(): | return the task process flow definition array |
The next set of methods are called whenever an incident or a task is updated and allows actions to be taken on specific change transitions.
| Return type | Method summary | Description |
|---|---|---|
| void | performIncidentStateChange: function(current, previous) | In the examples, this method is used to set SM-related values and ensure that an incident advances out of 'Draft' once someone is assigned to it. |
| void | performTaskStateChange: function(current, previous) | In the example, this method is used to update timestamps (on assignment and closing) and advance the task from 'Ready' to 'Assigned' once the assigned_to field is filled. |
Correct an invalid security incident or task state with process definition
An administrator can correct the security incident or task to valid states, either manually or using a script. Available states vary based on the current state of the incident.
Before you begin
About this task
To change states in bulk, do the following:
Procedure
-
Double-click the State field in the first record, select the new State, and select the green check mark (
) to complete the change.
Create a security incident group
Set up a security incident group and assign the appropriate roles and users to the group.
Before you begin
- If you have the user_admin role, you can create security incident assignment groups.
- If you have the sn_si.admin role, you can create and edit security incident assignment groups.
About this task
It is a good practice to create as many groups as needed in your organization. It is also a good practice to create one group for administrators and assign the admin role to this group only.
Procedure
-
Make sure that you select the security incident type for
this group.
- If the Type field is not visible, configure the form to add it.
- Select the lock icon beside the Type field.
-
Select the reference lookup icon (
)
- Search for and select the security incident type.
Create a security incident calculator group
Security incident calculator groups are used to group calculators.
Before you begin
Procedure
Create a security incident calculator
Security incident calculators allow you to calculate the severity of a security incident based on pre-defined formulas. You can define your own security incident calculators, as needed.
Before you begin
Procedure
Understanding security incident calculators
Security incident calculators are used to update record values when pre-defined conditions are met. The calculators are grouped based on the criteria used to determine how the records are updated.
The Security Incident Response base system includes the following security incident calculator groups and calculators. Within each group, the first calculator that matches the conditions is run.
| Security Incident Calculator Group Name | Calculators included in group | Description |
|---|---|---|
| Business Impact | Aggregate from Severity Calculators | This calculator delegates to the Security Criticality Calculator that determines criticality by weighing the values of other fields. |
| Severity | Business Impacted | This severity calculator defines its selection criteria using a simple condition builder. |
| Critical service affected | This severity calculator defines its selection criteria using an advanced condition.
If the configuration item in the security incident is associated with a highly critical business service, the Risk score, Business Impact, and Priority fields are elevated as defined by the calculator. |
|
| Critical service changes | This severity calculator defines its selection criteria using an advanced condition.
If the security incident meets the conditions, a script runs to define what levels the fields are elevated to. If the configuration item in the security incident is associated with a most critical or somewhat critical business service, the Risk score, Business Impact, and Priority fields are elevated as defined by the calculator. |
|
| Multi-Attack Vectors | This severity calculator defines its selection criteria using a simple condition
builder. If the configuration item in the security incident is associated with web, email, and impersonation attack vectors, the Risk score, Business Impact, and Priority fields are elevated as defined by the calculator. |
|
| Set priority with category and services | This severity calculator defines its selection criteria using an advanced condition
builder. The security incident priority is set to 1 - Critical
when the following conditions are met:
Note: This calculator is available in the base system when you have the Starter
Security Operation pricing tier. |
|
| Set priority with observables | This severity calculator defines its selection criteria using an advanced condition
builder. The security incident priority is set to1 - Critical when
the following conditions are met:
Note: This calculator is available in the base system when you have the Advanced
Security Operation pricing tier and you activate the Threat Feeds
plugin. |
|
| User criticality | Get user criticality | This severity calculator defines its selection criteria using a simple condition
builder. This severity calculator causes user business criticality to change to 1 - Critical when the Department field is changed to Finance. |
| Get user group criticality | This severity calculator defines its selection criteria using an advanced condition
builder. This severity calculator provides example of a calculator that runs on data in a related list. |
Severity calculators
When you create a security incident, the Risk score, Business Impact, and Priority fields contain default values. When you save the incident, a business rule automatically validates the information in the security incident against conditions defined in each of your active severity calculators. They are validated one security calculator at a time, in the order defined by the Order field in each calculator. If information in the security incident matches the conditions defined in one of the calculators, the severity field values are updated accordingly to the rules set up in the calculator.
For example, assume that you create a security incident for an affected CI, and the CI is highly critical. When the security incident is saved, the CI information is compared to the conditions defined in the severity calculators. When the security incident is validated against the Critical service affected severity calculator, the severity fields are automatically updated, and a message appears at the top of the security incident.
- [Attack Vector] [contains] [Web]
- [Attack Vector] [contains] [Email]
- [Business Unit] [contains] [Finance]
You can also update the severity values in an existing security incident at any time by opening the record and clicking the Calculate Severity related link.
Security incident risk score calculators
The Set priority with category and services and Set priority with observables calculators are used to calculate a risk score for a security incident.
User criticality calculators
The two calculators in the User criticality group (Get user criticality and Get user group criticality) provide examples of how you can drive criticality based on criteria defined in a user record or based on the group to which a user belongs.
They can be edited as needed, or new user criticality calculators can be created.
The Get user criticality calculator causes user business criticality to change to 1 - Critical when the Department field is changed to Finance.
var CRITICAL_GROUPS = [group1_sys_id, group2_sys_id,
group3_sys_id].Security incident risk score calculations
The risk score is calculated as an arithmetic mean that represents the risk based on the priority of a security incident, the type of security incident (Denial of Service, Spear Phishing, or Malicious code activity), and the number of sources that triggered a failed reputation score on an indicator.
- Calculate Severity
- Update risk score
- Update SI risk score
For example, if a security incident has a Business impact set to 2-High and a Priority set to 3-Moderate, the respective weights in the Risk Score Weights table are looked up and calculated thus:
Security Incident Business Impact with a value of 2 = a weight of 60.
Security Incident Priority with a value of 3 = a weight of 40.
(60 + 40)/2 = a risk score of 50.
The position of the security incident in the security incident list is then re-ordered based on its updated risk score.
- Business impact on the Security Incident form
- Priority on the Security Incident form
- Severity on the Security Incident form (hidden by default)
- Business impact on the Affected Users related list
- Business impact on the Affected Services related list
- Business impact on vulnerabilities on the Vulnerable items related list
- When an association between affected users and a security incident is created or modified
- When an association between affected services and a security incident is created or modified
- When an association between vulnerable items and a security incident is created or modified
Work notes are also updated whenever Update All Risk Scores and Clear All Risk Scores on the Risk Score Weights form are clicked.
Maintain risk score weights
The risk score weights used to calculate risk scores in security incidents can be removed or updated on an individual basis. They can also be removed or updated for all security incidents. The ability to remove them from security incidents is useful when changing weight values.
Before you begin
Procedure
Create a Security Incident Response SLA
You can define a Service Level Agreement (SLA) for Security Incident Response.
Before you begin
Role required: sn_si.admin
Procedure
Repair security incident SLAs
You can repair SLA records to ensure that SLA timing and duration information is accurate.
Before you begin
Procedure
Create a Security Incident Response runbook
A runbook is an association between a published knowledge article and a specific task. While you are performing the task, a knowledge article in the runbook automatically opens, providing information pertinent to the task.
Before you begin
Role required: sn_si.knowledge_admin
About this task
Procedure
Create rules to validate user-reported phishing attacks
When your employees receive emails that appear to be phishing attacks, they can report them to you using a phishing email address. The suspicious email is validated using rules defined by your organization.
Before you begin
- Define an email address such as acme+phishing@service-now.com. The +phishing tag is supported by SMTP to enable filtering and your instance can receive emails sent to it.
- Define an email address, such as phishing@acme.com (your Exchange mailbox), which in turn forwards it to acme+phishing@service-now.com (your instance mailbox defined through a mail forwarding rule).
Role required: sn_sec_cmn.write
About this task
When an employee encounters a suspicious email, they should forward it as an attachment to your phishing email address. If the attached email matches a rule defining a threat, a security incident is created.