Skip to main contentSkip to search
Powered by Zoomin Software. For more details please contactZoomin
Product Documentation | ServiceNowProduct Documentation | ServiceNow
Product Documentation | ServiceNow
  • Home
  • Technical Documentation
  • Release Notes
  • API Implementation
  • Accessibility
  • EnglishDeutsch日本語한국어FrançaisPortuguês
  • CommunityAsk questions, give advice, and connect with fellow ServiceNow professionals.
    DeveloperBuild, test, and deploy applications
    DocumentationFind detailed information about ServiceNow products, apps, features, and releases.
    ImpactAccelerate ROI and amplify your expertise.
    LearningBuild skills with instructor-led and online training.
    PartnerGrow your business with promotions, news, and marketing tools
    ServiceNowLearn about ServiceNow products & solutions.
    StoreDownload certified apps and integrations that complement ServiceNow.
    SupportManage your instances, access self-help, and get technical support.

Xanadu Security Management

ServiceNow Security Operations add-on for Splunk overview

Save as PDF
Save topicSave topic & subtopicsSave entire publication
Share this page
Share to emailCopy latest version URL
Print
Table of contents
  • Security Operations
    • Exploring Security Operations
    • Now Assist for Security Incident Response
      • Exploring Now Assist for Security Incident Response
        • Supporting information for Now Assist for Security Incident Response
      • Configuring Now Assist for Security Incident Response
        • Configure and activate a skill for Now Assist for Security Incident Response
        • Customize a Now Assist for Security Incident Response skill
        • Inputs and triggers for Now Assist for Security Incident Response
      • Using Now Assist for Security Incident Response to close security incidents
        • Summarize a security incident with Now Assist for Security Incident Response
        • Generate closure notes for a security incident with Now Assist for Security Incident Response
        • Generate recommended actions for a security incident with Now Assist for Security Incident Response
          • Generate recommended actions in UI16 for a security incident with Now Assist for Security Incident Response
        • Generate a post-incident analysis for a security incident with Now Assist for Security Incident Response
          • Generate a post-incident analysis in UI16 for a security incident with Now Assist for Security Incident Response
        • Exploring correlation insights with Now Assist for Security Incident Response
          • Generate correlation insights from the Security Incident Response Workspace with Now Assist for Security Incident Response
          • Generate correlation insights with Now Assist for Security Incident Response
        • Request generative AI skills in the Now Assist panel for Now Assist for Security Incident Response
      • Using AI agentic workflows in Now Assist for Security Incident Response
        • Activate an agentic workflow for Now Assist for Security Incident Response
        • Security Incident Response AI agent collection close security incident use case
          • Close a security incident
        • Security Incident Response AI agent collection Resolve security incident agentic workflow
          • Resolve a security incident
        • Security Incident Response AI agent collection for the Analyze security operations metrics agentic workflow
          • Analyze security operations metrics agentic workflow
    • Now Assist for Vulnerability Response
      • Exploring Now Assist for Vulnerability Response
        • Supporting information for Now Assist for Vulnerability Response
      • Configuring Now Assist for Vulnerability Response
        • Activate an agentic workflow for Now Assist for Vulnerability Response
      • Using agentic workflows in Now Assist for Vulnerability Response
      • Vulnerability Response AI agent collection for the Assess vulnerability exposure agentic workflow
        • Assess vulnerability exposure agentic workflow
      • Vulnerability Response AI agent collection for the Analyze vulnerability remediation status agentic workflow
        • Analyze vulnerability remediation status agentic workflow
    • Unified Security Exposure Management (USEM)
      • Exploring Unified Security Exposure Management (USEM)
        • Security Exposure Management Workspace
          • Administration in Unified Security Exposure Management
            • Visualization library
          • Viewing the Cloud Exposure View dashboard
          • Security Exposure Management Approvals View
          • Security Exposure Management Workspace Findings view
          • Remediation view
          • Security Exposure Management Workspace List view
          • Security Exposure Management Workspace Watch Topics
        • Security Exposure Management Workspace Health dashboard
        • Security Exposure Management workflow
          • Automating prioritization and triaging
            • Associating finding with a configuration item using lookup rules
              • Managing unmatched configuration items (CIs)
              • Managing unclassed hardware
              • Steps to help prevent duplicate or orphaned records after running lookup rules
            • Categorizing findings and discovered items using classification rules
            • Prioritizing vulnerabilities and other findings using roll-up calculators
              • Vulnerability Response Rollup Calculators
            • Assigning findings to remediation teams using assignment rules
              • Removing assignments from findings and remediation tasks
            • Defining your own service level agreements (SLAs) using remediation target rules
            • Deferring findings automatically without manual intervention using exception rules
            • Grouping multiple findings as remediation tasks for easy processing using remediation task rules
            • Closing stale detections and findings automatically using auto-close rules
            • Deleting stale findings automatically using auto-delete rules
            • Controlling the ingestion volume with automatic exclusion
            • Severity mapping for Unified Security Exposure Management
      • Implementing Unified Security Exposure Management
        • Migrate to Unified Security Exposure Management (USEM) from Vulnerability Response
        • Installing Security Exposure Management Workspace applications
          • Migration upgrade prerequisites
          • Install Unified Security Exposure Management
          • Download and activate applications
        • Security Exposure Management Workspace Roles
        • Access control lists (ACLs) for administration rules
        • Security Exposure Management Workspace personas and granular roles
          • Assign the Vulnerability Response persona roles using Setup Assistant
            • Manage persona and granular roles for Vulnerability Response
        • Configure rules to manage findings
          • Configuring lookup rules
          • Configuring classification rules
          • Configuring roll-up calculator rules
          • Configuring assignment rules
          • Configuring remediation target rules
          • Configuring an exception rule
            • Create an exception rule
            • Approve an exception rule request
            • Activating an exception rule
            • Reopen an exception rule
            • Update an approved exception rule
            • Delete an exception rule
          • Define fields and weights for the risk rule for Unified Security Exposure Management risk calculators
          • Configuring remediation task rules
          • Configuring auto-close rules
          • Configuring auto-delete rules
          • Configuring exclusion rules
            • Create or edit exclusion rules
          • Approve or reject an unassign request
          • Approval workflow configurations for unassign request
        • Configure Exception Management for Security Exposure Management
          • Request an exception using GRC: Policy and Compliance Management
          • Specify the duration of an exception requested for a remediation task
        • Configure email notifications in Unified Security Exposure Management
        • Configure email templates in Unified Security Exposure Management
        • Configure a severity map in the Security Exposure Management Workspace
        • Configure Visualization library
          • Create a custom widget
          • Update a widget
          • Localize widget titles
      • Unified Security Exposure Management integrations
        • Review Unified Security Exposure Management integrations
      • Using Unified Security Exposure Management
        • Create a dashboard in the Findings view page
        • Reclassify unclassed hardware
        • Bulk edit in the Security Exposure Management Workspace
          • Using bulk edit in the Security Exposure Management Workspace
            • Update the state of records in bulk in the Security Exposure Management Workspace
            • Bulk edit host vulnerable items with patches and solutions
            • Assign records to an assignment group in bulk
            • Remove assignments for host vulnerable items in bulk
            • Request bulk exception in the Security Exposure Management Workspace
            • Bulk edit for false positive in the Security Exposure Management Workspace
            • Close records in bulk in the Security Exposure Management Workspace
        • Use the List view in the Security Exposure Management Workspace
          • Create a customized list of records
        • Create a remediation task manually in the Security Exposure Management Workspace
        • Enable or disable the import of test results for a Qualys test group
        • Modify the severity for a CVE or TPE
        • Use Remediation Effort records
          • Create a remediation effort in the Security Exposure Management Workspace
          • Create a remediation task on-demand from Remediation Effort in the Vulnerability Manager Workspace
          • Create a recurring remediation effort in the Security Exposure Management Workspace
          • Transfer records to remediation efforts in the Security Exposure Management Workspace
        • Approve or reject requests in the Security Exposure Management Workspace
        • Add a compensating control to the library
          • Associate compensating controls with CVEs or TPEs for risk reduction requests
          • Disable or enable risk reduction for a CVE or TPE
        • Examples for remediation task creation in the Security Exposure Management Workspace
        • Exception Management Overview
          • Approver roles required for Security Exposure Management Workspace
          • Questionnaire support in Exception Management via Smart Assessment
            • Questionnaire Configuration form fields
            • Configure an assessment template
            • Use case for False positive or Request Exception Questionnaire
          • Defer a Remediation task
          • Request an extension for a deferred remediation task
          • Request a false positive for a vulnerable item or remediate task
        • Unified Approvals View
          • Add an approver
          • Configure Approval List and Form View
          • Reviewing an Approval Request
          • Review questionnaire to approve or reject requets
        • Employee service center for Vulnerability Response
          • Managing Approvals via the Employee Service Center
      • Unified Security Exposure Management reference
        • Security Exposure Management Workspace Components
          • Security Exposure Management Workspace Roles
          • Security Exposure Management Workspace Tables
          • Security Exposure Management Workspace Scheduled Jobs
        • Security Exposure Management Knowledge Base articles
        • Security Exposure Management Workspace remediation task rule examples
        • Migration upgrade reference information
        • Security Exposure Management Workspace Roles
        • Visualization widget fields
        • Re-evaluating the exceptions for selected records in the Security Exposure Management Workspace
      • Vulnerability Response
        • Exploring the Vulnerability Response application
          • Migrating from Vulnerability Response to Unified Security Exposure Management (USEM)
            • Planning for migration from Vulnerability Response to Unified Security Exposure Management (USEM)
          • Installation of Vulnerability Response and supported applications
          • Vulnerability Response personas and granular roles
          • Vulnerability Response assignment rules overview
          • Vulnerability Response remediation tasks and remediation task rules overview
          • Vulnerability Response remediation target rules
          • Vulnerability classification groups and rules
          • Machine Learning solutions for Vulnerability Response
          • CI lookup rules for identifying configuration items from Vulnerability Response third-party vulnerability integrations
            • Unclassed hardware
            • Unmatched CIs
          • Creating CIs for Vulnerability Response using the Identification and Reconciliation engine
            • Updating CI class for unmatched cloud assets
          • Discovered Items
            • CI changes for discovered items
            • Re-evaluating discovered items
          • Vulnerability Response remediation task and vulnerable item states
            • Vulnerable item age calculation and display
          • Removing assignments from vulnerable items and remediation tasks
          • Vulnerability Response calculators and vulnerability calculator rules
          • Vulnerability Response vulnerable item detections from third-party integrations
          • Vulnerability Solution Management
            • Understanding the Microsoft Security Response Center Solution Integration
            • Understanding the Red Hat Solution Integration
            • Rapid7 solution management
            • Generic framework to ingest data from any solution vendor
          • Patch orchestration with Vulnerability Response
          • Exception Management overview
          • Exception rules overview
          • Exclusion rules overview
          • False Positive overview
          • Questionnaire support in Exception Management via Smart Assessment
            • Configure Assessment template
            • Smart Assessment workflow
            • Questionnaire for False positive or Request Exception
          • Watchdog for Vulnerability Response
          • Change management for Vulnerability Response
          • Software exposure assessment using Software Asset Management (SAM Foundation)
          • Vulnerability Crisis Management
          • Domain separation and Vulnerability Response
          • Service Mapping in Vulnerability Response
        • Vulnerability Response implementation
          • Migrate to Unified Security Exposure Management (USEM) from Vulnerability Response
          • Install Vulnerability Response
            • Components installed with Vulnerability Response
          • Configuring Vulnerability Response using the Setup Assistant
            • Assign the Vulnerability Response persona roles using Setup Assistant
              • Manage persona and granular roles for Vulnerability Response
            • Install Vulnerability Response third-party applications using Setup Assistant
              • Importing data with the NVD and CWE integrations and managing third-party libraries
              • Install the Solution Management for Vulnerability Response application
              • Install and configure the Performance Analytics for Vulnerability Response [PA] application
            • Vulnerability Response applications and CSDM tables
            • Create or edit Vulnerability Response assignment rules
            • Create a Vulnerability Response assignment rule using ML
            • Create a Vulnerability Response assignment rule for service support
            • Create or edit Vulnerability Response remediation task rules
            • Define fields and weights for the risk rule for Vulnerability Response Risk Calculators
            • Vulnerability Response Rollup Calculators
            • Create or edit a Vulnerability Response remediation target rule
              • Recalculate a remediation target date
                • Examples of recalculating a remediation target date
            • Configure installed third-party integrations using the Setup Assistant
              • Configure installed solution integrations for Vulnerability Solution Management using Setup Assistant
              • Configure the MS TVM Vulnerability Integration using Setup Assistant
              • Configure the Qualys Vulnerability Integration using Setup Assistant
              • Configure the Tenable Vulnerability Integration using Setup Assistant
            • Setting up vulnerability solution providers
              • Prepare solution integration checklist
                • Preparing the Common Vulnerability Reporting Framework (CVRF) solution integration
                • Preparing the Common Security Advisory Framework (CSAF) solution integration
              • Configure vulnerability solution providers
                • Common Vulnerability Reporting Framework (CVRF)
                  • Import Common Vulnerability Reporting Framework data through file import
                  • Configure Connection and Credential aliases
                  • Configure a Common Vulnerability Reporting Framework vendor other than Cisco
                  • Import Common Vulnerability Reporting Framework data from advisories
                  • Import Common Vulnerability Reporting Framework (CVRF) data through CVRF URL
                  • Troubleshooting Common Vulnerability Reporting Framework data import
                • Common Security Advisory Framework (CSAF)
                  • Import Common Security Advisory Framework data through file import
                  • Configure Connection and Credential aliases for the Common Security Advisory Framework (CSAF)
                  • Configure a Common Security Advisory Framework vendor other than Red Hat
                  • Import Common Security Advisory Framework data from advisories
                  • Import Common Security Advisory Framework (CSAF) data through CSAF URL
                  • Troubleshooting Common Security Advisory Framework data import
          • Additional Vulnerability Response setup and configuration tasks
            • Quick start tests for Vulnerability Response
              • Run the Automated Test Framework (ATF) test suite for Vulnerability Response
            • Install Vulnerability Assignment Recommendations for Vulnerability Response
              • Configure Vulnerability Assignment Recommendations for Vulnerability Response
              • Create and train a solution definition for Vulnerability Response
            • Create a Vulnerability Response calculator
              • Disable the default vulnerability calculator if not used
            • Create, enable, or, modify Vulnerability Response auto delete rules
            • Add vulnerability significance charts to the Vulnerability Response homepage
            • Define Vulnerability Response email notifications
              • Define Vulnerability Response email templates
              • Create or edit remediation target notifications
            • Configure the Vulnerability Exposure Assessment
            • Configure Exception Management for Vulnerability Response
              • Add an exception approver
            • Configure approval rules for Exception Management
              • Create configurations for an approval rule
              • Create approval levels for Exception Management
              • Exception management workflow versus flow designer
            • Add a false positive approver
            • Configure questionnaire for risk reduction
            • View Vulnerability Response SLAs for remediation tasks
            • Configure watchdog
            • Configure maximum rows in related list
          • Advanced Vulnerability Response configuration tasks
            • Create domain-separated imports for an integration
              • Create and support multiple domains in the background jobs framework
            • Create a Vulnerability Response CI lookup rule
              • Ignore CI classes
              • Filter decommissioned CIs
              • Auto-promote CIs
            • Configure the vulnerable item key
              • Adding proof to Rapid7 vulnerable item keys
              • Delete all your vulnerable item records and related data in Vulnerability Response
            • Filtering within Vulnerability Response
            • Severity mapping for Vulnerability Response
            • Create a Vulnerability Response severity map
            • Define service classifications for Vulnerability Response reporting and related lists
            • Audit selected fields in the vulnerable items table
            • Vulnerability Response background job framework configuration
              • Define background job configurations in Vulnerability Response
              • Advanced parallel processing for background jobs in Vulnerability Response
        • Vulnerability Response integrations
          • Understanding the NVD integrations
            • Preparing for the NVD integrations
            • Configure and run the scheduled job for updating CWE records
            • Install the Vulnerability Response Integration with the NIST National Vulnerability Database
            • Optional NVD integration modification and activities
              • Perform a manual NVD integration import
            • View the (National Vulnerability Database) NVD integration import run status
            • Add CVEs to third-party entries
            • View Vulnerability Response vulnerability libraries
          • CISA Known Exploit Vulnerability (KEV) Integration
            • Preparing for the CISA integration
            • Install the ServiceNow Vulnerability Response Integration with CISA application
          • Understanding the Exploit Prediction Scoring System (EPSS) integration
            • Configure and run a scheduled job to update CVE records with EPSS data
            • Add EPSS Score condition in Risk calculator Business Rule
          • Understanding the Microsoft Threat and Vulnerability Management Vulnerability integration
            • Preparing for the Microsoft Threat and Vulnerability Management Vulnerability Integration
            • Set up Microsoft Azure for the MS TVM integration
            • Install and configure the Vulnerability Response Integration with the MS TVM application using Setup Assistant
            • Data retrieval settings for the Microsoft Threat and Vulnerability Management Integration
            • REST messages for the Microsoft Threat and Vulnerability Management Vulnerability Integration
              • Data transformation for the Microsoft Threat and Vulnerability Management Vulnerability Integration
            • Integration run status chart for the Microsoft Threat and Vulnerability Management Vulnerability Integration
              • Verify the Microsoft Threat and Vulnerability Management integration import run status
            • Split Microsoft TVM detections based on the vulnerability instance to split vulnerable items
          • Understanding the HCL BigFix patch orchestration integration with Vulnerability Response
            • Integrations and dependencies of the Vulnerability Response Patch Orchestration integration with HCL BigFix
            • Prepare for the Vulnerability Response Patch Orchestration integration with HCL BigFix
            • Install the Vulnerability Response Patch Orchestration with HCL BigFix application
            • Configure the Vulnerability Response patch orchestration integration with HCL BigFix
            • Viewing patch data for the Vulnerability Response patch orchestration integration with HCL BigFix
            • Schedule patches with the Vulnerability Response patch orchestration integration HCL BigFix
            • REST messages for the Vulnerability Response patch orchestration integration with HCL BigFix
            • Data transformation for the patch orchestration integration with HCL BigFix
            • Example workflow for the Vulnerability Response patch orchestration integration with HCL BigFix
          • Understanding the Vulnerability Response patch orchestration integration with Microsoft SCCM
            • Integrations and dependencies of the Vulnerability Response Patch Orchestration with the Microsoft SCCM application
            • Prepare for the Vulnerability Response patch orchestration integration with Microsoft SCCM
            • Install the Vulnerability Response Patch Orchestration with Microsoft SCCM application
            • Configure the Vulnerability Response Patch Orchestration with Microsoft SCCM integration
            • Viewing patch data and patch data rollup for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM
            • Schedule patches with the Microsoft SCCM integration with Vulnerability Response
            • REST messages for the Vulnerability Response Patch Orchestration with Microsoft SCCM
            • Data transformation for the Patch Orchestration with Microsoft SCCM Integration
            • Example workflow for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM
          • Understanding the Qualys Vulnerability Integration
            • Preparing for the Qualys Vulnerability Integration
            • Install the Qualys Vulnerability Integration
              • Activate the Qualys scanners
              • Components installed with the Qualys Vulnerability Integration
            • Update configuration items with the network partition identifier for the Qualys Vulnerability Integration
            • Optional Qualys modifications
            • Advanced Qualys configurations and modifications
            • Qualys metadata for vulnerabilities
              • Import additional metadata from Qualys
              • Qualys metadata values for vulnerabilities
              • Set additional filter parameters for Qualys imports
            • Resolving Qualys Vulnerability Integration issues
            • Qualys Vulnerability Integration reporting
              • Qualys integration run status chart
            • Qualys data transformation
              • Dynamic Search List Import
              • Static Search List Import
              • Asset Group Import
              • Appliance Import
            • Qualys REST messages
          • Understanding the Rapid7 Vulnerability Integration
            • Preparing for the Rapid7 Vulnerability Integration
              • Set up for the Rapid7 data warehouse Integration
              • Set up for the Rapid7 InsightVM Integration
            • Install the Rapid7 Vulnerability Integration
              • Configure the Rapid7 Vulnerability Integration
              • Filtering by Rapid7 sites
                • Prepend SITE to your Rapid7 InsightVM site tags
              • Deduplicate Rapid7 Vulnerability Integration data warehouse records
            • Rapid7 Vulnerability Integration run status chart
              • View the Rapid7 Vulnerability Integration import runs status dashboard
            • Initiate rescan for the Rapid7 Vulnerability Integration
            • Set additional filter parameters for Rapid7 InsightVM imports
          • Understanding the Shodan Exploit Integration
            • Preparing for the Shodan Exploit Integration
            • Install and configure the Shodan Exploit Integration for Security Operations
              • Set Shodan Exploit Integration import time
              • Perform a manual Shodan exploit import
            • View the Shodan Exploit Integration import run status
          • Understanding the Tenable Vulnerability Integration
            • Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications
            • Tenable.sc integrations with the Vulnerability Response application
            • Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application
            • Preparing for the Tenable Vulnerability Integration
            • Install the Vulnerability Response Integration with Tenable application using Setup Assistant
            • Data retrieval settings for the Tenable Vulnerability Integration
            • REST messages for the Tenable Vulnerability Integration
              • Data transformation for the Tenable Vulnerability Integration
            • Set additional filter parameters for Tenable.io imports
            • Tenable Vulnerability Integration reporting
              • Integration run status chart for the Tenable Vulnerability Integration
            • Initiate rescan for the Tenable.sc integration
            • Initiate rescan for the Tenable.io integration
            • Update configuration items with the network partition identifier for the Tenable Vulnerability Integration
            • Import modifications for the Tenable Vulnerability Integration
            • Split Tenable detections based on the vulnerability instance to split vulnerable items
          • Understanding the Atlassian Jira integration with Vulnerability Response
            • Preparing for the Jira Vulnerability Response integration
            • Install the Vulnerability Response Integration with Jira
            • Configure rules in the agile tool configuration
              • Create agile issue manually using list action
              • Create agile issue manually using form action
            • Manually synchronize the status of the Jira issue
              • Configure scheduler to create issues automatically
              • Configure scheduler to update issues automatically
              • Configure scheduler to synchronize the Jira status to ServiceNow automatically
          • Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
            • Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
            • Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
            • Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application
            • Integration run status chart for Prisma Cloud Compute Integration
          • Understanding the Wiz Vulnerability Response Integration
            • Activate the Wiz Vulnerability Response Integration application
            • Configure the Wiz Vulnerability Response Integration
              • Identify Wiz Resource types for the Wiz Vulnerability Integrations
              • Set filtering for the Wiz Host Vulnerabilities Integration
              • Set filtering for the Wiz Container Vulnerabilities Integration
                • Configure Container image vulnerability keys for the Vulnerability Response Integration with Wiz
              • Set filtering for the Wiz Test Results Integration
              • Set filtering for the Wiz Issues Integration
              • Set filtering for the Wiz Host Test Results Integration
              • Wiz Backfill Integrations
            • Schedule the Wiz Vulnerability Integrations
            • Field mapping for the Wiz Vulnerability Response Integrations
          • Manually create a vulnerability integration
            • Define a new vulnerability integration
              • Vulnerability integration script
                • Single call integrations
                • Multiple call integrations
                • Attachments as retrieveData() return values
              • Report processor strategies
                • Use the data source attachment report processor strategy
                • About custom report processor scripts
              • Integration factory script fields
            • Manually run a vulnerability integration
          • Manual ingestion of vulnerabilities
            • Ingest vulnerabilities manually
            • Verify manual integration run
            • Configure auto-close manual detections
            • Verify upload status
            • Template for manual ingestion of vulnerabilities
        • Vulnerability Response remediation overview
          • Verify successful completion of Vulnerability Response integration imports
          • View Vulnerability Response vulnerable item detection data
            • Verify Vulnerability Response vulnerable item detection data on integration run (VINTRUN) records
          • Viewing patch data and scheduling patches in Vulnerability Response
            • Patch data and state rollup for patch orchestration in Vulnerability Response
            • View patches without solutions in Vulnerability Response
            • Viewing patch orchestration data on the Vulnerability Response dashboards
          • View a solution
          • Create a vulnerability solution
            • Manually exclude solutions from third-party records or vice versa
          • Triage vulnerabilities automatically
            • Edit vulnerable items in bulk in Vulnerability Response
            • Ungrouped Vulnerability Response vulnerable items
              • View ungrouped Vulnerability Response vulnerable items
              • Manually add a vulnerable item to a remediation task
            • Remove assignments from vulnerable items and remediation tasks
            • Approve or reject an unassign request in Vulnerability Response
            • Automatic closing of vulnerable items and detections
              • Working with retired configuration items
              • Automatically close vulnerable items related to retired CIs
            • Closing stale detections in Vulnerability Response
              • Automatically close stale detections in Vulnerability Response
              • Create auto-close rules
            • Reclassify unclassed hardware
          • Manually create a remediation task in Vulnerability Response
            • Add users to the Vulnerability Response group
          • Manage individual vulnerable items manually
            • Create Vulnerability Response vulnerable items
              • Defer a vulnerable item
                • Request an extension for a deferred vulnerable item
            • Refresh Vulnerability Response vulnerable items
              • Identify and escalate security issues in third-party software
              • Identify and escalate security issues using NVD
              • Identify and escalate security issues using CWE
              • View the remediation target status of a Vulnerability Response vulnerable item
          • Working with unmatched CIs
            • View and reclassify unmatched configuration items
            • Reconcile unmatched discovered items
              • Reapply CI lookup rules on selected discovered items
              • Reapply CI Lookup Rules Enhancements
            • Steps to help prevent duplicate or orphaned records after running Vulnerability Response CI lookup rules
            • De-duplicating existing configuration items
            • Working with unmatched CIs
              • Resolve remediation tasks
                • Defer a Remediation task
                  • Request an extension for a deferred remediation task
                • Close a remediation task
          • Identifying duplicate vulnerable items from multiple scanners
            • Automatically resolve duplicate vulnerabilities
          • Create and edit a classification group
            • Create and edit a classification rule
            • Apply a rule to an existing vulnerability
            • Deactivate or delete a classification rule
          • Create an exclusion rule
          • Change Management tasks for Vulnerability Response
            • Create a change request from a remediation task
            • Associate a remediation task to an existing change request
            • Split a remediation task
            • State synchronization between change requests and remediation tasks
          • Assess your exposure to vulnerable software
          • Viewing assignment recommendations
            • Request assignment group recommendations for a vulnerable item
            • Request assignment group recommendations for multiple vulnerable items
            • Request assignment group recommendations for a remediation task
          • Requesting and approving an exception
            • Request an exception for a vulnerable item
            • Request an exception for a remediation task
            • Request a bulk exception
            • Request an exception using GRC: Policy and Compliance Management
              • Request a bulk exception using GRC: Policy and Compliance Management
            • Approve or reject an exception request in Vulnerability Response
          • Working with an exception rule
            • Create an exception rule
            • Approve an exception rule request
            • Activating an exception rule
            • Request an extension for an exception rule
            • Reopen an exception rule
            • Update an approved exception rule
            • Delete an exception rule
          • Marking and approving a false positive
            • Mark as a false positive
              • Bulk edit for false positive
            • Approve or reject a false positive
        • Analytics and Reporting Solutions for Vulnerability Response
          • Using the default Vulnerability Response dashboards
          • Platform Analytics Solutions for Vulnerability Management
            • Vulnerability Management CISO dashboard
              • Configure the Scan Coverage reports
              • Configure the PA indicators for the CISO Dashboard
            • SecOps Vulnerability Response Health dashboard
              • Modifying the threshold values
          • Vulnerability Management (PA) dashboard
            • View Performance Analytics for Vulnerability Response [PA] reports in real-time
            • View the Performance Analytics indicators for Vulnerability Response [PA]
          • Aggregated reports framework
            • Configure an aggregation for source data
              • Run multiple aggregations simultaneously
              • Configure the number of aggregations that can run simultaneously
            • Create a report using an aggregation
        • Vulnerability Response reference information
          • Implementation checklist for the Vulnerability Response application
          • Vulnerability Response remediation task states
            • Detections, remediation tasks, and vulnerable item states
            • Remediation tasks and vulnerable item states
            • State roll-up and roll-down scenarios
            • Remediation task state for Vulnerable Items (VITs) in multiple groups
          • Additional settings for domain separation
          • Discovered Items form fields
          • Vulnerability Response vulnerability form fields
          • Remediation target rule fields
          • Remediation task form fields
          • Questionnaire Configuration form fields
          • Vulnerability Response vulnerable item form fields
          • Solution form fields
          • Approval workflow configurations for unassign request
          • Vulnerability Response remediation task rule examples
          • Risk score calculation example for Vulnerability Response
          • Error handling for detections
        • Mobile experience for Vulnerability Response
          • Set up checklist for the Vulnerability Response Mobile app
          • Log in to the Vulnerability Response Mobile app
          • View, assign, and edit remediation tasks with the Vulnerability Response Mobile app
          • View, reassign, and edit remediation tasks assigned to you with the Vulnerability Response Mobile app
          • Search for remediation tasks with the Vulnerability Response Mobile app
          • Filter records with the Vulnerability Response Mobile app
        • Vulnerability Response Orchestration
          • Scan vulnerability workflow
          • Scan vulnerability item workflow
          • Variables for Create Scan Record for Vulnerabilities activity
      • Application Vulnerability Response
        • Exploring Application Vulnerability Response
        • Configuring Application Vulnerability Response
          • Configure Application Vulnerability Response
            • Verify that the scheduled job for updating CWE records is running
            • Verify that the scheduled job for updating NVD records is running
            • Activate Application Vulnerability Response Integrations
            • Define Application Vulnerability Response email notifications
              • Create or edit remediation target notifications in Application Vulnerability Response
            • Exception Management in Application Vulnerability Response
              • Configure Exception Management for Application Vulnerability Response
              • Configure approval rules for Exception Management
              • Deferring remediation in Application Vulnerability Response
              • Add an exception approver for Application Vulnerability Response
              • Requesting and approving an exception in Application Vulnerability Response
                • Request an exception for an application vulnerable item
                • Request an exception for application vulnerabilities using GRC: Policy and Compliance Management
                • Request an exception for an application remediation task
                • Approve exception rules and exception rule extension requests in Application Vulnerability Response
                • Define policy reason mapping
                • Request an extension for an exception rule in Application Vulnerability Response
                • Request an extension for a deferred remediation task in Application Vulnerability Response
                • Request an extension for a deferred application vulnerable item in Application Vulnerability Response
              • Create, delete, and cancel an exception rule for Application Vulnerability Response
            • Application Vulnerability Response remediation tasks and task rules overview
              • Create, edit, and delete Application Vulnerability Response remediation task rules
              • Create an application remediation task manually in Application Vulnerability Response
              • Create auto-close rules
          • Configure penetration testing
            • Configure sprints for penetration testing
            • Configure assessment types for penetration testing
        • Integrating Application Vulnerability Response with other applications
          • Vulnerability Response Integration with Black Duck
            • Prepare pre-integration tasks for Vulnerability Response Integration with Black Duck
            • Install the ServiceNow Vulnerability Response Integration with Black Duck
            • Configure the Vulnerability Response Integration with Black Duck
              • View the Vulnerability Response Integration with Black Duck import run status
            • Data transformation for the Vulnerability Response Integration with Black Duck
            • Import the project information from the Black Duck integration instance
              • Import Vulnerability Response Integration with Black Duck project versions to the Discovered Applications table
              • Import the application vulnerable items from the Vulnerability Response Integration with Black Duck
              • Set the import times for the Vulnerability Response Integration with Black Duck
              • Include Closed Black Duck application vulnerable items
          • Fortify on Demand Vulnerability Integration
            • Preparing for the Fortify on Demand Vulnerability Integration
            • Install the ServiceNow Vulnerability Response Integration with Fortify on Demand
            • Configure the Fortify on Demand Vulnerability Integration
            • View the Fortify Vulnerability Integration import run status
            • Fortify on Demand Vulnerability modification and activities
              • Perform a manual Fortify application vulnerability import
              • Import data using the Fortify on Demand Vulnerability Integration
              • Include Closed Fortify on Demand application vulnerable items
          • GitHub Application Vulnerability Integration
            • Preparing for the GitHub Application Vulnerability Integration
              • Creating OAuth 2.0 credentials for GitHub Apps - JWT for the GitHub Application Vulnerability Integration
            • Install the ServiceNow GitHub Application Vulnerability Integration
            • Configure the GitHub Application Vulnerability Integration
            • View the GitHub Application Vulnerability Integration import run status and imported repository data
            • View GitHub Application Vulnerability Integration import sets
          • Invicti Vulnerability Integration
            • Prepare for the Invicti Vulnerability Integration
            • Install the ServiceNow Vulnerability Response Integration with Invicti
            • Configure the Invicti Vulnerability Integration
            • Viewing the Invicti Vulnerability Integration import run status and records
            • Invicti Vulnerability Integration state mapping
          • Veracode Vulnerability Integration
            • Preparing for the Veracode Vulnerability Integration
            • Install the ServiceNow Vulnerability Response Integration with Veracode
            • Configure the Veracode Vulnerability Integration
              • View the Veracode Application Vulnerability Integration import run status
              • View Veracode scan summaries
            • Data transformation for the Veracode Vulnerability Integration
            • Veracode Vulnerability Integration modifications and activities
          • Manual ingestion of vulnerabilities for Application Vulnerability Response
            • Upload application vulnerabilities using a template file
            • Verify integration run
            • Verify upload status
        • Remediating Application Vulnerability Response vulnerabilities
          • View vulnerability libraries
            • Application Vulnerability fields
          • Identify applications in Application Vulnerability Response automatically
            • Create a CI lookup rule
              • Reapplying CI Lookup rules in Application Vulnerability Response
              • Prevent duplicate or orphaned records after running Application Vulnerability Response CI lookup rules
          • Assign application vulnerable items in Application Vulnerability Response automatically
            • Create or edit Application Vulnerability Response assignment rules
            • Removing assignments from Application Vulnerability Response vulnerable items and remediation tasks
          • Calculate risk in Application Vulnerability Response automatically
            • Define fields and weights for the risk rule
            • Create an application vulnerability calculator
          • Map the severity of an application vulnerable item automatically
            • Filtering within Application Vulnerability Management
          • Automate remediation target tracking in Application Vulnerability Response
            • Create or edit application remediation target rules
            • View the remediation target status of an application vulnerable item
          • Close a remediation task
          • Change Management for Application Vulnerability Response
            • Create a change request for Application Remediation task
            • Associate a remediation task to an existing change request
          • Penetration testing
            • Create a penetration test assessment request from existing requests (v19.0)
            • Create a penetration test assessment request (prior to v19.0)
              • Replicate a penetration test request in closed state
            • Create penetration test findings based on assessment requests (prior to v19.0)
            • Create an application vulnerability entry
          • Penetration testing workspace
            • Create a new penetration testing assessment request
            • Create penetration test findings based on an assessment questionnaire
            • Publish the assessment questionnaire
            • Use an assessment questionnaire
          • Penetration Testing Dashboard
            • Penetration Dashboard components
          • Understanding compensating controls for risk reduction in Application Vulnerability Response
        • Platform Analytics Solutions for Application Vulnerability Response
          • Application Vulnerability Management (PA) dashboard
          • My Application Vulnerabilities dashboard
          • Aggregated reports framework for Application Vulnerability Response
        • Application Vulnerability Response references
          • Application Vulnerability Response user groups and roles
          • Components installed with Application Vulnerability Response
          • Application Vulnerable Item (AVI) states
          • Application Vulnerability Response remediation task rule examples
          • Scanned application fields
          • Application Vulnerable Item fields
          • Penetration testing states
          • Managing state mapping for deferrals and false positives in Application Vulnerability Response
          • Application Vulnerability Response references
          • Exception rule example for Application Vulnerability Response
        • Application Vulnerability Response product view
      • Container Vulnerability Response
        • Exploring Container Vulnerability Response
          • Container Vulnerability Response remediation task and container vulnerable item states
        • Configuring Container Vulnerability Response
          • Install Vulnerability Response and Configuration Compliance for Containers
          • Define Container Vulnerability Response email notifications
            • Create or edit remediation target notifications
          • Configure Exception Management for Container Vulnerability Response
            • Configure approval rules for Exception Management
          • Quick start tests for Container Vulnerability Response
            • Run the Automated Test Framework (ATF) test suite for Container Vulnerability Response
        • Integrating Container Vulnerability Response with other applications
          • Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
            • Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
            • Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
            • Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application
          • Exploring the Wiz Container Vulnerability Integration
        • Remediating container vulnerabilities
          • Container Vulnerability Response calculator rules
          • Container Vulnerability Response assignment rules
          • Container Vulnerability Response remediation target rules
          • Exception management in Container Vulnerability Response
            • Requesting and approving an exception in Container Vulnerability Response
              • Request an exception for a container vulnerable item
              • Request an exception for a container remediation task
              • Request an exception for container vulnerabilities using GRC: Policy and Compliance Management
              • Define a policy reason mapping
              • Approve an exception request in Container Vulnerability Response
              • Defer a container vulnerable item in Container Vulnerability Response
              • Request an extension for a deferred container vulnerable item
            • Working with an exception rule in Container Vulnerability Response
              • Create an exception rule in Container Vulnerability Response
              • product/container-vulnerability-response/task/approve-ex-rule-request-cvr.html
              • Activating an exception rule in Container Vulnerability Response
              • Reopen an exception rule in Container Vulnerability Response
              • Update an approved exception rule in Container Vulnerability Response
              • Delete an exception rule in Container Vulnerability Response
              • Request an extension for a deferred remediation task in Container Vulnerability Response
              • Request an extension for an exception rule in Container Vulnerability Response
            • Marking and approving a false positive container vulnerability item
              • Mark as a false positive in Container Vulnerability Response
              • Approve a false positive
          • Container Vulnerability Response remediation tasks and task rules overview
            • Create, edit, and delete Container Vulnerability Response remediation task rules
            • Create auto-close rules for Container Vulnerability Response
            • Removing assignments from container vulnerable items and remediation tasks
          • Close a remediation task
          • IT Operations Management and pattern discovery
        • Analytics and Reporting Solutions for Container Vulnerability Response
          • Container Vulnerability Response dashboard
          • Aggregated reports framework for Container Vulnerability Response
        • Container Vulnerability Response reference
          • Components installed with Container Vulnerability Response
          • Container Vulnerability Response glossary
          • Container Vulnerable Item form fields
          • Prisma Cloud Compute Configuration form
          • Request Exception form
          • Exception Rule form
      • Configuration Compliance
        • Exploring Configuration Compliance
          • Configuration Compliance imported data
            • Configuration Compliance discovery
            • Configuration Compliance correlation
            • Discovered Items for Configuration Compliance
              • CI changes for discovered items for Configuration Compliance
              • Reconcile unmatched discovered items for Configuration Compliance
              • Reapply CI lookup rules on selected discovered items for Configuration Compliance
            • The Tenable Vulnerability Integration with Configuration Compliance
          • CI Lookup Rules for identifying configuration items from Configuration Compliance third-party vulnerability integrations
            • Deduplicating existing configuration items for Configuration Compliance
          • Creating CIs for Configuration Compliance using the Identification and Reconciliation Engine
          • Configuration Compliance assignment rules overview
            • Removing assignments from Configuration Compliance remediation tasks
          • Configuration Compliance remediation tasks and remediation task rules overview
          • Configuring calculator groups and calculators for Configuration Compliance
          • Configuration Compliance Exception Management overview
          • Configuration Compliance change management
        • Setting up, installing, and configuring the Configuration Compliance application
          • Install Configuration Compliance
          • Components installed with Configuration Compliance
          • Create or edit Configuration Compliance assignment rules
          • Configuration Compliance remediation target rules
          • Configuration Compliance calculator groups
          • Create a Configuration Compliance calculator group
            • Configuration Compliance calculators and calculator rules
              • Define fields and weights for the risk rule
              • Edit risk rollup calculators for Configuration Compliance
              • Create, edit, and reapply risk calculators for Configuration Compliance
              • Examples for Configuration Compliance risk score calculation
          • Create or edit Configuration Compliance remediation task rules
          • Specify the duration of an exception requested for a remediation task
          • Configure Exception Management for Configuration Compliance
          • Add an exception approver for Configuration Compliance
          • Create a Configuration Compliance criticality map
          • Create email notifications
          • Configure approval rules for Exception Management in Configuration Compliance
            • Create configurations for an approval rule in Configuration Compliance
            • Create approval levels for Exception Management in Configuration Compliance
            • Exception management workflow versus flow designer in Configuration Compliance
        • Configuration Compliance integrations
          • Microsoft Defender for Cloud Integration for Security Operations
            • Install and configure Microsoft Defender for Cloud Integration for Security Operations
            • Configuration Compliance imported data for Microsoft Defender for Cloud Integration
          • Understanding the Vulnerability Response Integration with Palo Alto Prisma Cloud
            • Preparing for installing the Vulnerability Response Integration with Palo Alto Prisma Cloud
            • Install and configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application
            • Configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application
            • Verify the Vulnerability Response Integration with Palo Alto Prisma Cloud import run status
            • Data mapping
            • Prisma Cloud REST Messages
          • Qualys integration with Configuration Compliance
            • Configure the PCRS parameters
              • Components installed with the Qualys Integration for Security Operations
            • Update configuration items with the network partition identifier for the Qualys Integration
            • Set additional filter parameters for Qualys imports
            • Resolving Qualys Vulnerability Integration issues
              • Attachments not appearing after import
              • Modify transform maps
              • Check XML attachment property size
              • Data retrieval limitations
              • Qualys Knowledge Base Integration is failing
            • Qualys integration run status chart
            • Qualys REST messages
          • Understanding the Tenable Vulnerability Integration
            • Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications
            • Tenable.sc integrations with the Vulnerability Response application
            • Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application
            • Preparing for the Tenable Vulnerability Integration
            • Install the Vulnerability Response Integration with Tenable application using Setup Assistant
            • Data retrieval settings for the Tenable Vulnerability Integration
            • REST messages for the Tenable Vulnerability Integration
              • Data transformation for the Tenable Vulnerability Integration
            • Set additional filter parameters for Tenable.io imports
            • Tenable Vulnerability Integration reporting
              • Integration run status chart for the Tenable Vulnerability Integration
            • Initiate rescan for the Tenable.sc integration
            • Initiate rescan for the Tenable.io integration
            • Update configuration items with the network partition identifier for the Tenable Vulnerability Integration
            • Import modifications for the Tenable Vulnerability Integration
            • Split Tenable detections based on the vulnerability instance to split vulnerable items
          • Exploring the Wiz Test Results and Issues Integrations with Configuration Compliance
        • Configuration Compliance remediation
          • Manually create a Configuration Compliance remediation task
          • Manually create a Configuration Compliance remediation task from the Test Results list
          • Create a change request in Configuration Compliance
          • Associate a remediation task to an existing change request
          • Split a remediation task
          • Remove assignments from remediation tasks for you or your groups
          • Approve an unassign request in Configuration Compliance
          • Automatic closing of test results
            • Working with retired configuration items in Configuration Compliance
            • Automatically close test results related to retired CIs
          • Automatically closing stale test results in Configuration Compliance
            • Use Auto-Close Stale Test Results in Configuration Compliance
          • Close a remediation task
          • Requesting and approving an exception for a remediation task
            • Request an exception for a remediation task in Configuration Compliance
            • Request an extension for an exception rule in Configuration Compliance
            • Request an exception for remediation tasks using GRC: Policy and Compliance Management
            • Approve an exception request in Configuration Compliance
            • Define policy reason mappings
        • Analytics and reporting for Configuration Compliance
          • Configuration Compliance reporting
          • Configuration Compliance dashboard
            • Activate Performance Analytics for Configuration Compliance
            • Viewing the Performance Analytics for Configuration Compliance dashboard
          • Aggregated reports framework for Configuration Compliance
        • Configuration Compliance reference information
          • View Configuration Compliance test groups
          • View Configuration Compliance authoritative sources
          • View Configuration Compliance technologies
          • View Configuration Compliance tests
          • View Configuration Compliance test results
          • View a remediation task
          • Test result and remediation task state transitions in the Configuration Compliance application
          • State synchronization between change requests and remediation tasks
          • Domain separation and Configuration Compliance
          • Test Results fields
          • Configuration Compliance criticality maps
          • Configuration Compliance states
          • Resolving Configuration Compliance import issues
            • Modify Qualys PC Results start date
          • CI lookup rules for Microsoft Defender for Cloud Integration for Security Operations and Palo Alto Prisma Cloud
      • Vulnerability Response Workspaces
        • Patch orchestration with the Vulnerability Response Workspaces
        • Vulnerability Response Workspaces and updates to remediation tasks and remediation task rules
        • Configure the Vulnerability Response Workspaces
        • Vulnerability Manager Workspace
          • Exploring the Vulnerability Manager Workspace
            • Home page in the Vulnerability Manager Workspace
            • Watch Topics page in the Vulnerability Manager Workspace
              • Related items list and visualizations in a watch topic
            • Remediation efforts in the Vulnerability Manager Workspace
              • Life cycles of remediation efforts, remediation tasks, and records in the Vulnerability Response Workspaces
            • Dashboards in the Vulnerability Manager Workspace
            • List page in the Vulnerability Manager Workspace
            • Bulk edit in the Vulnerability Manager Workspace
            • Understanding compensating controls for risk change
            • Analytics and reporting solutions for the Unified Vulnerability Response Dashboard
              • Unified Vulnerability Response Dashboard
          • Monitoring and managing vulnerable items and test results in the Vulnerability Manager Workspace
            • Open search results in Vulnerability Manager Workspace
            • Create and apply filters the summary of active records (VITs, AVITs, CVITs and CTRs)
            • Use watch topics in the Vulnerability Manager Workspace
              • Create a watch topic in the Vulnerability Manager Workspace
              • Edit or delete a watch topic in the Vulnerability Manager Workspace
              • Deactivate or activate a watch topic
            • Use Remediation Effort records
              • Create a remediation effort in the Vulnerability Manager Workspace
              • Create a remediation task on-demand in the Vulnerability Manager Workspace
              • Create a recurring remediation effort in the Vulnerability Manager Workspace
              • Transfer records to remediation efforts in the Vulnerability Manager Workspace
            • Add a compensating control to the library
              • Associate compensating controls with CVEs or TPEs for risk change requests
              • Disable or enable risk change for a CVE or TPE
            • Rescan records and remediation tasks in the Vulnerability Manager Workspace
            • Re-evaluate the remediation properties of the records in the Vulnerability Manager Workspace
            • Use the List view in the Vulnerability Manager Workspace
              • Create a customized list of records
              • Create a remediation task manually from the Vulnerability Manager Workspace
              • Enable or disable the import of test results for a Qualys test group
              • Modify the severity for a CVE or TPE
            • Approve or reject requests in the Vulnerability Manager Workspace
            • Set up email notifications in the Vulnerability Response Workspaces
          • Remediating vulnerable items and test results in the Vulnerability Manager Workspace
            • Using bulk edit in the Vulnerability Manager Workspace
              • Update the state of records in bulk in the Vulnerability Manager Workspace
              • Bulk edit host vulnerable items with patches and solutions
              • Assign records to an assignment group in bulk
              • Remove assignments for host vulnerable items in bulk
              • Request bulk exception in the Vulnerability Manager Workspace
              • Bulk edit for false positive in the Vulnerability Manager Workspace
              • Close records in bulk in the Vulnerability Manager Workspace
            • Request exceptions for remediation tasks and records from the Vulnerability Manager Workspace
            • Request an extension for a deferred vulnerable item in the Vulnerability Manager workspace
          • Vulnerability Manager Workspace reference information
            • Create Watch Topic form fields
            • GRC request exception form fields
            • Generate remediation digest form fields
            • Impact of the compensating controls on risk score and expiration date
            • Examples for remediation task creation in the Vulnerability Manager Workspace and IT Remediation Workspace
            • Re-evaluating the exceptions for selected records in the Vulnerability Manager Workspace
        • IT Remediation Workspace
          • Exploring the IT Remediation Workspace
            • View a workflow example in the IT Remediation Workspace
            • Home page in the IT Remediation Workspace
            • Dashboards in the IT Remediation Workspace
            • List page in the IT Remediation Workspace
          • Using the IT Remediation Workspace
            • Use the email digest in the Vulnerability Response Workspaces
            • Open search results in IT Remediation Workspace
            • Create a list in the IT Remediation Workspace
            • Use records in the IT Remediation Workspace
            • Use remediation task records in the IT Remediation Workspace
            • Assign a remediation task or record to yourself in the IT Remediation Workspace
            • View configuration items with vulnerabilities in the IT Remediation Workspace
            • Create a change request in the IT Remediation Workspace
            • Create a remediation task manually in the IT Remediation Workspace
            • Split a remediation task in the IT Remediation Workspace
            • Request a false positive in the IT Remediation Workspace
              • Request false positive for a set of test results
            • Request an exception in the IT Remediation Workspace
            • Request an exception using GRC: Policy and Compliance Management in the IT Remediation Workspace
            • Request risk change in the IT Remediation Workspace
            • Rescan vulnerable items and remediation tasks in the IT Remediation Workspace
              • Rescan Qualys vulnerable items from the Vulnerability Response workspaces
              • Rescan Rapid7 vulnerable items from the Vulnerability Response workspaces
              • Rescan Tenable.io and Tenable.sc vulnerable items from the Vulnerability Response workspaces
          • IT Remediation Workspace reference information
            • Create change request form fields
            • Request exception form fields for policy exceptions
            • Request exception form fields for risk reduction
        • Explore the Vulnerability Assessment workspace
          • Exploring exposure assessment
            • Exposure assessment by CVE
              • Add CVEs to assess exposure
              • Create VIs for CVEs for exposure assessment
              • Activate or deactivate CVEs for exposure assessment
              • Export impacted CIs for exposure assessment
              • Confidence score calculation example
                • View vulnerable software details
                • Confidence score reference tables for exposure assessment
            • Exposure assessment by software
              • Add software for exposure assessment
              • Create VIs for software for exposure assessment
              • Activate or deactivate software for exposure assessment
              • Export impacted CIs for software in the Vulnerability Assessment workspace
            • Exposure assessment by publisher software
              • Add software by a publisher for exposure assessment
              • Create VIs for software by a publisher for exposure assessment
              • Activate or deactivate software by a publisher for exposure assessment
              • Export impacted CIs for software by a publisher in the Vulnerability Assessment workspace
          • Exploring vulnerability assessment
            • Create a vulnerability assessment record
              • Update the vulnerability assessment auto-flush record
            • Modify the vulnerability assessment record
            • Perform an assessment
              • Assessment tab
              • Overview tab
              • Assign a priority and exposure level to the vulnerability assessment record
            • Add affected CIs to the assessment record
            • Create vulnerable items for the affected CI or affected software component
            • Link the vulnerability assessment record to major security incident in Major Security Incident Management
      • Software Bill of Materials
        • Exploring Software Bill of Materials
          • Exploring supported applications for Software Bill of Materials
        • Configuring Software Bill of Materials
          • Install the supported applications for Software Bill of Materials
            • Configuring the Deps.dev, OSV.dev, and PaCE integrations for Software Bill of Materials
        • Uploading and viewing your SBOM files in the SBOM Workspace
          • Uploading Software Bill of Materials files using a REST API
          • Upload Software Bill of Materials files manually
          • Uploading Software Bill of Materials for DevOps SBOM files
          • Classifying licenses and resolving component licenses in the Software Bill of Materials workspace
            • Classify imported licenses in the Software Bill of Materials Workspace
            • Resolve licenses to components in the Software Bill of Materials Workspace
          • Viewing reports and dashboards in the Software Bill of Materials workspace
            • Review the Home page in the Software Bill of Materials Workspace
            • Reviewing the Components module in the Software Bill of Materials Workspace
            • Creating rules for application vulnerable items in the Software Bill of Materials Workspace
            • View upload status for Software Bill of Materials files
            • Checking a Software Bill of Materials entity for vulnerabilities
        • Components installed with Software Bill of Materials applications
          • Create an application vulnerable item rule in the Software Bill of Materials Workspace
    • Vulnerability Response
      • Exploring the Vulnerability Response application
        • Migrating from Vulnerability Response to Unified Security Exposure Management (USEM)
          • Planning for migration from Vulnerability Response to Unified Security Exposure Management (USEM)
        • Installation of Vulnerability Response and supported applications
        • Vulnerability Response personas and granular roles
        • Vulnerability Response assignment rules overview
        • Vulnerability Response remediation tasks and remediation task rules overview
        • Vulnerability Response remediation target rules
        • Vulnerability classification groups and rules
        • Machine Learning solutions for Vulnerability Response
        • CI lookup rules for identifying configuration items from Vulnerability Response third-party vulnerability integrations
          • Unclassed hardware
          • Unmatched CIs
        • Creating CIs for Vulnerability Response using the Identification and Reconciliation engine
          • Updating CI class for unmatched cloud assets
        • Discovered Items
          • CI changes for discovered items
          • Re-evaluating discovered items
        • Vulnerability Response remediation task and vulnerable item states
          • Vulnerable item age calculation and display
        • Removing assignments from vulnerable items and remediation tasks
        • Vulnerability Response calculators and vulnerability calculator rules
        • Vulnerability Response vulnerable item detections from third-party integrations
        • Vulnerability Solution Management
          • Understanding the Microsoft Security Response Center Solution Integration
          • Understanding the Red Hat Solution Integration
          • Rapid7 solution management
          • Generic framework to ingest data from any solution vendor
        • Patch orchestration with Vulnerability Response
        • Exception Management overview
        • Exception rules overview
        • Exclusion rules overview
        • False Positive overview
        • Questionnaire support in Exception Management via Smart Assessment
          • Configure Assessment template
          • Smart Assessment workflow
          • Questionnaire for False positive or Request Exception
        • Watchdog for Vulnerability Response
        • Change management for Vulnerability Response
        • Software exposure assessment using Software Asset Management (SAM Foundation)
        • Vulnerability Crisis Management
        • Domain separation and Vulnerability Response
        • Service Mapping in Vulnerability Response
      • Vulnerability Response implementation
        • Migrate to Unified Security Exposure Management (USEM) from Vulnerability Response
        • Install Vulnerability Response
          • Components installed with Vulnerability Response
        • Configuring Vulnerability Response using the Setup Assistant
          • Assign the Vulnerability Response persona roles using Setup Assistant
            • Manage persona and granular roles for Vulnerability Response
          • Install Vulnerability Response third-party applications using Setup Assistant
            • Importing data with the NVD and CWE integrations and managing third-party libraries
            • Install the Solution Management for Vulnerability Response application
            • Install and configure the Performance Analytics for Vulnerability Response [PA] application
          • Vulnerability Response applications and CSDM tables
          • Create or edit Vulnerability Response assignment rules
          • Create a Vulnerability Response assignment rule using ML
          • Create a Vulnerability Response assignment rule for service support
          • Create or edit Vulnerability Response remediation task rules
          • Define fields and weights for the risk rule for Vulnerability Response Risk Calculators
          • Vulnerability Response Rollup Calculators
          • Create or edit a Vulnerability Response remediation target rule
            • Recalculate a remediation target date
              • Examples of recalculating a remediation target date
          • Configure installed third-party integrations using the Setup Assistant
            • Configure installed solution integrations for Vulnerability Solution Management using Setup Assistant
            • Configure the MS TVM Vulnerability Integration using Setup Assistant
            • Configure the Qualys Vulnerability Integration using Setup Assistant
            • Configure the Tenable Vulnerability Integration using Setup Assistant
          • Setting up vulnerability solution providers
            • Prepare solution integration checklist
              • Preparing the Common Vulnerability Reporting Framework (CVRF) solution integration
              • Preparing the Common Security Advisory Framework (CSAF) solution integration
            • Configure vulnerability solution providers
              • Common Vulnerability Reporting Framework (CVRF)
                • Import Common Vulnerability Reporting Framework data through file import
                • Configure Connection and Credential aliases
                • Configure a Common Vulnerability Reporting Framework vendor other than Cisco
                • Import Common Vulnerability Reporting Framework data from advisories
                • Import Common Vulnerability Reporting Framework (CVRF) data through CVRF URL
                • Troubleshooting Common Vulnerability Reporting Framework data import
              • Common Security Advisory Framework (CSAF)
                • Import Common Security Advisory Framework data through file import
                • Configure Connection and Credential aliases for the Common Security Advisory Framework (CSAF)
                • Configure a Common Security Advisory Framework vendor other than Red Hat
                • Import Common Security Advisory Framework data from advisories
                • Import Common Security Advisory Framework (CSAF) data through CSAF URL
                • Troubleshooting Common Security Advisory Framework data import
        • Additional Vulnerability Response setup and configuration tasks
          • Quick start tests for Vulnerability Response
            • Run the Automated Test Framework (ATF) test suite for Vulnerability Response
          • Install Vulnerability Assignment Recommendations for Vulnerability Response
            • Configure Vulnerability Assignment Recommendations for Vulnerability Response
            • Create and train a solution definition for Vulnerability Response
          • Create a Vulnerability Response calculator
            • Disable the default vulnerability calculator if not used
          • Create, enable, or, modify Vulnerability Response auto delete rules
          • Add vulnerability significance charts to the Vulnerability Response homepage
          • Define Vulnerability Response email notifications
            • Define Vulnerability Response email templates
            • Create or edit remediation target notifications
          • Configure the Vulnerability Exposure Assessment
          • Configure Exception Management for Vulnerability Response
            • Add an exception approver
          • Configure approval rules for Exception Management
            • Create configurations for an approval rule
            • Create approval levels for Exception Management
            • Exception management workflow versus flow designer
          • Add a false positive approver
          • Configure questionnaire for risk reduction
          • View Vulnerability Response SLAs for remediation tasks
          • Configure watchdog
          • Configure maximum rows in related list
        • Advanced Vulnerability Response configuration tasks
          • Create domain-separated imports for an integration
            • Create and support multiple domains in the background jobs framework
          • Create a Vulnerability Response CI lookup rule
            • Ignore CI classes
            • Filter decommissioned CIs
            • Auto-promote CIs
          • Configure the vulnerable item key
            • Adding proof to Rapid7 vulnerable item keys
            • Delete all your vulnerable item records and related data in Vulnerability Response
          • Filtering within Vulnerability Response
          • Severity mapping for Vulnerability Response
          • Create a Vulnerability Response severity map
          • Define service classifications for Vulnerability Response reporting and related lists
          • Audit selected fields in the vulnerable items table
          • Vulnerability Response background job framework configuration
            • Define background job configurations in Vulnerability Response
            • Advanced parallel processing for background jobs in Vulnerability Response
      • Vulnerability Response integrations
        • Understanding the NVD integrations
          • Preparing for the NVD integrations
          • Configure and run the scheduled job for updating CWE records
          • Install the Vulnerability Response Integration with the NIST National Vulnerability Database
          • Optional NVD integration modification and activities
            • Perform a manual NVD integration import
          • View the (National Vulnerability Database) NVD integration import run status
          • Add CVEs to third-party entries
          • View Vulnerability Response vulnerability libraries
        • CISA Known Exploit Vulnerability (KEV) Integration
          • Preparing for the CISA integration
          • Install the ServiceNow Vulnerability Response Integration with CISA application
        • Understanding the Exploit Prediction Scoring System (EPSS) integration
          • Configure and run a scheduled job to update CVE records with EPSS data
          • Add EPSS Score condition in Risk calculator Business Rule
        • Understanding the Microsoft Threat and Vulnerability Management Vulnerability integration
          • Preparing for the Microsoft Threat and Vulnerability Management Vulnerability Integration
          • Set up Microsoft Azure for the MS TVM integration
          • Install and configure the Vulnerability Response Integration with the MS TVM application using Setup Assistant
          • Data retrieval settings for the Microsoft Threat and Vulnerability Management Integration
          • REST messages for the Microsoft Threat and Vulnerability Management Vulnerability Integration
            • Data transformation for the Microsoft Threat and Vulnerability Management Vulnerability Integration
          • Integration run status chart for the Microsoft Threat and Vulnerability Management Vulnerability Integration
            • Verify the Microsoft Threat and Vulnerability Management integration import run status
          • Split Microsoft TVM detections based on the vulnerability instance to split vulnerable items
        • Understanding the HCL BigFix patch orchestration integration with Vulnerability Response
          • Integrations and dependencies of the Vulnerability Response Patch Orchestration integration with HCL BigFix
          • Prepare for the Vulnerability Response Patch Orchestration integration with HCL BigFix
          • Install the Vulnerability Response Patch Orchestration with HCL BigFix application
          • Configure the Vulnerability Response patch orchestration integration with HCL BigFix
          • Viewing patch data for the Vulnerability Response patch orchestration integration with HCL BigFix
          • Schedule patches with the Vulnerability Response patch orchestration integration HCL BigFix
          • REST messages for the Vulnerability Response patch orchestration integration with HCL BigFix
          • Data transformation for the patch orchestration integration with HCL BigFix
          • Example workflow for the Vulnerability Response patch orchestration integration with HCL BigFix
        • Understanding the Vulnerability Response patch orchestration integration with Microsoft SCCM
          • Integrations and dependencies of the Vulnerability Response Patch Orchestration with the Microsoft SCCM application
          • Prepare for the Vulnerability Response patch orchestration integration with Microsoft SCCM
          • Install the Vulnerability Response Patch Orchestration with Microsoft SCCM application
          • Configure the Vulnerability Response Patch Orchestration with Microsoft SCCM integration
          • Viewing patch data and patch data rollup for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM
          • Schedule patches with the Microsoft SCCM integration with Vulnerability Response
          • REST messages for the Vulnerability Response Patch Orchestration with Microsoft SCCM
          • Data transformation for the Patch Orchestration with Microsoft SCCM Integration
          • Example workflow for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM
        • Understanding the Qualys Vulnerability Integration
          • Preparing for the Qualys Vulnerability Integration
          • Install the Qualys Vulnerability Integration
            • Activate the Qualys scanners
            • Components installed with the Qualys Vulnerability Integration
          • Update configuration items with the network partition identifier for the Qualys Vulnerability Integration
          • Optional Qualys modifications
          • Advanced Qualys configurations and modifications
          • Qualys metadata for vulnerabilities
            • Import additional metadata from Qualys
            • Qualys metadata values for vulnerabilities
            • Set additional filter parameters for Qualys imports
          • Resolving Qualys Vulnerability Integration issues
          • Qualys Vulnerability Integration reporting
            • Qualys integration run status chart
          • Qualys data transformation
            • Dynamic Search List Import
            • Static Search List Import
            • Asset Group Import
            • Appliance Import
          • Qualys REST messages
        • Understanding the Rapid7 Vulnerability Integration
          • Preparing for the Rapid7 Vulnerability Integration
            • Set up for the Rapid7 data warehouse Integration
            • Set up for the Rapid7 InsightVM Integration
          • Install the Rapid7 Vulnerability Integration
            • Configure the Rapid7 Vulnerability Integration
            • Filtering by Rapid7 sites
              • Prepend SITE to your Rapid7 InsightVM site tags
            • Deduplicate Rapid7 Vulnerability Integration data warehouse records
          • Rapid7 Vulnerability Integration run status chart
            • View the Rapid7 Vulnerability Integration import runs status dashboard
          • Initiate rescan for the Rapid7 Vulnerability Integration
          • Set additional filter parameters for Rapid7 InsightVM imports
        • Understanding the Shodan Exploit Integration
          • Preparing for the Shodan Exploit Integration
          • Install and configure the Shodan Exploit Integration for Security Operations
            • Set Shodan Exploit Integration import time
            • Perform a manual Shodan exploit import
          • View the Shodan Exploit Integration import run status
        • Understanding the Tenable Vulnerability Integration
          • Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications
          • Tenable.sc integrations with the Vulnerability Response application
          • Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application
          • Preparing for the Tenable Vulnerability Integration
          • Install the Vulnerability Response Integration with Tenable application using Setup Assistant
          • Data retrieval settings for the Tenable Vulnerability Integration
          • REST messages for the Tenable Vulnerability Integration
            • Data transformation for the Tenable Vulnerability Integration
          • Set additional filter parameters for Tenable.io imports
          • Tenable Vulnerability Integration reporting
            • Integration run status chart for the Tenable Vulnerability Integration
          • Initiate rescan for the Tenable.sc integration
          • Initiate rescan for the Tenable.io integration
          • Update configuration items with the network partition identifier for the Tenable Vulnerability Integration
          • Import modifications for the Tenable Vulnerability Integration
          • Split Tenable detections based on the vulnerability instance to split vulnerable items
        • Understanding the Atlassian Jira integration with Vulnerability Response
          • Preparing for the Jira Vulnerability Response integration
          • Install the Vulnerability Response Integration with Jira
          • Configure rules in the agile tool configuration
            • Create agile issue manually using list action
            • Create agile issue manually using form action
          • Manually synchronize the status of the Jira issue
            • Configure scheduler to create issues automatically
            • Configure scheduler to update issues automatically
            • Configure scheduler to synchronize the Jira status to ServiceNow automatically
        • Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
          • Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
          • Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
          • Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application
          • Integration run status chart for Prisma Cloud Compute Integration
        • Understanding the Wiz Vulnerability Response Integration
          • Activate the Wiz Vulnerability Response Integration application
          • Configure the Wiz Vulnerability Response Integration
            • Identify Wiz Resource types for the Wiz Vulnerability Integrations
            • Set filtering for the Wiz Host Vulnerabilities Integration
            • Set filtering for the Wiz Container Vulnerabilities Integration
              • Configure Container image vulnerability keys for the Vulnerability Response Integration with Wiz
            • Set filtering for the Wiz Test Results Integration
            • Set filtering for the Wiz Issues Integration
            • Set filtering for the Wiz Host Test Results Integration
            • Wiz Backfill Integrations
          • Schedule the Wiz Vulnerability Integrations
          • Field mapping for the Wiz Vulnerability Response Integrations
        • Manually create a vulnerability integration
          • Define a new vulnerability integration
            • Vulnerability integration script
              • Single call integrations
              • Multiple call integrations
              • Attachments as retrieveData() return values
            • Report processor strategies
              • Use the data source attachment report processor strategy
              • About custom report processor scripts
            • Integration factory script fields
          • Manually run a vulnerability integration
        • Manual ingestion of vulnerabilities
          • Ingest vulnerabilities manually
          • Verify manual integration run
          • Configure auto-close manual detections
          • Verify upload status
          • Template for manual ingestion of vulnerabilities
      • Vulnerability Response remediation overview
        • Verify successful completion of Vulnerability Response integration imports
        • View Vulnerability Response vulnerable item detection data
          • Verify Vulnerability Response vulnerable item detection data on integration run (VINTRUN) records
        • Viewing patch data and scheduling patches in Vulnerability Response
          • Patch data and state rollup for patch orchestration in Vulnerability Response
          • View patches without solutions in Vulnerability Response
          • Viewing patch orchestration data on the Vulnerability Response dashboards
        • View a solution
        • Create a vulnerability solution
          • Manually exclude solutions from third-party records or vice versa
        • Triage vulnerabilities automatically
          • Edit vulnerable items in bulk in Vulnerability Response
          • Ungrouped Vulnerability Response vulnerable items
            • View ungrouped Vulnerability Response vulnerable items
            • Manually add a vulnerable item to a remediation task
          • Remove assignments from vulnerable items and remediation tasks
          • Approve or reject an unassign request in Vulnerability Response
          • Automatic closing of vulnerable items and detections
            • Working with retired configuration items
            • Automatically close vulnerable items related to retired CIs
          • Closing stale detections in Vulnerability Response
            • Automatically close stale detections in Vulnerability Response
            • Create auto-close rules
          • Reclassify unclassed hardware
        • Manually create a remediation task in Vulnerability Response
          • Add users to the Vulnerability Response group
        • Manage individual vulnerable items manually
          • Create Vulnerability Response vulnerable items
            • Defer a vulnerable item
              • Request an extension for a deferred vulnerable item
          • Refresh Vulnerability Response vulnerable items
            • Identify and escalate security issues in third-party software
            • Identify and escalate security issues using NVD
            • Identify and escalate security issues using CWE
            • View the remediation target status of a Vulnerability Response vulnerable item
        • Working with unmatched CIs
          • View and reclassify unmatched configuration items
          • Reconcile unmatched discovered items
            • Reapply CI lookup rules on selected discovered items
            • Reapply CI Lookup Rules Enhancements
          • Steps to help prevent duplicate or orphaned records after running Vulnerability Response CI lookup rules
          • De-duplicating existing configuration items
          • Working with unmatched CIs
            • Resolve remediation tasks
              • Defer a Remediation task
                • Request an extension for a deferred remediation task
              • Close a remediation task
        • Identifying duplicate vulnerable items from multiple scanners
          • Automatically resolve duplicate vulnerabilities
        • Create and edit a classification group
          • Create and edit a classification rule
          • Apply a rule to an existing vulnerability
          • Deactivate or delete a classification rule
        • Create an exclusion rule
        • Change Management tasks for Vulnerability Response
          • Create a change request from a remediation task
          • Associate a remediation task to an existing change request
          • Split a remediation task
          • State synchronization between change requests and remediation tasks
        • Assess your exposure to vulnerable software
        • Viewing assignment recommendations
          • Request assignment group recommendations for a vulnerable item
          • Request assignment group recommendations for multiple vulnerable items
          • Request assignment group recommendations for a remediation task
        • Requesting and approving an exception
          • Request an exception for a vulnerable item
          • Request an exception for a remediation task
          • Request a bulk exception
          • Request an exception using GRC: Policy and Compliance Management
            • Request a bulk exception using GRC: Policy and Compliance Management
          • Approve or reject an exception request in Vulnerability Response
        • Working with an exception rule
          • Create an exception rule
          • Approve an exception rule request
          • Activating an exception rule
          • Request an extension for an exception rule
          • Reopen an exception rule
          • Update an approved exception rule
          • Delete an exception rule
        • Marking and approving a false positive
          • Mark as a false positive
            • Bulk edit for false positive
          • Approve or reject a false positive
      • Analytics and Reporting Solutions for Vulnerability Response
        • Using the default Vulnerability Response dashboards
        • Platform Analytics Solutions for Vulnerability Management
          • Vulnerability Management CISO dashboard
            • Configure the Scan Coverage reports
            • Configure the PA indicators for the CISO Dashboard
          • SecOps Vulnerability Response Health dashboard
            • Modifying the threshold values
        • Vulnerability Management (PA) dashboard
          • View Performance Analytics for Vulnerability Response [PA] reports in real-time
          • View the Performance Analytics indicators for Vulnerability Response [PA]
        • Aggregated reports framework
          • Configure an aggregation for source data
            • Run multiple aggregations simultaneously
            • Configure the number of aggregations that can run simultaneously
          • Create a report using an aggregation
      • Vulnerability Response reference information
        • Implementation checklist for the Vulnerability Response application
        • Vulnerability Response remediation task states
          • Detections, remediation tasks, and vulnerable item states
          • Remediation tasks and vulnerable item states
          • State roll-up and roll-down scenarios
          • Remediation task state for Vulnerable Items (VITs) in multiple groups
        • Additional settings for domain separation
        • Discovered Items form fields
        • Vulnerability Response vulnerability form fields
        • Remediation target rule fields
        • Remediation task form fields
        • Questionnaire Configuration form fields
        • Vulnerability Response vulnerable item form fields
        • Solution form fields
        • Approval workflow configurations for unassign request
        • Vulnerability Response remediation task rule examples
        • Risk score calculation example for Vulnerability Response
        • Error handling for detections
      • Mobile experience for Vulnerability Response
        • Set up checklist for the Vulnerability Response Mobile app
        • Log in to the Vulnerability Response Mobile app
        • View, assign, and edit remediation tasks with the Vulnerability Response Mobile app
        • View, reassign, and edit remediation tasks assigned to you with the Vulnerability Response Mobile app
        • Search for remediation tasks with the Vulnerability Response Mobile app
        • Filter records with the Vulnerability Response Mobile app
      • Vulnerability Response Orchestration
        • Scan vulnerability workflow
        • Scan vulnerability item workflow
        • Variables for Create Scan Record for Vulnerabilities activity
    • Application Vulnerability Response
      • Exploring Application Vulnerability Response
      • Configuring Application Vulnerability Response
        • Configure Application Vulnerability Response
          • Verify that the scheduled job for updating CWE records is running
          • Verify that the scheduled job for updating NVD records is running
          • Activate Application Vulnerability Response Integrations
          • Define Application Vulnerability Response email notifications
            • Create or edit remediation target notifications in Application Vulnerability Response
          • Exception Management in Application Vulnerability Response
            • Configure Exception Management for Application Vulnerability Response
            • Configure approval rules for Exception Management
            • Deferring remediation in Application Vulnerability Response
            • Add an exception approver for Application Vulnerability Response
            • Requesting and approving an exception in Application Vulnerability Response
              • Request an exception for an application vulnerable item
              • Request an exception for application vulnerabilities using GRC: Policy and Compliance Management
              • Request an exception for an application remediation task
              • Approve exception rules and exception rule extension requests in Application Vulnerability Response
              • Define policy reason mapping
              • Request an extension for an exception rule in Application Vulnerability Response
              • Request an extension for a deferred remediation task in Application Vulnerability Response
              • Request an extension for a deferred application vulnerable item in Application Vulnerability Response
            • Create, delete, and cancel an exception rule for Application Vulnerability Response
          • Application Vulnerability Response remediation tasks and task rules overview
            • Create, edit, and delete Application Vulnerability Response remediation task rules
            • Create an application remediation task manually in Application Vulnerability Response
            • Create auto-close rules
        • Configure penetration testing
          • Configure sprints for penetration testing
          • Configure assessment types for penetration testing
      • Integrating Application Vulnerability Response with other applications
        • Vulnerability Response Integration with Black Duck
          • Prepare pre-integration tasks for Vulnerability Response Integration with Black Duck
          • Install the ServiceNow Vulnerability Response Integration with Black Duck
          • Configure the Vulnerability Response Integration with Black Duck
            • View the Vulnerability Response Integration with Black Duck import run status
          • Data transformation for the Vulnerability Response Integration with Black Duck
          • Import the project information from the Black Duck integration instance
            • Import Vulnerability Response Integration with Black Duck project versions to the Discovered Applications table
            • Import the application vulnerable items from the Vulnerability Response Integration with Black Duck
            • Set the import times for the Vulnerability Response Integration with Black Duck
            • Include Closed Black Duck application vulnerable items
        • Fortify on Demand Vulnerability Integration
          • Preparing for the Fortify on Demand Vulnerability Integration
          • Install the ServiceNow Vulnerability Response Integration with Fortify on Demand
          • Configure the Fortify on Demand Vulnerability Integration
          • View the Fortify Vulnerability Integration import run status
          • Fortify on Demand Vulnerability modification and activities
            • Perform a manual Fortify application vulnerability import
            • Import data using the Fortify on Demand Vulnerability Integration
            • Include Closed Fortify on Demand application vulnerable items
        • GitHub Application Vulnerability Integration
          • Preparing for the GitHub Application Vulnerability Integration
            • Creating OAuth 2.0 credentials for GitHub Apps - JWT for the GitHub Application Vulnerability Integration
          • Install the ServiceNow GitHub Application Vulnerability Integration
          • Configure the GitHub Application Vulnerability Integration
          • View the GitHub Application Vulnerability Integration import run status and imported repository data
          • View GitHub Application Vulnerability Integration import sets
        • Invicti Vulnerability Integration
          • Prepare for the Invicti Vulnerability Integration
          • Install the ServiceNow Vulnerability Response Integration with Invicti
          • Configure the Invicti Vulnerability Integration
          • Viewing the Invicti Vulnerability Integration import run status and records
          • Invicti Vulnerability Integration state mapping
        • Veracode Vulnerability Integration
          • Preparing for the Veracode Vulnerability Integration
          • Install the ServiceNow Vulnerability Response Integration with Veracode
          • Configure the Veracode Vulnerability Integration
            • View the Veracode Application Vulnerability Integration import run status
            • View Veracode scan summaries
          • Data transformation for the Veracode Vulnerability Integration
          • Veracode Vulnerability Integration modifications and activities
        • Manual ingestion of vulnerabilities for Application Vulnerability Response
          • Upload application vulnerabilities using a template file
          • Verify integration run
          • Verify upload status
      • Remediating Application Vulnerability Response vulnerabilities
        • View vulnerability libraries
          • Application Vulnerability fields
        • Identify applications in Application Vulnerability Response automatically
          • Create a CI lookup rule
            • Reapplying CI Lookup rules in Application Vulnerability Response
            • Prevent duplicate or orphaned records after running Application Vulnerability Response CI lookup rules
        • Assign application vulnerable items in Application Vulnerability Response automatically
          • Create or edit Application Vulnerability Response assignment rules
          • Removing assignments from Application Vulnerability Response vulnerable items and remediation tasks
        • Calculate risk in Application Vulnerability Response automatically
          • Define fields and weights for the risk rule
          • Create an application vulnerability calculator
        • Map the severity of an application vulnerable item automatically
          • Filtering within Application Vulnerability Management
        • Automate remediation target tracking in Application Vulnerability Response
          • Create or edit application remediation target rules
          • View the remediation target status of an application vulnerable item
        • Close a remediation task
        • Change Management for Application Vulnerability Response
          • Create a change request for Application Remediation task
          • Associate a remediation task to an existing change request
        • Penetration testing
          • Create a penetration test assessment request from existing requests (v19.0)
          • Create a penetration test assessment request (prior to v19.0)
            • Replicate a penetration test request in closed state
          • Create penetration test findings based on assessment requests (prior to v19.0)
          • Create an application vulnerability entry
        • Penetration testing workspace
          • Create a new penetration testing assessment request
          • Create penetration test findings based on an assessment questionnaire
          • Publish the assessment questionnaire
          • Use an assessment questionnaire
        • Penetration Testing Dashboard
          • Penetration Dashboard components
        • Understanding compensating controls for risk reduction in Application Vulnerability Response
      • Platform Analytics Solutions for Application Vulnerability Response
        • Application Vulnerability Management (PA) dashboard
        • My Application Vulnerabilities dashboard
        • Aggregated reports framework for Application Vulnerability Response
      • Application Vulnerability Response references
        • Application Vulnerability Response user groups and roles
        • Components installed with Application Vulnerability Response
        • Application Vulnerable Item (AVI) states
        • Application Vulnerability Response remediation task rule examples
        • Scanned application fields
        • Application Vulnerable Item fields
        • Penetration testing states
        • Managing state mapping for deferrals and false positives in Application Vulnerability Response
        • Application Vulnerability Response references
        • Exception rule example for Application Vulnerability Response
      • Application Vulnerability Response product view
    • Container Vulnerability Response
      • Exploring Container Vulnerability Response
        • Container Vulnerability Response remediation task and container vulnerable item states
      • Configuring Container Vulnerability Response
        • Install Vulnerability Response and Configuration Compliance for Containers
        • Define Container Vulnerability Response email notifications
          • Create or edit remediation target notifications
        • Configure Exception Management for Container Vulnerability Response
          • Configure approval rules for Exception Management
        • Quick start tests for Container Vulnerability Response
          • Run the Automated Test Framework (ATF) test suite for Container Vulnerability Response
      • Integrating Container Vulnerability Response with other applications
        • Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
          • Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
          • Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
          • Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application
        • Exploring the Wiz Container Vulnerability Integration
      • Remediating container vulnerabilities
        • Container Vulnerability Response calculator rules
        • Container Vulnerability Response assignment rules
        • Container Vulnerability Response remediation target rules
        • Exception management in Container Vulnerability Response
          • Requesting and approving an exception in Container Vulnerability Response
            • Request an exception for a container vulnerable item
            • Request an exception for a container remediation task
            • Request an exception for container vulnerabilities using GRC: Policy and Compliance Management
            • Define a policy reason mapping
            • Approve an exception request in Container Vulnerability Response
            • Defer a container vulnerable item in Container Vulnerability Response
            • Request an extension for a deferred container vulnerable item
          • Working with an exception rule in Container Vulnerability Response
            • Create an exception rule in Container Vulnerability Response
            • product/container-vulnerability-response/task/approve-ex-rule-request-cvr.html
            • Activating an exception rule in Container Vulnerability Response
            • Reopen an exception rule in Container Vulnerability Response
            • Update an approved exception rule in Container Vulnerability Response
            • Delete an exception rule in Container Vulnerability Response
            • Request an extension for a deferred remediation task in Container Vulnerability Response
            • Request an extension for an exception rule in Container Vulnerability Response
          • Marking and approving a false positive container vulnerability item
            • Mark as a false positive in Container Vulnerability Response
            • Approve a false positive
        • Container Vulnerability Response remediation tasks and task rules overview
          • Create, edit, and delete Container Vulnerability Response remediation task rules
          • Create auto-close rules for Container Vulnerability Response
          • Removing assignments from container vulnerable items and remediation tasks
        • Close a remediation task
        • IT Operations Management and pattern discovery
      • Analytics and Reporting Solutions for Container Vulnerability Response
        • Container Vulnerability Response dashboard
        • Aggregated reports framework for Container Vulnerability Response
      • Container Vulnerability Response reference
        • Components installed with Container Vulnerability Response
        • Container Vulnerability Response glossary
        • Container Vulnerable Item form fields
        • Prisma Cloud Compute Configuration form
        • Request Exception form
        • Exception Rule form
    • Configuration Compliance
      • Exploring Configuration Compliance
        • Configuration Compliance imported data
          • Configuration Compliance discovery
          • Configuration Compliance correlation
          • Discovered Items for Configuration Compliance
            • CI changes for discovered items for Configuration Compliance
            • Reconcile unmatched discovered items for Configuration Compliance
            • Reapply CI lookup rules on selected discovered items for Configuration Compliance
          • The Tenable Vulnerability Integration with Configuration Compliance
        • CI Lookup Rules for identifying configuration items from Configuration Compliance third-party vulnerability integrations
          • Deduplicating existing configuration items for Configuration Compliance
        • Creating CIs for Configuration Compliance using the Identification and Reconciliation Engine
        • Configuration Compliance assignment rules overview
          • Removing assignments from Configuration Compliance remediation tasks
        • Configuration Compliance remediation tasks and remediation task rules overview
        • Configuring calculator groups and calculators for Configuration Compliance
        • Configuration Compliance Exception Management overview
        • Configuration Compliance change management
      • Setting up, installing, and configuring the Configuration Compliance application
        • Install Configuration Compliance
        • Components installed with Configuration Compliance
        • Create or edit Configuration Compliance assignment rules
        • Configuration Compliance remediation target rules
        • Configuration Compliance calculator groups
        • Create a Configuration Compliance calculator group
          • Configuration Compliance calculators and calculator rules
            • Define fields and weights for the risk rule
            • Edit risk rollup calculators for Configuration Compliance
            • Create, edit, and reapply risk calculators for Configuration Compliance
            • Examples for Configuration Compliance risk score calculation
        • Create or edit Configuration Compliance remediation task rules
        • Specify the duration of an exception requested for a remediation task
        • Configure Exception Management for Configuration Compliance
        • Add an exception approver for Configuration Compliance
        • Create a Configuration Compliance criticality map
        • Create email notifications
        • Configure approval rules for Exception Management in Configuration Compliance
          • Create configurations for an approval rule in Configuration Compliance
          • Create approval levels for Exception Management in Configuration Compliance
          • Exception management workflow versus flow designer in Configuration Compliance
      • Configuration Compliance integrations
        • Microsoft Defender for Cloud Integration for Security Operations
          • Install and configure Microsoft Defender for Cloud Integration for Security Operations
          • Configuration Compliance imported data for Microsoft Defender for Cloud Integration
        • Understanding the Vulnerability Response Integration with Palo Alto Prisma Cloud
          • Preparing for installing the Vulnerability Response Integration with Palo Alto Prisma Cloud
          • Install and configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application
          • Configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application
          • Verify the Vulnerability Response Integration with Palo Alto Prisma Cloud import run status
          • Data mapping
          • Prisma Cloud REST Messages
        • Qualys integration with Configuration Compliance
          • Configure the PCRS parameters
            • Components installed with the Qualys Integration for Security Operations
          • Update configuration items with the network partition identifier for the Qualys Integration
          • Set additional filter parameters for Qualys imports
          • Resolving Qualys Vulnerability Integration issues
            • Attachments not appearing after import
            • Modify transform maps
            • Check XML attachment property size
            • Data retrieval limitations
            • Qualys Knowledge Base Integration is failing
          • Qualys integration run status chart
          • Qualys REST messages
        • Understanding the Tenable Vulnerability Integration
          • Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications
          • Tenable.sc integrations with the Vulnerability Response application
          • Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application
          • Preparing for the Tenable Vulnerability Integration
          • Install the Vulnerability Response Integration with Tenable application using Setup Assistant
          • Data retrieval settings for the Tenable Vulnerability Integration
          • REST messages for the Tenable Vulnerability Integration
            • Data transformation for the Tenable Vulnerability Integration
          • Set additional filter parameters for Tenable.io imports
          • Tenable Vulnerability Integration reporting
            • Integration run status chart for the Tenable Vulnerability Integration
          • Initiate rescan for the Tenable.sc integration
          • Initiate rescan for the Tenable.io integration
          • Update configuration items with the network partition identifier for the Tenable Vulnerability Integration
          • Import modifications for the Tenable Vulnerability Integration
          • Split Tenable detections based on the vulnerability instance to split vulnerable items
        • Exploring the Wiz Test Results and Issues Integrations with Configuration Compliance
      • Configuration Compliance remediation
        • Manually create a Configuration Compliance remediation task
        • Manually create a Configuration Compliance remediation task from the Test Results list
        • Create a change request in Configuration Compliance
        • Associate a remediation task to an existing change request
        • Split a remediation task
        • Remove assignments from remediation tasks for you or your groups
        • Approve an unassign request in Configuration Compliance
        • Automatic closing of test results
          • Working with retired configuration items in Configuration Compliance
          • Automatically close test results related to retired CIs
        • Automatically closing stale test results in Configuration Compliance
          • Use Auto-Close Stale Test Results in Configuration Compliance
        • Close a remediation task
        • Requesting and approving an exception for a remediation task
          • Request an exception for a remediation task in Configuration Compliance
          • Request an extension for an exception rule in Configuration Compliance
          • Request an exception for remediation tasks using GRC: Policy and Compliance Management
          • Approve an exception request in Configuration Compliance
          • Define policy reason mappings
      • Analytics and reporting for Configuration Compliance
        • Configuration Compliance reporting
        • Configuration Compliance dashboard
          • Activate Performance Analytics for Configuration Compliance
          • Viewing the Performance Analytics for Configuration Compliance dashboard
        • Aggregated reports framework for Configuration Compliance
      • Configuration Compliance reference information
        • View Configuration Compliance test groups
        • View Configuration Compliance authoritative sources
        • View Configuration Compliance technologies
        • View Configuration Compliance tests
        • View Configuration Compliance test results
        • View a remediation task
        • Test result and remediation task state transitions in the Configuration Compliance application
        • State synchronization between change requests and remediation tasks
        • Domain separation and Configuration Compliance
        • Test Results fields
        • Configuration Compliance criticality maps
        • Configuration Compliance states
        • Resolving Configuration Compliance import issues
          • Modify Qualys PC Results start date
        • CI lookup rules for Microsoft Defender for Cloud Integration for Security Operations and Palo Alto Prisma Cloud
    • Vulnerability Response Workspaces
      • Patch orchestration with the Vulnerability Response Workspaces
      • Vulnerability Response Workspaces and updates to remediation tasks and remediation task rules
      • Configure the Vulnerability Response Workspaces
      • Vulnerability Manager Workspace
        • Exploring the Vulnerability Manager Workspace
          • Home page in the Vulnerability Manager Workspace
          • Watch Topics page in the Vulnerability Manager Workspace
            • Related items list and visualizations in a watch topic
          • Remediation efforts in the Vulnerability Manager Workspace
            • Life cycles of remediation efforts, remediation tasks, and records in the Vulnerability Response Workspaces
          • Dashboards in the Vulnerability Manager Workspace
          • List page in the Vulnerability Manager Workspace
          • Bulk edit in the Vulnerability Manager Workspace
          • Understanding compensating controls for risk change
          • Analytics and reporting solutions for the Unified Vulnerability Response Dashboard
            • Unified Vulnerability Response Dashboard
        • Monitoring and managing vulnerable items and test results in the Vulnerability Manager Workspace
          • Open search results in Vulnerability Manager Workspace
          • Create and apply filters the summary of active records (VITs, AVITs, CVITs and CTRs)
          • Use watch topics in the Vulnerability Manager Workspace
            • Create a watch topic in the Vulnerability Manager Workspace
            • Edit or delete a watch topic in the Vulnerability Manager Workspace
            • Deactivate or activate a watch topic
          • Use Remediation Effort records
            • Create a remediation effort in the Vulnerability Manager Workspace
            • Create a remediation task on-demand in the Vulnerability Manager Workspace
            • Create a recurring remediation effort in the Vulnerability Manager Workspace
            • Transfer records to remediation efforts in the Vulnerability Manager Workspace
          • Add a compensating control to the library
            • Associate compensating controls with CVEs or TPEs for risk change requests
            • Disable or enable risk change for a CVE or TPE
          • Rescan records and remediation tasks in the Vulnerability Manager Workspace
          • Re-evaluate the remediation properties of the records in the Vulnerability Manager Workspace
          • Use the List view in the Vulnerability Manager Workspace
            • Create a customized list of records
            • Create a remediation task manually from the Vulnerability Manager Workspace
            • Enable or disable the import of test results for a Qualys test group
            • Modify the severity for a CVE or TPE
          • Approve or reject requests in the Vulnerability Manager Workspace
          • Set up email notifications in the Vulnerability Response Workspaces
        • Remediating vulnerable items and test results in the Vulnerability Manager Workspace
          • Using bulk edit in the Vulnerability Manager Workspace
            • Update the state of records in bulk in the Vulnerability Manager Workspace
            • Bulk edit host vulnerable items with patches and solutions
            • Assign records to an assignment group in bulk
            • Remove assignments for host vulnerable items in bulk
            • Request bulk exception in the Vulnerability Manager Workspace
            • Bulk edit for false positive in the Vulnerability Manager Workspace
            • Close records in bulk in the Vulnerability Manager Workspace
          • Request exceptions for remediation tasks and records from the Vulnerability Manager Workspace
          • Request an extension for a deferred vulnerable item in the Vulnerability Manager workspace
        • Vulnerability Manager Workspace reference information
          • Create Watch Topic form fields
          • GRC request exception form fields
          • Generate remediation digest form fields
          • Impact of the compensating controls on risk score and expiration date
          • Examples for remediation task creation in the Vulnerability Manager Workspace and IT Remediation Workspace
          • Re-evaluating the exceptions for selected records in the Vulnerability Manager Workspace
      • IT Remediation Workspace
        • Exploring the IT Remediation Workspace
          • View a workflow example in the IT Remediation Workspace
          • Home page in the IT Remediation Workspace
          • Dashboards in the IT Remediation Workspace
          • List page in the IT Remediation Workspace
        • Using the IT Remediation Workspace
          • Use the email digest in the Vulnerability Response Workspaces
          • Open search results in IT Remediation Workspace
          • Create a list in the IT Remediation Workspace
          • Use records in the IT Remediation Workspace
          • Use remediation task records in the IT Remediation Workspace
          • Assign a remediation task or record to yourself in the IT Remediation Workspace
          • View configuration items with vulnerabilities in the IT Remediation Workspace
          • Create a change request in the IT Remediation Workspace
          • Create a remediation task manually in the IT Remediation Workspace
          • Split a remediation task in the IT Remediation Workspace
          • Request a false positive in the IT Remediation Workspace
            • Request false positive for a set of test results
          • Request an exception in the IT Remediation Workspace
          • Request an exception using GRC: Policy and Compliance Management in the IT Remediation Workspace
          • Request risk change in the IT Remediation Workspace
          • Rescan vulnerable items and remediation tasks in the IT Remediation Workspace
            • Rescan Qualys vulnerable items from the Vulnerability Response workspaces
            • Rescan Rapid7 vulnerable items from the Vulnerability Response workspaces
            • Rescan Tenable.io and Tenable.sc vulnerable items from the Vulnerability Response workspaces
        • IT Remediation Workspace reference information
          • Create change request form fields
          • Request exception form fields for policy exceptions
          • Request exception form fields for risk reduction
      • Explore the Vulnerability Assessment workspace
        • Exploring exposure assessment
          • Exposure assessment by CVE
            • Add CVEs to assess exposure
            • Create VIs for CVEs for exposure assessment
            • Activate or deactivate CVEs for exposure assessment
            • Export impacted CIs for exposure assessment
            • Confidence score calculation example
              • View vulnerable software details
              • Confidence score reference tables for exposure assessment
          • Exposure assessment by software
            • Add software for exposure assessment
            • Create VIs for software for exposure assessment
            • Activate or deactivate software for exposure assessment
            • Export impacted CIs for software in the Vulnerability Assessment workspace
          • Exposure assessment by publisher software
            • Add software by a publisher for exposure assessment
            • Create VIs for software by a publisher for exposure assessment
            • Activate or deactivate software by a publisher for exposure assessment
            • Export impacted CIs for software by a publisher in the Vulnerability Assessment workspace
        • Exploring vulnerability assessment
          • Create a vulnerability assessment record
            • Update the vulnerability assessment auto-flush record
          • Modify the vulnerability assessment record
          • Perform an assessment
            • Assessment tab
            • Overview tab
            • Assign a priority and exposure level to the vulnerability assessment record
          • Add affected CIs to the assessment record
          • Create vulnerable items for the affected CI or affected software component
          • Link the vulnerability assessment record to major security incident in Major Security Incident Management
    • Software Bill of Materials
      • Exploring Software Bill of Materials
        • Exploring supported applications for Software Bill of Materials
      • Configuring Software Bill of Materials
        • Install the supported applications for Software Bill of Materials
          • Configuring the Deps.dev, OSV.dev, and PaCE integrations for Software Bill of Materials
      • Uploading and viewing your SBOM files in the SBOM Workspace
        • Uploading Software Bill of Materials files using a REST API
        • Upload Software Bill of Materials files manually
        • Uploading Software Bill of Materials for DevOps SBOM files
        • Classifying licenses and resolving component licenses in the Software Bill of Materials workspace
          • Classify imported licenses in the Software Bill of Materials Workspace
          • Resolve licenses to components in the Software Bill of Materials Workspace
        • Viewing reports and dashboards in the Software Bill of Materials workspace
          • Review the Home page in the Software Bill of Materials Workspace
          • Reviewing the Components module in the Software Bill of Materials Workspace
          • Creating rules for application vulnerable items in the Software Bill of Materials Workspace
          • View upload status for Software Bill of Materials files
          • Checking a Software Bill of Materials entity for vulnerabilities
      • Components installed with Software Bill of Materials applications
        • Create an application vulnerable item rule in the Software Bill of Materials Workspace
    • Enterprise security case management applications
      • Security Incident Response
        • Understanding Security Incident Response
          • Domain separation and Security Incident Response
        • Security Incident Response setup
          • Install and configure Security Incident Response
            • Download and install the Security Analyst Workspace
            • Components installed with Security Incident Response
            • Other additional Security Incident Response setup tasks
            • Setup Assistant reference
            • Configure the Security Analyst Workspace
              • Set up primary and secondary filters for Security Analyst Workspace
              • Security Analyst Workspace properties
              • Additional Security Analyst Workspace configuration
                • Landing page filter configuration
                • Enable UI Actions
                • Form UI actions
                • Related List configuration
                  • Related List UI Actions
                • Form configuration system properties
                • Enable playbooks for analyst selection
            • Troubleshooting Security Incident Response
          • Security Incident Response Platform Analytics Solutions
            • CISO dashboard
            • Security Incident Management Premium dashboard
            • Security Incident Management dashboard
            • Security Incident Explorer dashboard
            • Security Operations Efficiency dashboard
        • Security Incident Response Workspace
          • Exploring SIR Workspace
            • SIR Workspace plugins and roles
            • SIR Workspace features
            • SIR Workspace interface overview
            • Upcoming section
              • View upcoming tasks
            • Quick links section
              • Working with quick links
            • Shift Handover Records section
            • List view in SIR Workspace
              • Personalize a list
              • Assign Security Incidents
              • Close multiple security incidents
              • Assign Response Tasks
              • Report Phish Email
              • Working with quick filters
                • Add or modify quick filters
              • Export Security Incidents or Response Tasks
              • Manage Shift Handover records
          • Configuring SIR Workspace
            • Set up view of SIR Records
            • Configure SI design time investigation
              • Creating View for associated info tables
              • Adding an entry point list
              • Mapping View of the Associate Info to the entry point list
              • Configure each associated list from the view to handle run time data rendering
            • SIR Workspace Related Records
            • Define the new Risk Score Calculator Rules
              • Risk Score Calculator for Additional Related Tables
            • Configure Shift Handover
              • Configure Shift Handover Templates
              • Create shifts through Security Incident Response Workspace
            • Security Incident Response conference call integration
              • Manage Conference Call users and groups
              • Integrate SIR with third-party communication channels
            • Configure report templates in Security Incident Response
              • Create a Report Template in Security Incident Response
              • System properties for reports
              • Duplicate a report template in Security Incident Response
              • Edit a report template in Security Incident Response
            • On-Call scheduling in Security Incident Response
            • Category management in Security Incident Response
              • Create a category
              • Create a subcategory
          • Using SIR Workspace
            • Working with Security Incident Records
              • Security Incident Overview section
              • Security Incident Details section
                • Security incident Details tab
              • SIR Workspace Orchestration
                • SIR Workspace Investigation Canvas
                  • Explore Investigation Canvas
                • Unified experience framework for integrations powered by Capability Framework
                  • Unified experience capabilities and modal screens
                  • Unified Experience example
                    • Example 1: Select implementations: Threat Lookup
                      • Select implementations
                    • Example 2: Common Inputs: Sighting Search
                    • Example 3: Add specific runtime details inputs to an implementation: Run Additional Actions
              • Security Incident Response Tasks
                • Create a Response Task
              • Security Incident Response Other Records
              • Security Incident Response Post Incident Review
              • Edit Related Records in list view
              • TISC integration within SIR Workspace
                • Send data from SIR Workspace to TISC
                  • System properties to send data
                  • Add security incident to TISC case
                  • Add observables to TISC Case
                  • Send Observables to TISC
                  • Send Threat Lookup to TISC
                  • Send Sighting Search to TISC
                  • Send Observable Enrichment to TISC
                  • View TISC Context in SIR Workspace
                • Working with TISC Context
                  • Add observables to TISC Case
                  • View related info from TISC
                  • View Enrichment Results
              • Reports in Security Incident Response
                • Create a report
                • Edit a report
                • Delete a report
              • Collaborate using conference call or chat in Security Incident Response
                • Start a conference call in Security Incident Response
                • Add participants to active Conference Call
                • Start a Sidebar chat in Security Incident Response
              • Viewing incident details with a relationship graph
                • Customize a relationship graph
                • Create a relationship graph for an incident
            • Security Incident Playbook
            • Prerequisites for the Playbooks
            • Rebuilding existing playbooks in Workflow Studio
            • Activity Definitions
              • Example Activity Definition: Send email
                • Create an Activity Action
              • Submit to CSF X Sandbox
            • Sample Playbooks for SIR Workspace
            • Working with MSI Records
              • Propose as Major Security Incident
              • Promote to Major Security Incident
              • Link to Major Security Incident
            • Working with Form UI actions
            • Security Incident Closure workflow
            • Handle security incidents using AWA
          • Viewing SIR Workspace Dashboards
            • View Security Analyst Overview dashboard
            • View Security Incident Explorer dashboard
            • View Security Incident Management dashboard
            • View Security Operations Efficiency dashboard
            • View Security Incident Response Premium KPIs dashboard
            • View Context Sensitive Analytics - SI dashboard
            • View CISO dashboard
            • View CISO Reporting Overview dashboard
            • View Security Incident Manager Overview dashboard
            • View Security Incident Response Health dashboard
        • Security incident creation
          • Security incident manual creation
            • Create a security incident from the Security Incident list
            • Create a security incident from the Security Incident Catalog
            • Create a security incident from an Event Management alert
          • Security incident automatic creation
            • Security incidents created from events and alerts
              • Data imported into security alerts
            • Create security incidents from User Reported Phishing emails
          • Record creation from security incidents
            • Create a change, incident, or problem from a security incident
            • Create a Customer Service case from a security incident
            • Add a security incident to a security case
            • Create response tasks
        • Manage Predictive Intelligence for User Reported Phishing
          • Predictive Intelligence for User Reported Phishing
          • Required components and plugins
          • Final verdict generation for User Reported Phishing
          • Troubleshooting Predictive Intelligence for User Reported Phishing
        • Configure Predictive Intelligence for User Reported Phishing
        • Assigning security analysts
        • Process Mining Workspace for Security Incident Response
          • Create process mining project for security incidents
          • Process Mining use cases for security incidents
        • Managing security incidents and inbound requests
          • Create an inbound request
          • Manage observables
            • Show IoC information for a security incident
            • Create a security incident observable
            • Manage file observables
            • Edit a security incident observable list
            • Add multiple security incident observables
            • Automatic security incident observable log data enrichment
            • Publish observables to a third-party watchlist
          • Manage lookups and scans
            • Submit an IoC Lookup request from a security incident
            • Submit an IoC Lookup request from the Security Incident Catalog
            • Submit a vulnerability scan request from a security incident
            • Submit a vulnerability scan request from the Security Incident Response catalog
          • Manage on-demand orchestration
            • Perform on-demand orchestration from the Security Incident form
            • Perform on-demand orchestration from the Security Incident list
            • Define new on-demand orchestrations
              • Register new Security Operations applications for on-demand orchestration
          • Add information to a security incident
            • Add related problems, changes, and incidents to a security incident
          • Invoke a process dump for an enriched process in Windows
          • View information in a security incident
            • Parent and child security incident relationships
            • View affected items for a security incident
            • View related items for a security incident
            • View enrichment data for a security incident
            • View response task information for a security incident
            • View related events and alerts in security incidents
            • View security incident to customer service case mapping
            • View a Security Incident Response runbook
            • Identify all configuration items affected by a security incident
          • Calculate the severity of a security incident
          • Search for and delete phishing emails
          • Create a security incident knowledge article
          • Escalate a security incident
          • Manage post incident activities
            • Assign post incident review roles
            • Post incident review report
              • Manage Post Incident Review Report
            • Configure an assessment trigger condition
              • Assessment trigger conditions examples
            • Perform a questionnaire-based post incident review
              • Create post incident review questionnaire categories
              • Compose post incident review questions
            • Create PIR assignment rules
          • Close security incidents
            • Add closure information to a security incident
          • Restrict access to security incidents
        • Manage security threats using the Security Analyst Workspace
          • Resolve security threats with the playbook
          • Sightings searches on user-reported phishing and malware attacks
        • Playbook Resources
          • Activate a Security Incident Response flow
          • Security Incident Response playbooks
            • Process-based Playbooks
              • Playbook for Manual Phishing
                • Create playbooks for Manual Phishing in Workflow Studio
                  • Add parallel activities
                • Using the Manual Phishing playbook
                • Workspace Playbook summary
              • Playbook for Automated Phishing
                • Create processes for Automated Phishing in PAD
                • Using the Automated Phishing playbook
              • Playbook for Manual Malware
                • Create processes for Manual Malware in PAD
                • Using the Manual Malware playbook
              • Playbook for Automated Malware
                • Create processes Automated Malware in PAD
                • Using the Automated Malware playbook
              • Playbook for Failed Login Manual
                • Create processes for Failed Login Manual in PAD
                • Using the Failed Login Manual playbook
            • Flow-based Playbooks
              • Playbook for Automated Phishing
                • Run the automated phishing response playbook flow
                  • View automated phishing response playbook flow action designer
                  • View the automated phishing response playbook subflow designer
              • Playbook for Automated Malware
                • Run the automated malware playbook flow
              • Playbook for Failed Login Manual
              • Playbook for Child Security Incident Automation
              • Playbook for Office 365 - Malicious File Detected
                • Set up the Office Malicous File Detected playbook
                • Use the Office 365 Malicious File Detected playbook
              • Playbook for Repeat Detection
                • Set up the Repeat Detection playbook
                • Use the Repeat Detection playbook
              • Playbook for Spoofed Emails (using the same Display name)
                • Set up the Spoofed Emails playbook
                • Use the Spoofed Emails (using the same Display name) playbook
              • Playbook for Endpoint Detection
                • Set up the Endpoint Detection playbook
                • Use the Endpoint Detection playbook
              • Playbook for Possible Password Spray
                • Set up the Possible Password Spray playbook
                • Use the Possible Password Spray playbook
              • Playbook for T1003 - Detect Credential Dumping Tools
                • Set up the T1003 - Detect Credential Dumping Tools playbook
                • Use the T1003 - Detect Credential Dumping Tools playbook
              • Playbook for Email Domain Spoofing Detection
                • Set up the Email Spoof Detection playbook
                • Use the Email Domain Spoofing Detection playbook
              • Playbook for Typo Squatted Domain
                • Set up the Typo Squatted Domain playbook
                • Use the Typo Squatted Domain playbook
              • Playbook for Credential Sniffing
                • Set up the Credential Sniffing playbook
                • Use the Credential Sniffing playbook
              • Playbook for T1070 - Windows Events Logs Cleared
                • Set up the T1070 - Windows Events Logs Cleared playbook
                • Use the T1070 - Windows Events Logs Cleared playbook
              • Playbook for OSquery of External Address in /etc/hosts file
                • Set up the OSquery of External Address in the /etc/hosts file playbook
                • Use the OSquery of External Address in the /etc/hosts file playbook
              • Playbook for User Deleting Bash History - Cloud
                • Set up the User Deleting Bash History playbook
                • Use the User Deleting Bash History playbook
              • Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud
                • Set up the Successful VPN Attempts from the Service Accounts playbook
                • Use the Successful VPN Attempts from the Service Accounts playbook
              • Playbook for Attempted Access to Deactivated Accounts
                • Set up the Attempted Access Deactivated Account playbook
                • Use the Attempted Access to Deactivated Accounts playbook
              • Playbook for T1003 - Defense Evasion - Mimikatz DCShadow
                • Set up the T1003 - Defense Evasion - Mimikatz DCShadow playbook
                • Use the T1003 - Defense Evasion - Mimikatz DCShadow playbook
              • Playbook for T1003 - Credential Dumping - Mimikatz DCSync
                • Set up the T1003 - Credential Dumping - Mimikatz DCsync playbook
                • Use the T1003 - Credential Dumping - Mimikatz DCsync playbook
              • Playbook for Okta User Login Failures from Multiple IPs
                • Set up the Okta User Login Failures from Multiple IPs playbook
                • Use the Okta User Login Failures from Multiple IPs playbook
              • Playbook for ModSec Brute force by IP Burst
                • Set up the ModSec Brute force by IP Burst playbook
                • Use the ModSec Brute force by IP Burst playbook
          • Security Incident Response playbook actions
        • Visual representation of Security Incident Response reporting
          • Security Incident Response Overview dashboard
            • Access Security Incident Response Explorer
            • Security incident map
              • Add map to Security Incident Response overview
              • Modify security incident map
            • Security incident treemaps
              • Add treemaps to the Security Incident Response overview
              • Create or update a treemap category
              • Create or update a treemap indicator
            • Add vulnerability significance charts to an overview
        • Major Security Incident Management
          • Exploring Major Security Incident Management
            • Major Security Incident Management
            • Get started with MSIM
            • Checklist for MSIM setup
            • Major Security Incident Management roles
          • Integrating Major Security Incident Management
            • Integrate Major Security Incident Management with Microsoft SharePoint
              • Register a new application at Azure portal for SharePoint connections
              • Use certificates for authentication
              • Configure Microsoft SharePoint with Major Security Incident Management
            • Integrate Major Security Incident Management with Microsoft Teams
              • Register a new application at Azure portal for Microsoft Teams connections
              • Configure Microsoft Teams connection with Major Security Incident Management
            • Establish MS Teams Graph connection on ServiceNow AI Platform
              • Using Certificates for authentication
                • Attach a Java Key Store certificate for MS Teams
                • Configure the JWT signing key for MS Teams
                • Configure the JWT provider for MS Teams
                • Establish a connection using certificates
              • Using Client Secret value
                • Establish a connection using client secret
                • Activate MS Teams chat connector for MS Teams Graph Spoke user
            • Major Security Incident Management Conference Call Integration
              • Start a conference call
              • Add participants to a conference call
              • Mute participants in a conference call
              • View conference call details
              • Integrate MSIM Conference Calls with Microsoft Teams
                • Use the MSIM Conference Call Microsoft Teams integration
              • Integrate MSIM Conference Calls with Zoom
                • Use the MSIM Conference Call Zoom integration
              • Integrate MSIM Conference Calls with Cisco Webex
                • Use the Conference Calls Cisco Webex integration
          • Configuring Major Security Incident Management
            • Configure File Explorer Component
              • Get Started with File Explorer
              • Configure File Explorer Repository Drive
              • Configure Folder and File Action Settings
              • Create Folder Templates
              • File Explorer Activity Stream in Workspace
              • File Explorer troubleshooting
            • Configure Microsoft Teams
              • Get started with Microsoft Teams
              • Activate MS Teams as a chat provider
              • Create a chat channel template
              • View Chat Message Activity
              • MS Teams Chat Connector Troubleshooting for MSIM
            • Configure Slack chat connector for major security incidents
              • Get started with Slack chat connector configuration
              • Create a chat channel template for Slack
              • Activate Slack as a channel provider
              • View chat message activities in Slack
          • Major Security Incident Management administration
          • Major Security Incident Management workspace
          • Using Major Security Incident Management
            • Propose, promote, and link incident records
              • Propose as a Major Security Incident
              • Promote to a Major Security Incident
              • Link to Major Security Incident
            • Using MSI List view in the MSIM workspace
            • View Major Security Incident impact metrics
            • View Major Security Incident trend charts
            • Update Major Security Incident details
              • Restrict access to certain major security incidents
            • Link additional records to Major Security Incident
            • Unlink records from Major Security Incident
            • Manage tasks in a Major Security Incident
              • Manage tasks using the Visual Task Board
              • Manage tasks using the List view
            • Track collaboration activity via MSIM workspace
            • Create and distribute MSIM Status Reports
          • Managing MSIM status reports
            • Configure Major Security Incident status reports
              • Create a Report Template
                • Add Branding to your Report Templates
                • Use Visualizations in Report Templates
                • Use Reports Lists in Report Templates
                • Use Template Scripts in your Report Templates
                • Preview the Report Template
              • Create a Report Section Template
              • Create a Report Subsection Template
              • Create Report Subsection Element template
                • Create a Free Form Type Element
                • Create a Visualization Type Element
                • Create a List Type Element
                • Create a Custom Type Element
              • Add system properties
          • Major Security Incident Management Playbooks
            • Create processes for MSIM playbook
            • Using the MSIM playbook
            • Playbook for zero-day vulnerability
              • Using the Zero-day Vulnerability Playbook
            • Playbook for Legal Request
          • Rollup Framework for MSIM
            • Configure Linked Records in Major Security Incident Management
            • Configure Rollup Records in Major Security Incident Management
            • Configure List Layout in Major Security Incident Management
            • Rollup example use case implementation for a Security Case
              • Step 1. Create linked record configuration for a Security Case
              • Step 2. Create a view for modal window for a Security Case
              • Step 3. Create UI actions for the Source Table for a Security Case
              • Step 4. Create a view for a new Linked Record Tab for a Security Case
              • Step 5. Add Access Control Lists (ACLs) for Major Security Incident Management workspace users
              • Step 6. Create business rules for a Security Case
              • Step 7. Create rollup record configurations
            • Perform on demand atomic rollup
        • Security Incident Response integrations
          • ArcSight ESM Event Ingestion for Security Operations integration
            • Set up your ServiceNow AI Platform instance for the ArcSight ESM event ingestion integration
              • Set up the ArcSight ESM Query Viewer
              • Install and configure the ServiceNow application for the ArcSight ESM Event Ingestion integration
              • Create a profile for ArcSight ESM correlation event ingestion integration
                • Create and name the profile for ArcSight ESM event ingestion integration
                • Select correlation events for ArcSight ESM event ingestion integration
                • Mapping correlation event fields for the ArcSight ESM event ingestion integration
                  • Create mappings for ArcSight ESM event ingestion integration
                • Preview the security incident for the ArcSight ESM event ingestion Integration
                • Create a schedule for ArcSight ESM event ingestion ingestion
                • Additional options: Automate correlated event updates and closure based on SIR incident status
            • ArcSight ESM Integration Settings for event ingestion integration
            • Troubleshooting ArcSight ESM event ingestion integration
            • Copy ArcSight ESM profile for event ingestion integration
            • Use the script editor to format correlation event values for ArcSight ESM integration
            • Flow Designer usage with ArcSight ESM event ingestion integration
          • Amazon Web Services (AWS) Security Hub integration
            • Get started with AWS Security Hub integration
            • Register and configure the AWS Security Hub portal
            • Install and configure the AWS Security Hub integration
            • Create a profile for AWS Security Hub finding integration
            • Map the AWS Security Hub finding fields
            • Define filter and aggregation criteria for AWS Security Hub findings ingestion
            • Schedule the AWS Security Hub finding retrieval
            • Automate the AWS Security Hub finding updates and closures by the SIR incident status
            • SIR form after an AWS Security Hub finding ingestion
          • Carbon Black - Incident Enrichment integration
            • Get started with the Carbon Black - Incident Enrichment integration
          • Carbon Black integration
            • Get started with the Carbon Black integration
          • Check Point Anti-bot - Email Parser integration
          • Check Point Next Generation Threat Prevention integration
            • Check Point NGTP setup
              • Create an API account for the Check Point NGTP integration
              • Set up the Check Point NGTP integration
              • Activate the Check Point NGTP integration
            • Working with block lists
              • Create a block list for the Check Point NGTP integration
              • Activate a block list for the Check Point NGTP integration
              • Configure a block list as a Custom Intelligence Feed on the Check Point NGTP integration
              • Submit block list entries from a security incident for the Check Point NGTP integration
              • Submit block list entries directly from the Block List Entry Table
              • Approve block list entries for the Check Point NGTP integration
              • Block list entry exceptions for the Check Point NGTP integration
              • Edit the security tag name for the Check Point NGTP integration
              • Uninstall the Check Point NGTP integration
          • CrowdStrike Falcon Host integration
            • Get started with the CrowdStrike Falcon Host integration
            • Security Operations CrowdStrike Falcon Host - Publish to Watchlist Flow
          • CrowdStrike Falcon Insight for Security Operations integration
            • Getting started with the CrowdStrike Falcon Insight integration
            • Create CrowdStrike API client and generate keys
            • Install and configure CrowdStrike Falcon Insight
            • Create an approval group
            • Create a capability profile for the CrowdStrike Falcon Insight integration
            • Configure profiles and security incidents for the CrowdStrike Falcon Insight integration
            • How trigger conditions work with a configuration item for a profile
            • Verify CrowdStrike Falcon Insight profile trigger conditions
            • Trigger a CrowdStrike Falcon Insight profile manually from a security incident
            • Create and configure a profile for the sighting search
            • Configure and trigger additional actions in CrowdStrike Falcon Insight
            • Using CrowdStrike Falcon Insight integration in Analyst Workspace
          • CrowdStrike Next-Gen SIEM integration for Security Operations
            • Get started with CrowdStrike Next-Gen SIEM integration
            • Install and configure CrowdStrike Next-Gen SIEM integration
            • Create a detection profile for CrowdStrike Next-Gen SIEM
            • Set correlation rules for CrowdStrike Next-Gen SIEM integration
            • Map the CrowdStrike Next-Gen detection fields
            • Defining filter and aggregation criteria
            • Set the filtering conditions for security incidents
            • Define aggregation conditions
            • Schedule the CrowdStrike Next-Gen SIEM detection retrieval
            • Automate detection updates and closures
          • CrowdStrike Falcon X Sandbox for Security Operations integration
            • Get started with the CrowdStrike Falcon X Sandbox integration
            • Set up Sandbox submission configurations
            • Manually submit files or URLs to Sandbox
            • Automate CrowdStrike Falcon Sandbox submissions using Flow Designer
            • Monitor the submission results in the sandbox
            • Tag security incidents with the Sandbox submission status
            • Review the sandbox global settings
          • Elasticsearch Incident Enrichment integration
            • Get started with the Elasticsearch - Incident Enrichment integration
          • FireEye Endpoint Security integration
            • Set up your NowPlatform instance for FireEye integration
            • Configuring Timestamp Settings for Triage Acquisition
            • Install the application and configure a source for the integration
              • FireEye Default Settings
            • Create a new capability profile for the FireEye Endpoint integration
            • Understand how trigger conditions work with a configuration item
            • Configure profiles and security incidents for the FireEye HX integration
              • Verify the Trigger Condition Filters
            • Trigger a FireEye capability profile from Related Links
            • Trigger a FireEye Capability profile from Configuration Item related list
            • FireEye Get File Capability
            • FireEye Additional Actions on Endpoint
            • Create and configure a profile for sightings search with the FireEye Integration
            • Invoke Sighting Search from a Security Incident
          • Have I been pwned? integration
            • Security Operations Have I been pwned? integration setup
              • Threat Lookup - Have I been pwned? flow
              • Activate the Security Operations Have I been pwned? integration
              • Update your X.509 certificate
          • HPE Security ArcSight ESM - Email Parser integration
          • HPE ArcSight Logger - Incident Enrichment integration
            • Get started with the HPE ArcSight Logger - Incident Enrichment integration
          • Hybrid Analysis integration
            • Install and configure Hybrid Analysis
            • Verify expected results for Hybrid Analysis
            • (Optional) Manually attach an observable for Hybrid Analysis
          • IBM QRadar Offense Ingestion Integration
            • Install and configure the ServiceNow application for the IBM QRadar offense ingestion integration
            • Set up your ServiceNow AI Platform instance for the IBM QRadar offense ingestion integration
              • Create a profile for IBM QRadar offense ingestion integration
                • Create profiles for ingesting IBM QRadar offenses
                • Select IBM QRadar rules
                • Mapping of offense fields for the IBM QRadar integration
                  • Ingesting the sample IBM QRadar offenses
                  • Mapping IBM QRadar offense fields to security incident response fields
                • Preview the security incident for the IBM QRadar integration
                • Define schedule for the IBM QRadar integration
                • Automate offense updates and closure based on SIR incident status
            • IBM QRadar integration configuration settings
            • Optional: Copy a IBM QRadar profile
            • Domain separation and IBM QRadar Offense Ingestion
            • Security Incident Response form after offense ingestion
            • Flow Designer and Integration Hub usage with IBM QRadar offense ingestion integration
            • Troubleshooting IBM QRadar offense ingestion integration
          • IBM QRadar - Incident Enrichment Integration
            • Get started with the IBM QRadar - Incident Enrichment integration
          • LogRhythm Overview
            • Set up the REST API for LogRhythm
            • Install the plugin and configure LogRhythm
            • Creating an alarm profile for LogRhythm
              • Mapping LogRhythm alarms to the security incident
                • Map LogRhythm alarm fields to security incident fields
              • Filter alarms for LogRhythm
              • Previewing the security incident with mapped LogRhythm alarm values
              • Schedule and retrieve LogRhythm alarms
              • Additional options for LogRhythm alarms
            • Additional configurations for the LogRhythm integration
              • Use the script editor to format LogRhythm values
              • Copy an alarm profile for LogRhythm
              • Disable automated alarm closure for LogRhythm
              • View LogRhythm drilldown events
            • Troubleshooting the LogRhythm integration
              • Verify connectivity for LogRhythm
              • Script execution and system log for LogRhythm
          • McAfee ePO integration
            • Integration architecture for McAfee ePO
            • Checklist for the McAfee ePO integration
            • Set up your ServiceNow AI Platform instance for the McAfee ePO integration
            • Set up your McAfee ePO console to integrate with Security Incident Response (SIR)
            • Install the application and configure a server for the McAfee ePO integration
            • Edit security tags in the ServiceNow AI Platform for the McAfee ePO integration
            • Create an approval group
            • McAfee ePO integration capability profiles
              • Create a capability profile for the McAfee ePO integration
              • Defining triggering conditions with a Configuration item (CI) field for a McAfee ePO profile
              • Configuring profiles for the McAfee ePO integration
                • Configure profiles and security incidents for system enrichment queries for the McAfee ePO integration
            • Trigger McAfee ePO profile manually from a security incident
            • Trigger additional actions in McAfee ePO integration
            • Using McAfee ePO integration in Analyst Workspace
          • McAfee ESM - Email Parser integration
            • Configure McAfee ESM - Email Parser integration
          • McAfee ESM - Incident Enrichment Integration
            • Get started with the McAfee ESM - Incident Enrichment integration
          • Microsoft Azure Sentinel integration
            • Get started with Microsoft Azure Sentinel integration
            • Register and configure the Microsoft Azure portal
            • Install and configure the Microsoft Azure Sentinel integration
            • Create a profile for Microsoft Azure Sentinel
            • Map the Microsoft Azure Sentinel incident fields
            • Defining filter and aggregation criteria
            • Schedule the Microsoft Azure Sentinel incident retrieval
            • Automate the incident updates and closures by the SIR incident status
            • Copy a Microsoft Azure Sentinel profile
            • SIR form after an incident ingestion
            • Review the Microsoft Azure Sentinel integration settings
            • Domain separation
            • Comparing Microsoft Azure Sentinel and Microsoft Graph Security API integrations with SIR
          • Microsoft Defender for Endpoint integration
            • Register and configure the Microsoft Defender for Endpoint in the Microsoft Azure portal
            • Get started with the Microsoft Defender for Endpoint integration
            • Install the application and configure a source for the integration
              • Microsoft Defender for Endpoint Default Settings
            • Map the Microsoft Defender for Endpoint indicator types
            • Create a capability profile for the Microsoft Defender for Endpoint integration
            • Trigger conditions in a configuration item
            • Configure profiles and security incidents for the Microsoft Defender for Endpoint integration
              • Verify the Trigger Condition Filters
            • Trigger the Microsoft Defender for Endpoint capabilities from Related Links
            • Trigger the Microsoft Defender for Endpoint from Configuration Item related list
            • Additional Configurations in Microsoft Defender for Endpoint
              • Configure Isolate Host capability in Microsoft Defender for Endpoint
              • Configure Remove Host Isolation capability in Microsoft Defender for Endpoint
              • Configure Run Antivirus Scan capability in Microsoft Defender for Endpoint
              • Configure Restrict App Execution capability in Microsoft Defender for Endpoint
              • Configure Remove App Restriction capability in Microsoft Defender for Endpoint
              • Configure Get Related Machines from Defender Capability in Microsoft Defender for Endpoint
              • Configure Stop and Quarantine File capability in Microsoft Defender for Endpoint
            • Create and configure a profile for sightings search with the Microsoft Defender for Endpoint integration
              • Perform a manual sighting search in Microsoft Defender for Endpoint
              • Perform an automatic observable enrichment in Microsoft Defender for Endpoint
              • Perform a manual observable enrichment in Microsoft Defender for Endpoint
            • Create indicators in Microsoft Defender for Endpoint
              • Update indicators in Microsoft Defender for Endpoint
            • Domain separation in Microsoft Defender for Endpoint integration
            • Rate limit configuration in Microsoft Defender for Endpoint integration
          • Microsoft Exchange Online integration
            • Set up your Microsoft Azure account
            • Install Microsoft Exchange Online application
            • Configure the Microsoft Exchange Online integration
            • Define email search criteria and request a search on the Microsoft Exchange Online service
            • Request delete approval for emails on Microsoft Exchange online service
            • Approve delete email requests for the Microsoft Exchange Online integration
            • Recover deleted emails on the Microsoft Exchange Online service
            • Edit security tags for the Microsoft Exchange Online integration
          • Microsoft Exchange On-Premises integration
            • Get started with the Microsoft Exchange On-Premises integration
            • Microsoft Exchange - Perform Email Search and Deletion flow
          • Microsoft Graph Security API alert ingestion integration
            • Set up your ServiceNow AI Platform instance for the Microsoft Graph Security API integration
              • Configure the Microsoft Azure portal
              • Install and configure the Servicenow application for Microsoft Graph Security API alert ingestion integration
            • Create a profile for the Microsoft Graph Security API alert ingestion integration
              • Identify the source for the profile
              • Mapping of alert fields for Microsoft Graph Security API alert ingestion integration
                • Ingest sample Microsoft Graph Security API alerts
                • Mapping alerts to security incident response fields
              • Preview the security incident for the Microsoft Graph Security API integration
              • Define schedule for Microsoft Graph Security API integration
              • Automate alert updates and closure based on SIR incident status
            • Microsoft Graph Security API integration configuration settings
            • Security Incident Response form after alert ingestion
            • Optional: Copy a Microsoft Graph Security API profile
            • Domain separation and Microsoft Graph Security API alert ingestion
            • Flow Designer and Integration Hub usage in Microsoft Graph Security API integration
            • Troubleshooting Microsoft Graph Security API integration
          • Palo Alto Networks - AutoFocus integration
            • Activate and configure Palo Alto Networks - AutoFocus integration
            • Get AutoFocus Session Info Enrichment Flow
          • Palo Alto Networks - Firewall integration
            • Set up SSH credentials to the MID Server
            • Activate and configure the Palo Alto Networks Firewall Integration
            • Security Operations Integration Palo Alto Networks Firewall Launcher workflow
            • Security Operations Palo Alto Networks - Check and Block Value workflow
            • Get Log Data Flow
          • Palo Alto Networks - WildFire integration
            • Activate Security Operations Palo Alto Networks - WildFire
            • Get WildFire Data Enrichment Flow
          • Palo Alto Networks Next-Generation Firewall integration
            • Create a certificate profile for the Palo Alto Networks Next-Generation Firewall
            • Set up and install Palo Alto Networks Next-Generation Firewall
            • Create the API account role for Palo Alto Networks Next-Generation Firewall
            • Supported External Dynamic Lists for Palo Alto Networks Next-Generation Firewall
            • Create an EDL for Palo Alto Networks Next-Generation Firewall
            • Activate an EDL for Palo Alto Networks Next-Generation Firewall
              • Activate an EDL manually for Palo Alto Networks Next-Generation Firewall
                • Configure an EDL in Palo Alto Networks Next-Generation Firewall
              • Activate an EDL for Palo Alto Networks Next-Generation Firewall with a change request
            • Submit EDL entries from a security incident record for Palo Alto Networks Next-Generation Firewall
            • Submit EDL entries from the blocklist for Palo Alto Networks Next-Generation Firewall
            • Approve EDL entries for Palo Alto Networks Next-Generation Firewall
            • EDL entry exceptions for Palo Alto Networks Next-Generation Firewall
            • (Optional) Edit the security tag name for Palo Alto Networks Next-Generation Firewall
            • Uninstall Palo Alto Networks Next-Generation Firewall
          • PhishTank integration
            • Install and configure PhishTank
            • Verify expected results for PhishTank
            • (Optional) Manually attach an observable for PhishTank
          • Proofpoint Integration for Security Operations
            • Exploring the Proofpoint Integration for Security Operations
            • Configuring the Proofpoint Integration for Security Operations
              • Install and configure the Proofpoint Integration for Security Operations
              • Create an event profile for the Proofpoint Integration for Security Operations
              • Review Proofpoint integration settings
              • View Proofpoint Analytics Dashboard
          • Reverse Whois integration
            • Install and configure Reverse Whois
            • (Optional) Install and configure Whois
            • Initiate the lookup for Reverse Whois
            • Verify expected results for Reverse Whois
            • (Optional) Run enrichment lookup and verify expected results for Whois
          • RISKIQ and WHOISIQ integration
            • Supported observables for RISKIQ and RISKIQ WHOISIQ
            • Install and configure RISKIQ and WHOISIQ
            • Verify expected results for RISKIQ SSL certificate lookups
              • RISKIQ SSL certificate lookups that return an exact match
              • RISKIQ SSL certificate lookups that return multiple certificates or no certificates
            • Verify expected results for WHOISIQ URL lookups
            • Create an observable for manual WHOISIQ lookups
            • Verify expected results for manual WHOISIQ lookups
          • Shodan integration
            • Install and configure Shodan
            • Verify expected results for Shodan
            • (Optional) Manually attach an observable for Shodan
          • Secureworks CTP Ticket Ingestion Integration
            • Set up your ServiceNow AI Platform instance for the Secureworks CTP ticket ingestion integration
              • Install and configure the ServiceNow application for the Secureworks CTP ticket ingestion integration
            • Create a profile for Secureworks CTP ticket ingestion integration
              • Identify the source of the profile
              • Mapping of ticket fields for the SecureWorks CTP integration
                • Ingesting the sample Secureworks tickets
                • Mapping Secureworks ticket fields to security incident response fields
              • Preview the mapped values in the security incident
              • Define schedule for the Secureworks CTP Ticket ingestion
              • Automate ticket updates and closure based on SIR incident status
            • Optional: Copy a Secureworks CTP profile
            • Security Incident Response form changes after ticket ingestion
            • View the Secureworks tickets and the corresponding security incidents
              • Secureworks CTP Master Ticket Closure Notice
            • Secureworks CTP integration configuration settings
          • Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks
            • Install and Configure
            • Create an incident profile
            • Set Alert Sources
            • Map incident fields
            • Define filter and aggregation criteria
            • Schedule incident retrieval
            • Automate incident updates and closures
          • Security Incident Response integration with Zscaler
            • Getting started with Security Incident Response integration with Zscaler
            • Configure access to Zscaler Internet Access APIs
            • Install and configure Security Incident Response integration with Zscaler
            • Add Zscaler Internet Access URL category lists
            • Submit observables from a security incident record to a URL category list
            • Approve observables to URL category lists
            • Submit the security incident to the Zscaler URL category list
            • Run a threat lookup by using the Zscaler global threat library
            • Submit to Zscaler Sandbox analysis
            • Set up email alerts for Patient 0 events
          • ServiceNow Security Operations add-on for Splunk overview
            • Splunk integration setup
              • Download the ServiceNow Security Operations application
              • Install the ServiceNow Security Operations add-on for Splunk
              • Setup Splunk environment
                • Configure Application Registry on the ServiceNow instance
                • Using ServiceNow Security Operations Integration add-on
            • Manual search commands
            • Splunk event actions
            • Single-record Splunk alerts
            • Multiple-record, custom field Splunk alerts
              • Create a multi-record, custom field Splunk alert
              • Multi-record, custom field Splunk alert examples
            • Splunk error reporting
          • Splunk Enterprise Event Ingestion integration for Security Operations by ServiceNow
            • Set up your ServiceNow AI Platform instance for the Splunk Enterprise Event Ingestion integration
            • Install and configure the ServiceNow application for the Splunk Enterprise Event Ingestion integration
              • Configure Splunk Enterprise Event Ingestion settings
            • Create and name an event profile for the Splunk Enterprise Event Ingestion integration
              • Select scheduled alerts for the Splunk Enterprise Event Ingestion integration
              • Mapping alerts and events for the Splunk Enterprise Event Ingestion integration
              • Map alerts for the Splunk Enterprise Event Ingestion integration
              • Preview the security incident for the Splunk Enterprise Event Ingestion integration
              • Schedule and retrieve alerts for the Splunk Enterprise Event Ingestion integration
            • Integration architecture and external systems connection for the Splunk Enterprise Event Ingestion integration
              • Copy Splunk Enterprise Event Ingestion profiles from one instance to another using export/import functionality
              • Copy an event profile for the Splunk Enterprise Event Ingestion integration
              • Set up ServiceNow Event Ingestion Integration add-on
              • Using ServiceNow Event Ingestion Integration add-on
              • Save searches in your Splunk Enterprise console for the Splunk Enterprise Event Ingestion integration
              • Use the script editor to format alert values for the Splunk Enterprise Event Ingestion integration
              • Checklist for the Splunk Enterprise Event Ingestion integration
          • Splunk Enterprise Security event ingestion integration
            • Key terms used in this integration
            • Set up your ServiceNow AI Platform instance for the Splunk Enterprise Security integration
            • Install and configure the ServiceNow application for the Splunk Enterprise Security Notable Event Ingestion integration
              • Configure Splunk Enterprise Security settings
              • Authentication errors
            • Create and name an event profile for the Splunk Enterprise Security event ingestion integration
            • Setup ServiceNow Security Operations Event Ingestion Addon for Splunk ES
            • Using ServiceNow Security Operations Event Ingestion Add-on for Splunk ES
            • Copy an event profile for the Splunk Enterprise Security Event Ingestion integration
            • Use the script editor to format alert values for the Splunk Enterprise Security Event Ingestion integration
            • Copy Splunk Enterprise Security profiles from one instance to another using export/import functionality
            • Checklist for the Splunk Enterprise Security Notable Event Ingestion integration
          • Splunk - Incident Enrichment integration
            • Get started with the Splunk Search integration for Security Operations
        • Mobile Experience for Security Incident Response
          • Set up checklist for the Security Incident Response Mobile app
          • Log in to the Security Incident Response Mobile app
          • View, edit, and assign open security incidents with the Security Incident Response Mobile app
          • View, edit, and reassign security incidents assigned to you with the Security Incident Response Mobile app
          • View, edit and assign unassigned security incidents with the Security Incident Response Mobile app
          • View, edit, and assign high priority incidents with the Security Incident Response Mobile app
          • View, edit, and assign security incidents with a risk score greater than 60 with the Security Incident Response Mobile app
          • Search for security incidents with the Security Incident Response Mobile app
          • View, edit, and assign open response tasks with the Security Incident Response Mobile app
          • View, edit, and reassign your response tasks with the Security Incident Response Mobile app
          • Filter records with the Security Incident Response Mobile app
        • Security Incident Response Orchestration
          • Set up Security Incident Response Orchestration
          • Understand Security Incident Response Orchestration workflows and workflow templates
            • Security Incident Response Orchestration flows and actions
              • Create Lookup Request for IoC Changes Flow
                • Create IoC Lookup Request Flow Action
              • Security Incident Response- Get Network Statistics Flow
              • Security Incident Response - Get Running Services Flow
                • Determine Shell Script by OS Flow Action
                • Get Running Services - WMI Enrichment
              • Run procdump flow
                • Execute procdump action
              • Security Incident - Evaluate response task outcome workflow
      • Threat Intelligence
        • Understanding Threat Intelligence
          • Domain separation and Threat Intelligence
        • Set up Threat Intelligence
        • IoC Repository
          • Attack modes and methods
            • Define an attack mode/method
            • Add an IoC to an attack mode/method
            • Add a related attack mode method
            • Add associated task to an attack mode/method
          • Indicators of compromise
            • View an IoC
            • Add a related observable to an IoC
            • Add a related attack mode/method to an IoC
            • Identify associated indicator types
            • Identify indicator sources
            • Add associated tasks to an IoC
          • Observables
            • Define an observable
            • Add a related IoC to an observable
            • Add associated tasks to an observable
            • Add a related observable
            • Load more IoC data
            • Identify observable sources
            • Perform lookups on observables
            • Perform threat enrichment on observables
          • Attack patterns
            • Define an attack pattern
          • Campaigns
            • Define a campaign
          • Course of actions
            • Define a course of action
          • Identities
            • Define identities
          • Infrastructure
            • Define infrastructure
          • Intrusion set
            • Define an intrusion set
          • Locations
            • Define Location
          • Malware
            • Define a Malware
          • Malware analysis
            • Define malware analysis
          • Observed data
            • Define observed data
          • Threat actors
            • Define threat actors
          • Threat groupings
            • Define threat groupings
          • Marking definitions
            • Define marking definitions
          • Threat notes
            • Define threat notes
          • Threat opinions
            • Define threat opinions
          • Threat reports
            • Define threat reports
          • Sightings
            • Define indicator sightings
            • Define object sightings
          • Tools
            • Define tools
          • Vulnerabilities
            • Define vulnerabilities
          • Relationships
            • Define object-object relationships
            • Define object-indicator relationships
            • Define object-observable relationships
          • STIX Visualizer
        • MITRE-ATT&CK framework overview
          • MITRE-ATT&CK administration
            • Get started with MITRE-ATT&CK framework
            • Understand the MITRE to STIX data model
            • Domain separation and MITRE-ATT&CK
            • Set up the MITRE-ATT&CK framework
            • Manage matrices
            • Manage techniques
            • Manage mitigations
            • Manage groups
            • Manage malware
            • Manage tools
            • Manage MITRE relationships
            • Manage CVE and technique mapping
            • Extend the MITRE-ATT&CK data
            • Define the data source and detection tool mapping
            • Define the data source and data component mapping
            • Define the technique detection coverage
              • MITRE-ATT&CK Scoring definition
            • Map your technique detection coverage to a technique
            • Define the mitigation coverage
              • Technique mitigation coverage definitions
            • Map your mitigation coverage to a technique
              • Overall technique mitigation coverage calculator
            • Create and map detection rules
            • Auto-extract technique rules for importing MITRE-ATT&CK information
            • Review threat group and MITRE-ATT&CK techniques mapping
            • Threat group to technique heatmap definition
            • Review the MITRE-ATT&CK system properties
          • Using MITRE-ATT&CK to detect and analyze threats
            • Associate MITRE-ATT&CK information with security incidents
            • Associate MITRE-ATT&CK information with observables
            • Associate MITRE-ATT&CK information with security case
            • Rollup MITRE-ATT&CK information using Threat Lookup results
            • Rollup MITRE-ATT&CK information from detection rules
            • Rollup MITRE-ATT&CK information from child security incidents
            • Perform link analysis and threat hunting using MITRE-ATT&CK specific filters
            • MITRE-ATT&CK heat map and navigator
            • Using the MITRE-ATT&CK dashboard
        • Threat Intelligence administration
          • Threat Lookup Finding Calculators
            • Using Threat Lookup Finding Calculators
        • Threat Intelligence integrations
          • CrowdStrike Falcon Intelligence integration
            • CrowdStrike Falcon Intelligence integration overview
          • Have I been pwned? integration
            • Security Operations Have I been pwned? integration setup
              • Threat Lookup - Have I been pwned? flow
              • Activate the Security Operations Have I been pwned? integration
              • Update your X.509 certificate
          • MISP integration for Security Operations
            • MISP administration
              • Getting started with MISP integration for Security Operations
                • MISP user roles and permissions
              • Install and configure the MISP integration for Security Operations
              • Review the MISP integration settings
              • Configure MISP sighting searches
              • Configure how an automatic event is created
              • MISP event data
              • Associated MISP events
              • MISP user information
              • Domain separation and MISP
              • Troubleshooting MISP integration
            • Using MISP to investigate and analyze threats
              • Sighting searches in MISP
              • Observable enrichment in MISP
              • Managing events in MISP
              • Roll up MITRE-ATT&CK information using MISP enrichment results
          • OPSWAT Metadefender Integration
            • OPSWAT Metadefender integration overview
          • VirusTotal integration
            • VirusTotal integration setup
              • Activate and configure the VirusTotal integration
            • Threat Lookup - VirusTotal workflow
          • WhoisXML API integration
            • WhoisXML API integration setup
              • Activate and configure the Security Operations Whois integration
              • Update your X.509 certificate
            • Enrich Observable WhoIs workflow
        • Threat Intelligence Orchestration
          • Set up Threat Intelligence Orchestration
          • Threat Intelligence Orchestration workflows and activities
        • Security Case Management
          • Create cases in Security Case Management
            • Add artifacts to a case
            • Associate MITRE-ATT&CK information with security case
          • Case creation from security artifacts
            • IoCs and observables in cases
              • Create a case from IoCs or observables
              • Add IoCs and observables to an existing case
              • Create an observable from a case
              • Run a sightings search on observables in a case
            • Security incidents in cases
              • Create a case from security incidents
              • Add security incidents to an existing case
            • Configuration items in cases
              • Create a case from CIs
              • Add CIs to existing cases
            • Affected users in cases
              • Create a case from affected users
              • Add affected users to existing cases
          • Security artifact analysis
            • Related details for case artifacts
              • View related details for a security incident artifact
              • View related details for a configuration item artifact
              • View related details for an IoC artifact
              • View related details for an affected user artifact
              • View related details for an observable artifact
            • Security artifact exclusion and inclusion
              • Exclude security artifacts from a case
              • Return excluded security artifacts to a case
            • Annotate security artifacts
            • Search for security artifacts
    • Security Posture Control
      • Exploring Security Posture Control
        • Install the supported applications for Security Posture Control
        • Service Graph Connectors for Security Posture Control
        • Policies for Security Posture Control
          • Policies included with the Security Posture Control application
          • Creating your own policies in the Security Posture Control application
        • Key insights and configured insights for Security Posture Control
      • Using the Security Posture Control workspace
        • Activate a policy included with the Security Posture Control application
        • Create and activate custom policies for Security Posture Control
        • Edit an activated policy in Security Posture Control
        • Clone a policy or create a child policy in Security Posture Control
        • Create and activate a configured insight for Security Posture Control
        • Create an asset profile in Security Posture Control
          • Delete an asset profile in Security Posture Control
        • View findings for Security Posture Control
          • Test result and remediation task state transitions in the Security Posture Control application
        • Creating your own API connectors in Security Posture Control
          • Enter metadata
          • Create connector alias and connection credentials
          • Select a connector template
          • Provide input values for your API connector
          • Map API response to SPC attributes
          • Validate your API connector
          • Create an instance and set the import schedule
        • Create an asset search in Security Posture Control
        • Resolving duplicate configuration items in Security Posture Control
          • Resolve duplicate configuration items in Security Posture Control
      • Using mitigation controls monitoring with Security Posture Control
        • Mitigation controls policies
        • Mitigation controls and policies required for Exploit Protection (EDR) mitigation controls
          • Install and configure the CrowdStrike integrations for mitigation controls monitoring
          • Install and configure the Service Graph Connector for Microsoft SCCM and the Microsoft Defender Mitigation Control Integration
            • Create multiple instances for the Microsoft Defender Mitigation Control Integration
          • Install and configure the Service Graph Connector for SentinelOne and the SentinelOne Mitigation Control Integration
        • Exploit Protection (WAF) mitigation controls
          • Configure the F5 BIG-IP integrations for mitigation controls monitoring
          • Configure the AWS WAF integration for mitigation controls monitoring
          • Create a policy for the AWS WAF integration for mitigation controls monitoring
        • View detected mitigations
        • Mitigation controls to vulnerable item mapping
      • Use cases, policy examples, and supported service graph connectors in Security Posture Control
        • Security Posture Control use case: Detecting assets with missing endpoint protection
        • Security Posture Control use case: Detecting assets missed by vulnerability assessment tools
        • Security Posture Control use case: Detecting unmanaged assets
        • Security Posture Control use case: Detecting assets missing an endpoint management solution
        • Security Posture Control use case: Detecting assets with vulnerabilities and security tool coverage gaps
        • Security Posture Control use case: Detecting internet exposure of cloud assets  and high-risk combinations
        • Supported hardware service graph connectors for Security Posture Control
        • Supported software service graph connectors for Security Posture Control
        • Examples of base, child, and cloned policies for Security Posture Control
          • Create a base policy for Security Posture Control (example)
          • Create a child policy from a base policy for Security Posture Control (example)
          • Clone a policy for Security Posture Control (example)
    • Cybersecurity Executive Dashboard
      • Opt-in for benchmark scores
      • Set targets
      • Security Simulation and Training Integration for Security Operations
        • Configure Knowbe4 integration
        • Configure Microsoft Defender for Office 365 integration
      • Risk and compliance dashboard for GRC: Metrics
        • Risk and Compliance Dashboard reports and solutions
    • Threat Intelligence Security Center
      • Exploring Threat Intelligence Security Center
        • TISC Key terminology
        • View Threat Intelligence Security Center Homepage
      • Configuring Threat Intelligence Security Center
        • Download TISC application from ServiceNow Store
        • Set up Threat Intelligence Security Center
      • Integrating Threat Intelligence Security Center
        • Threat Intelligence Security Center Catalog
        • Threat Intelligence Feeds
          • Configure a new threat intelligence feed
          • Configure Custom Field Mapping
          • View Threat Intel Feeds
            • View STIX TAXII Feeds
            • View STIX HTTPs Feeds
            • View MISP Feeds
            • View Text Feeds
            • View CSV Feeds
            • View JSON Feeds
            • View RSS Feeds
            • View Custom Feed
              • Configure custom CrowdStrike feed
                • System Properties for CrowdStrike
              • Configure custom MISP feed
          • Understanding STIX TAXII
            • Configure a new TAXII Feed
          • Duplicate threat intelligence feeds
        • TISC Enrichment Integrations
          • Configure Observable Enrichment
          • Configure Sighting Search
            • Define queries for Sighting Search
            • Using Sighting Search Parameters
          • Configure Threat Lookup
            • View Threat Lookup Reputation Calculators
        • TISC API References
        • TISC Integrations
          • Observable Enrichment
            • Whois integration
              • Configure and enable Whois integration
            • Shodan integration
              • Configure and enable Shodan integration
          • Sighting Search
            • Get started with Elasticsearch integration
              • Configure and enable Elasticsearch integration
            • Get started with Splunk Search integration
              • Configure and enable Splunk integration
          • Threat Lookup
            • TISC VirusTotal integration
              • Configure and Enable VirusTotal Integration
            • TISC CrowdStrike Falcon Intelligence integration
              • Configure and Enable CrowdStrike Falcon Intelligence integration
        • TISC Security Tools - EDR
          • CrowdStrike Falcon EDR integration
            • Configure Crowdstrike Falcon EDR integration
            • Send observables to EDR
          • Microsoft Defender for EDR Integration
            • Register and configure the Microsoft Defender in the Microsoft Azure portal
            • Install and configure Microsoft Defender for EDR Integration
            • System properties for Microsoft Defender EDR
            • Send observables to EDR
          • TISC Security Tools - Firewall
            • Palo Alto Networks integration
              • Create new EDL for Palo Alto Networks
              • Palo Alto EDL Approval Rules
              • Add Observables to EDL
              • Remove Observables from EDL
              • Approve EDL entries for Palo Alto Networks
          • TISC add-on for Splunk overview
            • TISC integration with Splunk
            • Creating users in ServiceNow TISC instance
            • Configuring TISC add-on in Splunk
              • Data storage in Splunk
        • TISC - Azure Sentinel integration
          • TISC playbook templates
      • Administration
        • Defining Data Imports Approval Rules
        • Defining Expiration Rules
          • Expiration rules for source records
        • Create Inbound Data Exclusion Rules
        • Custom Threat Score Calculator in TISC
          • Define Threat Score Calculator
        • MITRE ATT&CK Technique Extraction Rules
          • MITRE ATT&CK Technique Extraction method
        • Defining Security Control Lists
        • Creating Taxonomies
          • Bulk import Taxonomies
        • Managing the Threat Lookup Reputation Calculator
        • Manage email Notifications
          • Email Notifications
          • Email logs
        • Report Templates
          • Create a new Report Template
          • System properties for Reports
          • Edit a Published Report Template
          • Duplicate a Report Template
        • Working with Webhooks
          • System properties for Webhooks
          • Configure webhooks
            • Subscribe Triggers
            • View webhook error logs
            • View webhook batches
          • Webhook Triggers
        • Configure tooltips for nodemaps
        • Working with automated flows
          • Automated IOC Enrichment
          • Analyze, assess, and disseminate observables
          • Analyze and assess threat IoC’s
          • Vulnerability Management Support
          • Zero-day vulnerability tracking
          • Automated flows tables
      • Threat Intelligence Security Center reference
        • Domain separation and Threat Intelligence Security Center
        • Components installed with Threat Intelligence Security Center
      • Using Threat Intelligence Security Center
        • TISC integration with SIR Workspace
        • Configuring Threat Intelligence External Sharing
          • Exploring Outbound Intel Sharing
            • Configuring Outbound Intel Sharing Controls
            • Configuring Outbound Intel Data Exclusion Rule
            • Configuring Outbound Intel Sharing Profiles
            • Configuring Outbound Intel Sharing Groups
            • Defining Approval Rule for Outbound Intel
            • Configuring Outbound Intel Sharing Templates
            • Working on the Redaction Library
              • Bulk Import of Redaction Categories and Values
          • Exploring Inbound Intel Sharing
            • Configuring Inbound Intel Sharing Profiles
            • Configuring Inbound Intel Sharing Groups
            • Defining Approval Rule for Inbound Intel
          • Exploring TAXII Outbound Server
            • Create TAXII Collection
            • Automated Sharing of TAXII Collections
            • Viewing TAXII Collection Records
        • Viewing Threat Intelligence External Sharing
          • Viewing Outbound Intelligence
          • Viewing Inbound Intelligence
          • Viewing TAXII Collections
        • Viewing Redaction Imports
          • View all Redaction Imports
          • View my Redaction Imports
        • Sharing of Outbound Intelligence Records from GUI
        • Threat Intelligence Sharing Approval Workflow
        • Automated Sharing of Outbound Intelligence Records
        • Working with Data Imports
          • Viewing all imports
          • Viewing my imports
          • Viewing my approvals
        • Import Threat Intelligence
          • Import data using structured file
          • Import data using standard format
          • Import data using raw text
          • Import data using unstructured file format
        • Threat Analyst Workbench
          • Workbench Overview
          • Creating cases using Threat Analyst Workbench
            • Enforced Restrictions for case(s)
              • Access controls for a case
              • External user access for case tasks
            • Associate MITRE Techniques to a Case
            • Roll up of MITRE technique associations
          • Create case task using Threat Analyst Workbench
          • Working with Investigation Canvases
            • Understanding investigation canvas actions
            • Linking an existing case from Investigation Canvas
            • Creating a Case and Linking from Investigation Canvas
            • Linking Canvas from a Case
            • Create an investigation canvas
            • Adding a new node to the canvas
            • Investigation canvas and MITRE ATT&CK
              • Investigation Canvas MITRE Filters
          • Add artifacts to case(s) or case task(s)
            • Roll up of MITRE Techniques from Artifacts to Case
            • Show MITRE ATT&CK Framework for a Case(s)
          • Run Enrichment Actions within a case
          • View Case Reports
          • Create a security incident from a TISC case
          • Upload Secure File Attachments
        • Threat Intelligence Security Center Library
          • Understanding the Data Model
          • TISC Library Objects form view
          • TISC Library Repository
            • Observables
              • Define an Observable
              • Observables source records
              • Link Threat Intel Related Records
              • Fetch Observables Data
              • View details in Relationship Graph
                • Link node actions in Relationship Graph
              • Working with Internal Intelligence Records
                • View Internal Intelligence Records
              • Run Enrichment Actions from Observable
              • Add to Case
              • Run Enrichment operations in TISC
                • Run Threat Lookup
                • Run Sighting Search
                • Run Observable Enrichment
              • View Enrichment Results
            • Indicators
              • Define an Indicator
            • Attack Patterns
              • Define an attack pattern
            • Campaign
              • Define Campaign
            • Courses of Action
              • Define Courses of Action
            • Identity
              • Define identities
            • Infrastructure
              • Define infrastructure
            • Intrusion Set
              • Define Intrusion Set
            • Location
              • Define Location
            • Malware
              • Define Malware
            • Malware Analysis
              • Define Malware Analysis
            • Object Sighting
              • Define Object Sighting
            • Observed Data
              • Define Observed Data
            • Threat Actor
              • Define Threat Actor
            • Threat Event
              • Define Threat Event
            • Threat Grouping
              • Define Threat Grouping
            • Threat Note
              • Define Threat Note
            • Threat Opinion
              • Define Threat Opinion
            • Threat Report
              • Define Threat Report
            • Tool
              • Define Tools
            • Vulnerability
              • Define Vulnerability
              • Fetch Vulnerability Data
            • Marking Definition
              • Define Marking Definition
            • Data Component
              • Define Data Component
            • Data Sources
              • Define Data Sources
            • Define RSS Feeds
            • Relationships Objects
              • Define observable-observable relationships
              • Define object-object relationships
              • Define object-observable relationships
              • Define object-indicator relationships
              • Define indicator-indicator relationships
              • Define indicator-observable relationships
            • Potential Relationships
              • Confirm observable-observable potential relationship
              • Confirm object-object potential relationships
              • Confirm indicator-indicator potential relationships
          • Export intelligence data
          • Confirm Potential Relationships from Related Records
          • Automated Correlation
        • Working with Data Exports
          • View all exports
          • View my exports
          • Export intelligence system properties
        • MITRE-ATT&CK Repository
          • Manage Matrices
          • Manage Techniques
          • Manage Mitigations
          • Manage Groups
          • Manage Malware
          • Manage Tools
          • Manage MITRE Relationships
        • Data migration in TISC
          • Data migration from SIR TI to TISC
        • TISC Data Processing Functional Flow
        • TISC Data Archival
          • TISC Data Archival
            • Archive TISC related records
            • Destroy Rules in TISC
          • Delete intelligence records
    • Data Loss Prevention Incident Response
      • Exploring Data Loss Prevention Incident Response
        • DLP Incident Response overview
        • Get started with DLP Incident Response
      • Installing and configuring DLP IR Incident Response
        • Install and configure the DLP Incident Response application
        • Domain separation and DLP Incident Response
      • DLP Incident Response Administration
        • DLP default configuration settings
        • Create end user lookup rules
        • Create assignment rules
        • Create incident consolidation rules
        • Create response due date rules
          • Add multiple users to access DLP incidents
        • Create Approval Rules
        • Create user instructions templates
          • Configure DLP UI user instructions
        • Create email templates
        • Create a Data Loss Prevention Incident Response SLA trigger
        • Create a Data Loss Prevention Incident Response SLA definition
        • Create assessments
        • Configure response option for your DLP incidents
        • Create incident response option rules
        • Create age chart configurations
        • Create user delegate configurations
        • Create repeat offender identification rules
        • Create Additional Incident Data Fields
        • DLP SLA Definition form
        • Configure advanced settings
        • Monitor DLP Integration Run process
        • DLP Incident Access Restrictions
          • Create field level restrictions
          • Create record level restrictions
        • DLP Incidents Archival
          • Archive DLP related records
      • Data Loss Prevention Incident Response Incident Management
        • Data Loss Prevention Incident Response User Workspace
          • Report or respond to DLP incidents
          • Working with my approvals module
        • Data Loss Prevention Incident Response Analyst Workspace
        • Data Loss Prevention Incident Response Dashboard
      • Inbound Integration for Data Loss Prevention Incident Response
      • DLP integrations
        • Symantec Integration for Data Loss Prevention Incident Response
          • Getting started with Symantec DLP integration for Data Loss Prevention
          • Install and configure the Symantec DLP integration for Data Loss Prevention
          • Create a profile for Symantec DLP integration
            • Define filters to apply for the Incident creation
            • Configure evidence file storage
            • Schedule the Symantec DLP Incident Retrieval
            • Mapping Symantec DLP incident statuses with ServiceNow incident Status
          • Severity mapping between Symantec DLP incidents with ServiceNow incidents
          • Configure Smart Response Rules
          • Execute Smart Response Rules
          • Download evidence files on Symantec
          • Preview evidence files
          • Configure the Symantec DLP  integration settings
          • Domain Separation in the Symantec DLP integration
        • Data Loss Prevention Incident Response Integration with Proofpoint
          • Getting started with Proofpoint integration for Data Loss Prevention
          • Install and configure the Proofpoint integration for Data Loss Prevention
            • Create an Application in Proofpoint and Obtain Client Credentials
            • Configure the Webhook on the Proofpoint DLP tenant for alert notifications to ServiceNow
          • Create a Profile for Proofpoint DLP integration
            • Define filters to apply for the Incident creation
            • Configure evidence file storage
            • Download DLP incidents evidence files on Proofpoint
            • Preview evidence files
            • Email remediation actions
          • Map Proofpoint DLP incidents status with ServiceNow incident status
          • Configure Proofpoint DLP integration settings
          • Domain Separation in Proofpoint DLP integration
        • Data Loss Prevention Incident Response Integration with Netskope
          • Getting started with Netskope DLP integration for Data Loss Prevention
          • Install and configure the Netskope DLP integration for Data Loss Prevention
          • Create a Profile for Netskope DLP integration
            • Define Filters to apply for the Incident creation
            • Schedule the Netskope DLP incidents retrieval
          • Mapping DLP incident status with Netskope
          • Configure Netskope DLP integration settings
          • Download evidence files
          • Preview evidence files
          • Notifications for users on retry mechanism
          • Email notifications on credential expiration
          • Domain Separation in Netskope DLP integration
        • Internet Content Adaption Protocol (ICAP) integration for DLP IR
          • Getting started with ICAP DLP integration for Data Loss Prevention
          • Install and configure the ICAP DLP integration
          • Create a profile for ICAP DLP integration
            • Define filters to apply for the Incident creation
            • Schedule the ICAP DLP incidents retrieval
          • View sensitive information for DLP alerts
          • Download evidence files for DLP alerts
          • Preview evidence files for ICAP
          • Review the ICAP DLP integration settings
        • Data Loss Prevention Incident Response with Microsoft
          • Getting started with Microsoft DLP IR integration for data loss prevention
          • Install and configure the Microsoft DLP integration
          • Create a new incident profile for Microsoft DLP integration
            • Microsoft purview endpoint storage configuration
            • Define filters to apply for the Incident creation
            • Configure the match content for the incident
            • Schedule the DLP IR Microsoft incident retrieval
          • Configure Microsoft DLP IR integration settings
          • Configure evidence file storage for Microsoft
          • Request release email from quarantine
          • Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
            • Download files approval flow
          • Preview Evidence files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
          • Domain separation in Microsoft DLP integration
    • Security Operations common functionality
      • Create and define filter groups in Security Operations
      • Shared data transformation
        • Create duplication rules in Security Operations
      • Security Operations email processing
        • Security Operations email properties
          • Create Security Operations email properties
        • Security Operations email parsing
          • Create email parsers in Security Operations
          • Edit email records in Security Operations
        • Unmatched Security Operations email events
          • View and reprocess unmatched Security Operations emails
      • Security Operations field mapping
        • Map tables to tables with Security Operations field mapping
      • Security Operations field value transforms
        • Create Security Operations field value transforms
      • Security Operations enrichment data mapping
        • Create a Security Operations enrichment data map
      • Security Operations user-defined escalation
        • Create a Security Operations user-defined escalation group
      • Create domain-separated property overrides
      • Create an operating system group
      • Set up security tag groups and tags
        • Create security tag rules
        • Import security tag rules
      • Security annotations
        • Create security annotations for CIs
        • Create security annotations for observables
        • Create security annotations for users
        • View security annotations reports
      • Components installed with Security Support Common
        • View components installed with Security Support Common
      • Search Security Operations
      • Security Operations Integration Reference
        • ServiceNow Security Operations integration development guidelines
          • Types of ServiceNow integrations provided
          • Security Operations Integration Configurations
            • Activate and configure third-party integrations
            • Create an integration
          • Tips for writing integrations
          • Integration troubleshooting
            • Replace an untrusted or expired third-party SSL certificate
        • Integrations Capabilities framework 2.0
        • REST APIs for third-party integration with Security Operations
        • Integration capabilities
          • Security Operations Integration- Block Request capability
            • Run Block Request
            • Security Operations Integration - Block Request Flow
          • Security Operations Integration- Email Search and Delete capability
            • Security Operations Integration - Email Search and Delete flow
              • Execution Tracking Begin (Mail Search) activity
          • Security Operations Integration- Enrich CI capability
            • Security Operations Integration - CI Enrichment flow
          • Security Operations Integration- Enrich Observable capability
            • Security Operations Integration - Enrich Observable workflow
          • Security Operations Integration- Get Network Statistics capability
            • Security Operations Integrations - Get Network Statistics workflow
            • Execution Tracking - Begin (CIs) Flow Action
            • Security Incident Response- Get Network Statistics Flow
          • Security Operations Integration- Get Running Processes capability
            • Security Operations - Get Running Processes Flow
            • Security Operations Carbon Black Integration - Get Running Processes Flow
              • Collect Carbon Black Configurations Flow Action
              • Check MID Server Status
              • Get Sensor ID Flow Action
              • Create Session Flow Action
              • Check Session Status Flow Action
              • Create Command Process Flow Action
              • Check Command Status and Get Process Flow Action
              • Map Processes Data Flow Action
              • Close Session Flow Action
            • Security Operations System Command Integration- Get Running Processes flow
              • Combine results activity
              • Execute Shell Script activity
              • Extract Shell Script from MID Script activity
              • Get Running Processes via PowerShell activity
          • Security Operations Integration- Isolate Host capability
            • Security Operations - Isolate Host Flow
            • Run Isolate Host
            • Security Operations Carbon Black Integration - Isolate Host Flow
              • Get Sensor ID Flow Action
              • Set Network Isolation Enabled Flow Action
              • Update Sensor Flow Action
            • Security Operations Carbon Black Integration- Remove Host Isolation Flow
          • Security Operations Integration- Publish to Watchlist capability
            • Security Operations Integration - Publish to Watchlist Flow
          • Security Operations Integration- Sightings Search capability
            • Create sightings search configuration records
              • Run a Sightings Search
              • Security Operations Integration - Sightings Search Flow
                • Security Operations - QRadar Sightings Search Flow
                • Security Operations - McAfee ESM Sightings Search Flow
                • Security Operations - Arcsight Logger Sightings Search Flow
                • Security Operations - Elasticsearch Sightings Search Flow
                • Security Operations Integration - Splunk Sightings Search Flow
              • View Sightings Search Results
                • Share Sightings Search results
                • Share observables from a security incident
              • View Sightings Search Details
              • View Sightings Search Data
          • Security Operations Integration - Threat Lookup capability
            • Security Operations Integration - Threat Lookup workflow
          • Change the order of workflow execution
        • Common Security Operations integration flows and orchestration Flow Actions
          • Execution Tracking - Begin Flow Action
          • Capability Execution Tracking - Complete Flow Action
          • Capability Execution Tracking- Failure Flow Action
          • Capability - Determine CIs activity
          • Create Enrichment Data records Flow Action
          • Get Configuration Item FQDN Flow Action
          • Determine Observables activity
          • Get Supported Security Capabilities activity
          • Capability Execution Tracking- No Impls activity
          • Create Compliance Search Action
          • Get IP from CI activity
          • Get Network Statistics via netstat Flow Action
          • Get running processes via WMI activity
          • Check Compliance Search Status Action
          • Update Task Worknotes activity
          • Roll up lookup info to security incident activity
          • Update security incident with lookup results workflow
          • Filter Allowlisted Observables activity
          • Write content to record as attachment activity
          • Get IP from CI Flow Action
      • Security Operations workflow triggers
        • Create Security Operations workflow triggers
      • Security Operations Orchestration
    • Security Operations and the ServiceNow Store
      • Download an application from the ServiceNow Store for the first time
        • Get entitlement for a Security Operations product or application
        • Activate a ServiceNow Store application
      • Install a Security Operations integration
      • Update an application previously downloaded from the ServiceNow Store
      • Upgrade your instance to the next family release
  • Security Operations
    • Exploring Security Operations
    • Now Assist for Security Incident Response
      • Exploring Now Assist for Security Incident Response
        • Supporting information for Now Assist for Security Incident Response
      • Configuring Now Assist for Security Incident Response
        • Configure and activate a skill for Now Assist for Security Incident Response
        • Customize a Now Assist for Security Incident Response skill
        • Inputs and triggers for Now Assist for Security Incident Response
      • Using Now Assist for Security Incident Response to close security incidents
        • Summarize a security incident with Now Assist for Security Incident Response
        • Generate closure notes for a security incident with Now Assist for Security Incident Response
        • Generate recommended actions for a security incident with Now Assist for Security Incident Response
          • Generate recommended actions in UI16 for a security incident with Now Assist for Security Incident Response
        • Generate a post-incident analysis for a security incident with Now Assist for Security Incident Response
          • Generate a post-incident analysis in UI16 for a security incident with Now Assist for Security Incident Response
        • Exploring correlation insights with Now Assist for Security Incident Response
          • Generate correlation insights from the Security Incident Response Workspace with Now Assist for Security Incident Response
          • Generate correlation insights with Now Assist for Security Incident Response
        • Request generative AI skills in the Now Assist panel for Now Assist for Security Incident Response
      • Using AI agentic workflows in Now Assist for Security Incident Response
        • Activate an agentic workflow for Now Assist for Security Incident Response
        • Security Incident Response AI agent collection close security incident use case
          • Close a security incident
        • Security Incident Response AI agent collection Resolve security incident agentic workflow
          • Resolve a security incident
        • Security Incident Response AI agent collection for the Analyze security operations metrics agentic workflow
          • Analyze security operations metrics agentic workflow
    • Now Assist for Vulnerability Response
      • Exploring Now Assist for Vulnerability Response
        • Supporting information for Now Assist for Vulnerability Response
      • Configuring Now Assist for Vulnerability Response
        • Activate an agentic workflow for Now Assist for Vulnerability Response
      • Using agentic workflows in Now Assist for Vulnerability Response
      • Vulnerability Response AI agent collection for the Assess vulnerability exposure agentic workflow
        • Assess vulnerability exposure agentic workflow
      • Vulnerability Response AI agent collection for the Analyze vulnerability remediation status agentic workflow
        • Analyze vulnerability remediation status agentic workflow
    • Unified Security Exposure Management (USEM)
      • Exploring Unified Security Exposure Management (USEM)
        • Security Exposure Management Workspace
          • Administration in Unified Security Exposure Management
            • Visualization library
          • Viewing the Cloud Exposure View dashboard
          • Security Exposure Management Approvals View
          • Security Exposure Management Workspace Findings view
          • Remediation view
          • Security Exposure Management Workspace List view
          • Security Exposure Management Workspace Watch Topics
        • Security Exposure Management Workspace Health dashboard
        • Security Exposure Management workflow
          • Automating prioritization and triaging
            • Associating finding with a configuration item using lookup rules
              • Managing unmatched configuration items (CIs)
              • Managing unclassed hardware
              • Steps to help prevent duplicate or orphaned records after running lookup rules
            • Categorizing findings and discovered items using classification rules
            • Prioritizing vulnerabilities and other findings using roll-up calculators
              • Vulnerability Response Rollup Calculators
            • Assigning findings to remediation teams using assignment rules
              • Removing assignments from findings and remediation tasks
            • Defining your own service level agreements (SLAs) using remediation target rules
            • Deferring findings automatically without manual intervention using exception rules
            • Grouping multiple findings as remediation tasks for easy processing using remediation task rules
            • Closing stale detections and findings automatically using auto-close rules
            • Deleting stale findings automatically using auto-delete rules
            • Controlling the ingestion volume with automatic exclusion
            • Severity mapping for Unified Security Exposure Management
      • Implementing Unified Security Exposure Management
        • Migrate to Unified Security Exposure Management (USEM) from Vulnerability Response
        • Installing Security Exposure Management Workspace applications
          • Migration upgrade prerequisites
          • Install Unified Security Exposure Management
          • Download and activate applications
        • Security Exposure Management Workspace Roles
        • Access control lists (ACLs) for administration rules
        • Security Exposure Management Workspace personas and granular roles
          • Assign the Vulnerability Response persona roles using Setup Assistant
            • Manage persona and granular roles for Vulnerability Response
        • Configure rules to manage findings
          • Configuring lookup rules
          • Configuring classification rules
          • Configuring roll-up calculator rules
          • Configuring assignment rules
          • Configuring remediation target rules
          • Configuring an exception rule
            • Create an exception rule
            • Approve an exception rule request
            • Activating an exception rule
            • Reopen an exception rule
            • Update an approved exception rule
            • Delete an exception rule
          • Define fields and weights for the risk rule for Unified Security Exposure Management risk calculators
          • Configuring remediation task rules
          • Configuring auto-close rules
          • Configuring auto-delete rules
          • Configuring exclusion rules
            • Create or edit exclusion rules
          • Approve or reject an unassign request
          • Approval workflow configurations for unassign request
        • Configure Exception Management for Security Exposure Management
          • Request an exception using GRC: Policy and Compliance Management
          • Specify the duration of an exception requested for a remediation task
        • Configure email notifications in Unified Security Exposure Management
        • Configure email templates in Unified Security Exposure Management
        • Configure a severity map in the Security Exposure Management Workspace
        • Configure Visualization library
          • Create a custom widget
          • Update a widget
          • Localize widget titles
      • Unified Security Exposure Management integrations
        • Review Unified Security Exposure Management integrations
      • Using Unified Security Exposure Management
        • Create a dashboard in the Findings view page
        • Reclassify unclassed hardware
        • Bulk edit in the Security Exposure Management Workspace
          • Using bulk edit in the Security Exposure Management Workspace
            • Update the state of records in bulk in the Security Exposure Management Workspace
            • Bulk edit host vulnerable items with patches and solutions
            • Assign records to an assignment group in bulk
            • Remove assignments for host vulnerable items in bulk
            • Request bulk exception in the Security Exposure Management Workspace
            • Bulk edit for false positive in the Security Exposure Management Workspace
            • Close records in bulk in the Security Exposure Management Workspace
        • Use the List view in the Security Exposure Management Workspace
          • Create a customized list of records
        • Create a remediation task manually in the Security Exposure Management Workspace
        • Enable or disable the import of test results for a Qualys test group
        • Modify the severity for a CVE or TPE
        • Use Remediation Effort records
          • Create a remediation effort in the Security Exposure Management Workspace
          • Create a remediation task on-demand from Remediation Effort in the Vulnerability Manager Workspace
          • Create a recurring remediation effort in the Security Exposure Management Workspace
          • Transfer records to remediation efforts in the Security Exposure Management Workspace
        • Approve or reject requests in the Security Exposure Management Workspace
        • Add a compensating control to the library
          • Associate compensating controls with CVEs or TPEs for risk reduction requests
          • Disable or enable risk reduction for a CVE or TPE
        • Examples for remediation task creation in the Security Exposure Management Workspace
        • Exception Management Overview
          • Approver roles required for Security Exposure Management Workspace
          • Questionnaire support in Exception Management via Smart Assessment
            • Questionnaire Configuration form fields
            • Configure an assessment template
            • Use case for False positive or Request Exception Questionnaire
          • Defer a Remediation task
          • Request an extension for a deferred remediation task
          • Request a false positive for a vulnerable item or remediate task
        • Unified Approvals View
          • Add an approver
          • Configure Approval List and Form View
          • Reviewing an Approval Request
          • Review questionnaire to approve or reject requets
        • Employee service center for Vulnerability Response
          • Managing Approvals via the Employee Service Center
      • Unified Security Exposure Management reference
        • Security Exposure Management Workspace Components
          • Security Exposure Management Workspace Roles
          • Security Exposure Management Workspace Tables
          • Security Exposure Management Workspace Scheduled Jobs
        • Security Exposure Management Knowledge Base articles
        • Security Exposure Management Workspace remediation task rule examples
        • Migration upgrade reference information
        • Security Exposure Management Workspace Roles
        • Visualization widget fields
        • Re-evaluating the exceptions for selected records in the Security Exposure Management Workspace
      • Vulnerability Response
        • Exploring the Vulnerability Response application
          • Migrating from Vulnerability Response to Unified Security Exposure Management (USEM)
            • Planning for migration from Vulnerability Response to Unified Security Exposure Management (USEM)
          • Installation of Vulnerability Response and supported applications
          • Vulnerability Response personas and granular roles
          • Vulnerability Response assignment rules overview
          • Vulnerability Response remediation tasks and remediation task rules overview
          • Vulnerability Response remediation target rules
          • Vulnerability classification groups and rules
          • Machine Learning solutions for Vulnerability Response
          • CI lookup rules for identifying configuration items from Vulnerability Response third-party vulnerability integrations
            • Unclassed hardware
            • Unmatched CIs
          • Creating CIs for Vulnerability Response using the Identification and Reconciliation engine
            • Updating CI class for unmatched cloud assets
          • Discovered Items
            • CI changes for discovered items
            • Re-evaluating discovered items
          • Vulnerability Response remediation task and vulnerable item states
            • Vulnerable item age calculation and display
          • Removing assignments from vulnerable items and remediation tasks
          • Vulnerability Response calculators and vulnerability calculator rules
          • Vulnerability Response vulnerable item detections from third-party integrations
          • Vulnerability Solution Management
            • Understanding the Microsoft Security Response Center Solution Integration
            • Understanding the Red Hat Solution Integration
            • Rapid7 solution management
            • Generic framework to ingest data from any solution vendor
          • Patch orchestration with Vulnerability Response
          • Exception Management overview
          • Exception rules overview
          • Exclusion rules overview
          • False Positive overview
          • Questionnaire support in Exception Management via Smart Assessment
            • Configure Assessment template
            • Smart Assessment workflow
            • Questionnaire for False positive or Request Exception
          • Watchdog for Vulnerability Response
          • Change management for Vulnerability Response
          • Software exposure assessment using Software Asset Management (SAM Foundation)
          • Vulnerability Crisis Management
          • Domain separation and Vulnerability Response
          • Service Mapping in Vulnerability Response
        • Vulnerability Response implementation
          • Migrate to Unified Security Exposure Management (USEM) from Vulnerability Response
          • Install Vulnerability Response
            • Components installed with Vulnerability Response
          • Configuring Vulnerability Response using the Setup Assistant
            • Assign the Vulnerability Response persona roles using Setup Assistant
              • Manage persona and granular roles for Vulnerability Response
            • Install Vulnerability Response third-party applications using Setup Assistant
              • Importing data with the NVD and CWE integrations and managing third-party libraries
              • Install the Solution Management for Vulnerability Response application
              • Install and configure the Performance Analytics for Vulnerability Response [PA] application
            • Vulnerability Response applications and CSDM tables
            • Create or edit Vulnerability Response assignment rules
            • Create a Vulnerability Response assignment rule using ML
            • Create a Vulnerability Response assignment rule for service support
            • Create or edit Vulnerability Response remediation task rules
            • Define fields and weights for the risk rule for Vulnerability Response Risk Calculators
            • Vulnerability Response Rollup Calculators
            • Create or edit a Vulnerability Response remediation target rule
              • Recalculate a remediation target date
                • Examples of recalculating a remediation target date
            • Configure installed third-party integrations using the Setup Assistant
              • Configure installed solution integrations for Vulnerability Solution Management using Setup Assistant
              • Configure the MS TVM Vulnerability Integration using Setup Assistant
              • Configure the Qualys Vulnerability Integration using Setup Assistant
              • Configure the Tenable Vulnerability Integration using Setup Assistant
            • Setting up vulnerability solution providers
              • Prepare solution integration checklist
                • Preparing the Common Vulnerability Reporting Framework (CVRF) solution integration
                • Preparing the Common Security Advisory Framework (CSAF) solution integration
              • Configure vulnerability solution providers
                • Common Vulnerability Reporting Framework (CVRF)
                  • Import Common Vulnerability Reporting Framework data through file import
                  • Configure Connection and Credential aliases
                  • Configure a Common Vulnerability Reporting Framework vendor other than Cisco
                  • Import Common Vulnerability Reporting Framework data from advisories
                  • Import Common Vulnerability Reporting Framework (CVRF) data through CVRF URL
                  • Troubleshooting Common Vulnerability Reporting Framework data import
                • Common Security Advisory Framework (CSAF)
                  • Import Common Security Advisory Framework data through file import
                  • Configure Connection and Credential aliases for the Common Security Advisory Framework (CSAF)
                  • Configure a Common Security Advisory Framework vendor other than Red Hat
                  • Import Common Security Advisory Framework data from advisories
                  • Import Common Security Advisory Framework (CSAF) data through CSAF URL
                  • Troubleshooting Common Security Advisory Framework data import
          • Additional Vulnerability Response setup and configuration tasks
            • Quick start tests for Vulnerability Response
              • Run the Automated Test Framework (ATF) test suite for Vulnerability Response
            • Install Vulnerability Assignment Recommendations for Vulnerability Response
              • Configure Vulnerability Assignment Recommendations for Vulnerability Response
              • Create and train a solution definition for Vulnerability Response
            • Create a Vulnerability Response calculator
              • Disable the default vulnerability calculator if not used
            • Create, enable, or, modify Vulnerability Response auto delete rules
            • Add vulnerability significance charts to the Vulnerability Response homepage
            • Define Vulnerability Response email notifications
              • Define Vulnerability Response email templates
              • Create or edit remediation target notifications
            • Configure the Vulnerability Exposure Assessment
            • Configure Exception Management for Vulnerability Response
              • Add an exception approver
            • Configure approval rules for Exception Management
              • Create configurations for an approval rule
              • Create approval levels for Exception Management
              • Exception management workflow versus flow designer
            • Add a false positive approver
            • Configure questionnaire for risk reduction
            • View Vulnerability Response SLAs for remediation tasks
            • Configure watchdog
            • Configure maximum rows in related list
          • Advanced Vulnerability Response configuration tasks
            • Create domain-separated imports for an integration
              • Create and support multiple domains in the background jobs framework
            • Create a Vulnerability Response CI lookup rule
              • Ignore CI classes
              • Filter decommissioned CIs
              • Auto-promote CIs
            • Configure the vulnerable item key
              • Adding proof to Rapid7 vulnerable item keys
              • Delete all your vulnerable item records and related data in Vulnerability Response
            • Filtering within Vulnerability Response
            • Severity mapping for Vulnerability Response
            • Create a Vulnerability Response severity map
            • Define service classifications for Vulnerability Response reporting and related lists
            • Audit selected fields in the vulnerable items table
            • Vulnerability Response background job framework configuration
              • Define background job configurations in Vulnerability Response
              • Advanced parallel processing for background jobs in Vulnerability Response
        • Vulnerability Response integrations
          • Understanding the NVD integrations
            • Preparing for the NVD integrations
            • Configure and run the scheduled job for updating CWE records
            • Install the Vulnerability Response Integration with the NIST National Vulnerability Database
            • Optional NVD integration modification and activities
              • Perform a manual NVD integration import
            • View the (National Vulnerability Database) NVD integration import run status
            • Add CVEs to third-party entries
            • View Vulnerability Response vulnerability libraries
          • CISA Known Exploit Vulnerability (KEV) Integration
            • Preparing for the CISA integration
            • Install the ServiceNow Vulnerability Response Integration with CISA application
          • Understanding the Exploit Prediction Scoring System (EPSS) integration
            • Configure and run a scheduled job to update CVE records with EPSS data
            • Add EPSS Score condition in Risk calculator Business Rule
          • Understanding the Microsoft Threat and Vulnerability Management Vulnerability integration
            • Preparing for the Microsoft Threat and Vulnerability Management Vulnerability Integration
            • Set up Microsoft Azure for the MS TVM integration
            • Install and configure the Vulnerability Response Integration with the MS TVM application using Setup Assistant
            • Data retrieval settings for the Microsoft Threat and Vulnerability Management Integration
            • REST messages for the Microsoft Threat and Vulnerability Management Vulnerability Integration
              • Data transformation for the Microsoft Threat and Vulnerability Management Vulnerability Integration
            • Integration run status chart for the Microsoft Threat and Vulnerability Management Vulnerability Integration
              • Verify the Microsoft Threat and Vulnerability Management integration import run status
            • Split Microsoft TVM detections based on the vulnerability instance to split vulnerable items
          • Understanding the HCL BigFix patch orchestration integration with Vulnerability Response
            • Integrations and dependencies of the Vulnerability Response Patch Orchestration integration with HCL BigFix
            • Prepare for the Vulnerability Response Patch Orchestration integration with HCL BigFix
            • Install the Vulnerability Response Patch Orchestration with HCL BigFix application
            • Configure the Vulnerability Response patch orchestration integration with HCL BigFix
            • Viewing patch data for the Vulnerability Response patch orchestration integration with HCL BigFix
            • Schedule patches with the Vulnerability Response patch orchestration integration HCL BigFix
            • REST messages for the Vulnerability Response patch orchestration integration with HCL BigFix
            • Data transformation for the patch orchestration integration with HCL BigFix
            • Example workflow for the Vulnerability Response patch orchestration integration with HCL BigFix
          • Understanding the Vulnerability Response patch orchestration integration with Microsoft SCCM
            • Integrations and dependencies of the Vulnerability Response Patch Orchestration with the Microsoft SCCM application
            • Prepare for the Vulnerability Response patch orchestration integration with Microsoft SCCM
            • Install the Vulnerability Response Patch Orchestration with Microsoft SCCM application
            • Configure the Vulnerability Response Patch Orchestration with Microsoft SCCM integration
            • Viewing patch data and patch data rollup for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM
            • Schedule patches with the Microsoft SCCM integration with Vulnerability Response
            • REST messages for the Vulnerability Response Patch Orchestration with Microsoft SCCM
            • Data transformation for the Patch Orchestration with Microsoft SCCM Integration
            • Example workflow for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM
          • Understanding the Qualys Vulnerability Integration
            • Preparing for the Qualys Vulnerability Integration
            • Install the Qualys Vulnerability Integration
              • Activate the Qualys scanners
              • Components installed with the Qualys Vulnerability Integration
            • Update configuration items with the network partition identifier for the Qualys Vulnerability Integration
            • Optional Qualys modifications
            • Advanced Qualys configurations and modifications
            • Qualys metadata for vulnerabilities
              • Import additional metadata from Qualys
              • Qualys metadata values for vulnerabilities
              • Set additional filter parameters for Qualys imports
            • Resolving Qualys Vulnerability Integration issues
            • Qualys Vulnerability Integration reporting
              • Qualys integration run status chart
            • Qualys data transformation
              • Dynamic Search List Import
              • Static Search List Import
              • Asset Group Import
              • Appliance Import
            • Qualys REST messages
          • Understanding the Rapid7 Vulnerability Integration
            • Preparing for the Rapid7 Vulnerability Integration
              • Set up for the Rapid7 data warehouse Integration
              • Set up for the Rapid7 InsightVM Integration
            • Install the Rapid7 Vulnerability Integration
              • Configure the Rapid7 Vulnerability Integration
              • Filtering by Rapid7 sites
                • Prepend SITE to your Rapid7 InsightVM site tags
              • Deduplicate Rapid7 Vulnerability Integration data warehouse records
            • Rapid7 Vulnerability Integration run status chart
              • View the Rapid7 Vulnerability Integration import runs status dashboard
            • Initiate rescan for the Rapid7 Vulnerability Integration
            • Set additional filter parameters for Rapid7 InsightVM imports
          • Understanding the Shodan Exploit Integration
            • Preparing for the Shodan Exploit Integration
            • Install and configure the Shodan Exploit Integration for Security Operations
              • Set Shodan Exploit Integration import time
              • Perform a manual Shodan exploit import
            • View the Shodan Exploit Integration import run status
          • Understanding the Tenable Vulnerability Integration
            • Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications
            • Tenable.sc integrations with the Vulnerability Response application
            • Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application
            • Preparing for the Tenable Vulnerability Integration
            • Install the Vulnerability Response Integration with Tenable application using Setup Assistant
            • Data retrieval settings for the Tenable Vulnerability Integration
            • REST messages for the Tenable Vulnerability Integration
              • Data transformation for the Tenable Vulnerability Integration
            • Set additional filter parameters for Tenable.io imports
            • Tenable Vulnerability Integration reporting
              • Integration run status chart for the Tenable Vulnerability Integration
            • Initiate rescan for the Tenable.sc integration
            • Initiate rescan for the Tenable.io integration
            • Update configuration items with the network partition identifier for the Tenable Vulnerability Integration
            • Import modifications for the Tenable Vulnerability Integration
            • Split Tenable detections based on the vulnerability instance to split vulnerable items
          • Understanding the Atlassian Jira integration with Vulnerability Response
            • Preparing for the Jira Vulnerability Response integration
            • Install the Vulnerability Response Integration with Jira
            • Configure rules in the agile tool configuration
              • Create agile issue manually using list action
              • Create agile issue manually using form action
            • Manually synchronize the status of the Jira issue
              • Configure scheduler to create issues automatically
              • Configure scheduler to update issues automatically
              • Configure scheduler to synchronize the Jira status to ServiceNow automatically
          • Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
            • Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
            • Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
            • Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application
            • Integration run status chart for Prisma Cloud Compute Integration
          • Understanding the Wiz Vulnerability Response Integration
            • Activate the Wiz Vulnerability Response Integration application
            • Configure the Wiz Vulnerability Response Integration
              • Identify Wiz Resource types for the Wiz Vulnerability Integrations
              • Set filtering for the Wiz Host Vulnerabilities Integration
              • Set filtering for the Wiz Container Vulnerabilities Integration
                • Configure Container image vulnerability keys for the Vulnerability Response Integration with Wiz
              • Set filtering for the Wiz Test Results Integration
              • Set filtering for the Wiz Issues Integration
              • Set filtering for the Wiz Host Test Results Integration
              • Wiz Backfill Integrations
            • Schedule the Wiz Vulnerability Integrations
            • Field mapping for the Wiz Vulnerability Response Integrations
          • Manually create a vulnerability integration
            • Define a new vulnerability integration
              • Vulnerability integration script
                • Single call integrations
                • Multiple call integrations
                • Attachments as retrieveData() return values
              • Report processor strategies
                • Use the data source attachment report processor strategy
                • About custom report processor scripts
              • Integration factory script fields
            • Manually run a vulnerability integration
          • Manual ingestion of vulnerabilities
            • Ingest vulnerabilities manually
            • Verify manual integration run
            • Configure auto-close manual detections
            • Verify upload status
            • Template for manual ingestion of vulnerabilities
        • Vulnerability Response remediation overview
          • Verify successful completion of Vulnerability Response integration imports
          • View Vulnerability Response vulnerable item detection data
            • Verify Vulnerability Response vulnerable item detection data on integration run (VINTRUN) records
          • Viewing patch data and scheduling patches in Vulnerability Response
            • Patch data and state rollup for patch orchestration in Vulnerability Response
            • View patches without solutions in Vulnerability Response
            • Viewing patch orchestration data on the Vulnerability Response dashboards
          • View a solution
          • Create a vulnerability solution
            • Manually exclude solutions from third-party records or vice versa
          • Triage vulnerabilities automatically
            • Edit vulnerable items in bulk in Vulnerability Response
            • Ungrouped Vulnerability Response vulnerable items
              • View ungrouped Vulnerability Response vulnerable items
              • Manually add a vulnerable item to a remediation task
            • Remove assignments from vulnerable items and remediation tasks
            • Approve or reject an unassign request in Vulnerability Response
            • Automatic closing of vulnerable items and detections
              • Working with retired configuration items
              • Automatically close vulnerable items related to retired CIs
            • Closing stale detections in Vulnerability Response
              • Automatically close stale detections in Vulnerability Response
              • Create auto-close rules
            • Reclassify unclassed hardware
          • Manually create a remediation task in Vulnerability Response
            • Add users to the Vulnerability Response group
          • Manage individual vulnerable items manually
            • Create Vulnerability Response vulnerable items
              • Defer a vulnerable item
                • Request an extension for a deferred vulnerable item
            • Refresh Vulnerability Response vulnerable items
              • Identify and escalate security issues in third-party software
              • Identify and escalate security issues using NVD
              • Identify and escalate security issues using CWE
              • View the remediation target status of a Vulnerability Response vulnerable item
          • Working with unmatched CIs
            • View and reclassify unmatched configuration items
            • Reconcile unmatched discovered items
              • Reapply CI lookup rules on selected discovered items
              • Reapply CI Lookup Rules Enhancements
            • Steps to help prevent duplicate or orphaned records after running Vulnerability Response CI lookup rules
            • De-duplicating existing configuration items
            • Working with unmatched CIs
              • Resolve remediation tasks
                • Defer a Remediation task
                  • Request an extension for a deferred remediation task
                • Close a remediation task
          • Identifying duplicate vulnerable items from multiple scanners
            • Automatically resolve duplicate vulnerabilities
          • Create and edit a classification group
            • Create and edit a classification rule
            • Apply a rule to an existing vulnerability
            • Deactivate or delete a classification rule
          • Create an exclusion rule
          • Change Management tasks for Vulnerability Response
            • Create a change request from a remediation task
            • Associate a remediation task to an existing change request
            • Split a remediation task
            • State synchronization between change requests and remediation tasks
          • Assess your exposure to vulnerable software
          • Viewing assignment recommendations
            • Request assignment group recommendations for a vulnerable item
            • Request assignment group recommendations for multiple vulnerable items
            • Request assignment group recommendations for a remediation task
          • Requesting and approving an exception
            • Request an exception for a vulnerable item
            • Request an exception for a remediation task
            • Request a bulk exception
            • Request an exception using GRC: Policy and Compliance Management
              • Request a bulk exception using GRC: Policy and Compliance Management
            • Approve or reject an exception request in Vulnerability Response
          • Working with an exception rule
            • Create an exception rule
            • Approve an exception rule request
            • Activating an exception rule
            • Request an extension for an exception rule
            • Reopen an exception rule
            • Update an approved exception rule
            • Delete an exception rule
          • Marking and approving a false positive
            • Mark as a false positive
              • Bulk edit for false positive
            • Approve or reject a false positive
        • Analytics and Reporting Solutions for Vulnerability Response
          • Using the default Vulnerability Response dashboards
          • Platform Analytics Solutions for Vulnerability Management
            • Vulnerability Management CISO dashboard
              • Configure the Scan Coverage reports
              • Configure the PA indicators for the CISO Dashboard
            • SecOps Vulnerability Response Health dashboard
              • Modifying the threshold values
          • Vulnerability Management (PA) dashboard
            • View Performance Analytics for Vulnerability Response [PA] reports in real-time
            • View the Performance Analytics indicators for Vulnerability Response [PA]
          • Aggregated reports framework
            • Configure an aggregation for source data
              • Run multiple aggregations simultaneously
              • Configure the number of aggregations that can run simultaneously
            • Create a report using an aggregation
        • Vulnerability Response reference information
          • Implementation checklist for the Vulnerability Response application
          • Vulnerability Response remediation task states
            • Detections, remediation tasks, and vulnerable item states
            • Remediation tasks and vulnerable item states
            • State roll-up and roll-down scenarios
            • Remediation task state for Vulnerable Items (VITs) in multiple groups
          • Additional settings for domain separation
          • Discovered Items form fields
          • Vulnerability Response vulnerability form fields
          • Remediation target rule fields
          • Remediation task form fields
          • Questionnaire Configuration form fields
          • Vulnerability Response vulnerable item form fields
          • Solution form fields
          • Approval workflow configurations for unassign request
          • Vulnerability Response remediation task rule examples
          • Risk score calculation example for Vulnerability Response
          • Error handling for detections
        • Mobile experience for Vulnerability Response
          • Set up checklist for the Vulnerability Response Mobile app
          • Log in to the Vulnerability Response Mobile app
          • View, assign, and edit remediation tasks with the Vulnerability Response Mobile app
          • View, reassign, and edit remediation tasks assigned to you with the Vulnerability Response Mobile app
          • Search for remediation tasks with the Vulnerability Response Mobile app
          • Filter records with the Vulnerability Response Mobile app
        • Vulnerability Response Orchestration
          • Scan vulnerability workflow
          • Scan vulnerability item workflow
          • Variables for Create Scan Record for Vulnerabilities activity
      • Application Vulnerability Response
        • Exploring Application Vulnerability Response
        • Configuring Application Vulnerability Response
          • Configure Application Vulnerability Response
            • Verify that the scheduled job for updating CWE records is running
            • Verify that the scheduled job for updating NVD records is running
            • Activate Application Vulnerability Response Integrations
            • Define Application Vulnerability Response email notifications
              • Create or edit remediation target notifications in Application Vulnerability Response
            • Exception Management in Application Vulnerability Response
              • Configure Exception Management for Application Vulnerability Response
              • Configure approval rules for Exception Management
              • Deferring remediation in Application Vulnerability Response
              • Add an exception approver for Application Vulnerability Response
              • Requesting and approving an exception in Application Vulnerability Response
                • Request an exception for an application vulnerable item
                • Request an exception for application vulnerabilities using GRC: Policy and Compliance Management
                • Request an exception for an application remediation task
                • Approve exception rules and exception rule extension requests in Application Vulnerability Response
                • Define policy reason mapping
                • Request an extension for an exception rule in Application Vulnerability Response
                • Request an extension for a deferred remediation task in Application Vulnerability Response
                • Request an extension for a deferred application vulnerable item in Application Vulnerability Response
              • Create, delete, and cancel an exception rule for Application Vulnerability Response
            • Application Vulnerability Response remediation tasks and task rules overview
              • Create, edit, and delete Application Vulnerability Response remediation task rules
              • Create an application remediation task manually in Application Vulnerability Response
              • Create auto-close rules
          • Configure penetration testing
            • Configure sprints for penetration testing
            • Configure assessment types for penetration testing
        • Integrating Application Vulnerability Response with other applications
          • Vulnerability Response Integration with Black Duck
            • Prepare pre-integration tasks for Vulnerability Response Integration with Black Duck
            • Install the ServiceNow Vulnerability Response Integration with Black Duck
            • Configure the Vulnerability Response Integration with Black Duck
              • View the Vulnerability Response Integration with Black Duck import run status
            • Data transformation for the Vulnerability Response Integration with Black Duck
            • Import the project information from the Black Duck integration instance
              • Import Vulnerability Response Integration with Black Duck project versions to the Discovered Applications table
              • Import the application vulnerable items from the Vulnerability Response Integration with Black Duck
              • Set the import times for the Vulnerability Response Integration with Black Duck
              • Include Closed Black Duck application vulnerable items
          • Fortify on Demand Vulnerability Integration
            • Preparing for the Fortify on Demand Vulnerability Integration
            • Install the ServiceNow Vulnerability Response Integration with Fortify on Demand
            • Configure the Fortify on Demand Vulnerability Integration
            • View the Fortify Vulnerability Integration import run status
            • Fortify on Demand Vulnerability modification and activities
              • Perform a manual Fortify application vulnerability import
              • Import data using the Fortify on Demand Vulnerability Integration
              • Include Closed Fortify on Demand application vulnerable items
          • GitHub Application Vulnerability Integration
            • Preparing for the GitHub Application Vulnerability Integration
              • Creating OAuth 2.0 credentials for GitHub Apps - JWT for the GitHub Application Vulnerability Integration
            • Install the ServiceNow GitHub Application Vulnerability Integration
            • Configure the GitHub Application Vulnerability Integration
            • View the GitHub Application Vulnerability Integration import run status and imported repository data
            • View GitHub Application Vulnerability Integration import sets
          • Invicti Vulnerability Integration
            • Prepare for the Invicti Vulnerability Integration
            • Install the ServiceNow Vulnerability Response Integration with Invicti
            • Configure the Invicti Vulnerability Integration
            • Viewing the Invicti Vulnerability Integration import run status and records
            • Invicti Vulnerability Integration state mapping
          • Veracode Vulnerability Integration
            • Preparing for the Veracode Vulnerability Integration
            • Install the ServiceNow Vulnerability Response Integration with Veracode
            • Configure the Veracode Vulnerability Integration
              • View the Veracode Application Vulnerability Integration import run status
              • View Veracode scan summaries
            • Data transformation for the Veracode Vulnerability Integration
            • Veracode Vulnerability Integration modifications and activities
          • Manual ingestion of vulnerabilities for Application Vulnerability Response
            • Upload application vulnerabilities using a template file
            • Verify integration run
            • Verify upload status
        • Remediating Application Vulnerability Response vulnerabilities
          • View vulnerability libraries
            • Application Vulnerability fields
          • Identify applications in Application Vulnerability Response automatically
            • Create a CI lookup rule
              • Reapplying CI Lookup rules in Application Vulnerability Response
              • Prevent duplicate or orphaned records after running Application Vulnerability Response CI lookup rules
          • Assign application vulnerable items in Application Vulnerability Response automatically
            • Create or edit Application Vulnerability Response assignment rules
            • Removing assignments from Application Vulnerability Response vulnerable items and remediation tasks
          • Calculate risk in Application Vulnerability Response automatically
            • Define fields and weights for the risk rule
            • Create an application vulnerability calculator
          • Map the severity of an application vulnerable item automatically
            • Filtering within Application Vulnerability Management
          • Automate remediation target tracking in Application Vulnerability Response
            • Create or edit application remediation target rules
            • View the remediation target status of an application vulnerable item
          • Close a remediation task
          • Change Management for Application Vulnerability Response
            • Create a change request for Application Remediation task
            • Associate a remediation task to an existing change request
          • Penetration testing
            • Create a penetration test assessment request from existing requests (v19.0)
            • Create a penetration test assessment request (prior to v19.0)
              • Replicate a penetration test request in closed state
            • Create penetration test findings based on assessment requests (prior to v19.0)
            • Create an application vulnerability entry
          • Penetration testing workspace
            • Create a new penetration testing assessment request
            • Create penetration test findings based on an assessment questionnaire
            • Publish the assessment questionnaire
            • Use an assessment questionnaire
          • Penetration Testing Dashboard
            • Penetration Dashboard components
          • Understanding compensating controls for risk reduction in Application Vulnerability Response
        • Platform Analytics Solutions for Application Vulnerability Response
          • Application Vulnerability Management (PA) dashboard
          • My Application Vulnerabilities dashboard
          • Aggregated reports framework for Application Vulnerability Response
        • Application Vulnerability Response references
          • Application Vulnerability Response user groups and roles
          • Components installed with Application Vulnerability Response
          • Application Vulnerable Item (AVI) states
          • Application Vulnerability Response remediation task rule examples
          • Scanned application fields
          • Application Vulnerable Item fields
          • Penetration testing states
          • Managing state mapping for deferrals and false positives in Application Vulnerability Response
          • Application Vulnerability Response references
          • Exception rule example for Application Vulnerability Response
        • Application Vulnerability Response product view
      • Container Vulnerability Response
        • Exploring Container Vulnerability Response
          • Container Vulnerability Response remediation task and container vulnerable item states
        • Configuring Container Vulnerability Response
          • Install Vulnerability Response and Configuration Compliance for Containers
          • Define Container Vulnerability Response email notifications
            • Create or edit remediation target notifications
          • Configure Exception Management for Container Vulnerability Response
            • Configure approval rules for Exception Management
          • Quick start tests for Container Vulnerability Response
            • Run the Automated Test Framework (ATF) test suite for Container Vulnerability Response
        • Integrating Container Vulnerability Response with other applications
          • Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
            • Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
            • Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
            • Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application
          • Exploring the Wiz Container Vulnerability Integration
        • Remediating container vulnerabilities
          • Container Vulnerability Response calculator rules
          • Container Vulnerability Response assignment rules
          • Container Vulnerability Response remediation target rules
          • Exception management in Container Vulnerability Response
            • Requesting and approving an exception in Container Vulnerability Response
              • Request an exception for a container vulnerable item
              • Request an exception for a container remediation task
              • Request an exception for container vulnerabilities using GRC: Policy and Compliance Management
              • Define a policy reason mapping
              • Approve an exception request in Container Vulnerability Response
              • Defer a container vulnerable item in Container Vulnerability Response
              • Request an extension for a deferred container vulnerable item
            • Working with an exception rule in Container Vulnerability Response
              • Create an exception rule in Container Vulnerability Response
              • product/container-vulnerability-response/task/approve-ex-rule-request-cvr.html
              • Activating an exception rule in Container Vulnerability Response
              • Reopen an exception rule in Container Vulnerability Response
              • Update an approved exception rule in Container Vulnerability Response
              • Delete an exception rule in Container Vulnerability Response
              • Request an extension for a deferred remediation task in Container Vulnerability Response
              • Request an extension for an exception rule in Container Vulnerability Response
            • Marking and approving a false positive container vulnerability item
              • Mark as a false positive in Container Vulnerability Response
              • Approve a false positive
          • Container Vulnerability Response remediation tasks and task rules overview
            • Create, edit, and delete Container Vulnerability Response remediation task rules
            • Create auto-close rules for Container Vulnerability Response
            • Removing assignments from container vulnerable items and remediation tasks
          • Close a remediation task
          • IT Operations Management and pattern discovery
        • Analytics and Reporting Solutions for Container Vulnerability Response
          • Container Vulnerability Response dashboard
          • Aggregated reports framework for Container Vulnerability Response
        • Container Vulnerability Response reference
          • Components installed with Container Vulnerability Response
          • Container Vulnerability Response glossary
          • Container Vulnerable Item form fields
          • Prisma Cloud Compute Configuration form
          • Request Exception form
          • Exception Rule form
      • Configuration Compliance
        • Exploring Configuration Compliance
          • Configuration Compliance imported data
            • Configuration Compliance discovery
            • Configuration Compliance correlation
            • Discovered Items for Configuration Compliance
              • CI changes for discovered items for Configuration Compliance
              • Reconcile unmatched discovered items for Configuration Compliance
              • Reapply CI lookup rules on selected discovered items for Configuration Compliance
            • The Tenable Vulnerability Integration with Configuration Compliance
          • CI Lookup Rules for identifying configuration items from Configuration Compliance third-party vulnerability integrations
            • Deduplicating existing configuration items for Configuration Compliance
          • Creating CIs for Configuration Compliance using the Identification and Reconciliation Engine
          • Configuration Compliance assignment rules overview
            • Removing assignments from Configuration Compliance remediation tasks
          • Configuration Compliance remediation tasks and remediation task rules overview
          • Configuring calculator groups and calculators for Configuration Compliance
          • Configuration Compliance Exception Management overview
          • Configuration Compliance change management
        • Setting up, installing, and configuring the Configuration Compliance application
          • Install Configuration Compliance
          • Components installed with Configuration Compliance
          • Create or edit Configuration Compliance assignment rules
          • Configuration Compliance remediation target rules
          • Configuration Compliance calculator groups
          • Create a Configuration Compliance calculator group
            • Configuration Compliance calculators and calculator rules
              • Define fields and weights for the risk rule
              • Edit risk rollup calculators for Configuration Compliance
              • Create, edit, and reapply risk calculators for Configuration Compliance
              • Examples for Configuration Compliance risk score calculation
          • Create or edit Configuration Compliance remediation task rules
          • Specify the duration of an exception requested for a remediation task
          • Configure Exception Management for Configuration Compliance
          • Add an exception approver for Configuration Compliance
          • Create a Configuration Compliance criticality map
          • Create email notifications
          • Configure approval rules for Exception Management in Configuration Compliance
            • Create configurations for an approval rule in Configuration Compliance
            • Create approval levels for Exception Management in Configuration Compliance
            • Exception management workflow versus flow designer in Configuration Compliance
        • Configuration Compliance integrations
          • Microsoft Defender for Cloud Integration for Security Operations
            • Install and configure Microsoft Defender for Cloud Integration for Security Operations
            • Configuration Compliance imported data for Microsoft Defender for Cloud Integration
          • Understanding the Vulnerability Response Integration with Palo Alto Prisma Cloud
            • Preparing for installing the Vulnerability Response Integration with Palo Alto Prisma Cloud
            • Install and configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application
            • Configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application
            • Verify the Vulnerability Response Integration with Palo Alto Prisma Cloud import run status
            • Data mapping
            • Prisma Cloud REST Messages
          • Qualys integration with Configuration Compliance
            • Configure the PCRS parameters
              • Components installed with the Qualys Integration for Security Operations
            • Update configuration items with the network partition identifier for the Qualys Integration
            • Set additional filter parameters for Qualys imports
            • Resolving Qualys Vulnerability Integration issues
              • Attachments not appearing after import
              • Modify transform maps
              • Check XML attachment property size
              • Data retrieval limitations
              • Qualys Knowledge Base Integration is failing
            • Qualys integration run status chart
            • Qualys REST messages
          • Understanding the Tenable Vulnerability Integration
            • Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications
            • Tenable.sc integrations with the Vulnerability Response application
            • Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application
            • Preparing for the Tenable Vulnerability Integration
            • Install the Vulnerability Response Integration with Tenable application using Setup Assistant
            • Data retrieval settings for the Tenable Vulnerability Integration
            • REST messages for the Tenable Vulnerability Integration
              • Data transformation for the Tenable Vulnerability Integration
            • Set additional filter parameters for Tenable.io imports
            • Tenable Vulnerability Integration reporting
              • Integration run status chart for the Tenable Vulnerability Integration
            • Initiate rescan for the Tenable.sc integration
            • Initiate rescan for the Tenable.io integration
            • Update configuration items with the network partition identifier for the Tenable Vulnerability Integration
            • Import modifications for the Tenable Vulnerability Integration
            • Split Tenable detections based on the vulnerability instance to split vulnerable items
          • Exploring the Wiz Test Results and Issues Integrations with Configuration Compliance
        • Configuration Compliance remediation
          • Manually create a Configuration Compliance remediation task
          • Manually create a Configuration Compliance remediation task from the Test Results list
          • Create a change request in Configuration Compliance
          • Associate a remediation task to an existing change request
          • Split a remediation task
          • Remove assignments from remediation tasks for you or your groups
          • Approve an unassign request in Configuration Compliance
          • Automatic closing of test results
            • Working with retired configuration items in Configuration Compliance
            • Automatically close test results related to retired CIs
          • Automatically closing stale test results in Configuration Compliance
            • Use Auto-Close Stale Test Results in Configuration Compliance
          • Close a remediation task
          • Requesting and approving an exception for a remediation task
            • Request an exception for a remediation task in Configuration Compliance
            • Request an extension for an exception rule in Configuration Compliance
            • Request an exception for remediation tasks using GRC: Policy and Compliance Management
            • Approve an exception request in Configuration Compliance
            • Define policy reason mappings
        • Analytics and reporting for Configuration Compliance
          • Configuration Compliance reporting
          • Configuration Compliance dashboard
            • Activate Performance Analytics for Configuration Compliance
            • Viewing the Performance Analytics for Configuration Compliance dashboard
          • Aggregated reports framework for Configuration Compliance
        • Configuration Compliance reference information
          • View Configuration Compliance test groups
          • View Configuration Compliance authoritative sources
          • View Configuration Compliance technologies
          • View Configuration Compliance tests
          • View Configuration Compliance test results
          • View a remediation task
          • Test result and remediation task state transitions in the Configuration Compliance application
          • State synchronization between change requests and remediation tasks
          • Domain separation and Configuration Compliance
          • Test Results fields
          • Configuration Compliance criticality maps
          • Configuration Compliance states
          • Resolving Configuration Compliance import issues
            • Modify Qualys PC Results start date
          • CI lookup rules for Microsoft Defender for Cloud Integration for Security Operations and Palo Alto Prisma Cloud
      • Vulnerability Response Workspaces
        • Patch orchestration with the Vulnerability Response Workspaces
        • Vulnerability Response Workspaces and updates to remediation tasks and remediation task rules
        • Configure the Vulnerability Response Workspaces
        • Vulnerability Manager Workspace
          • Exploring the Vulnerability Manager Workspace
            • Home page in the Vulnerability Manager Workspace
            • Watch Topics page in the Vulnerability Manager Workspace
              • Related items list and visualizations in a watch topic
            • Remediation efforts in the Vulnerability Manager Workspace
              • Life cycles of remediation efforts, remediation tasks, and records in the Vulnerability Response Workspaces
            • Dashboards in the Vulnerability Manager Workspace
            • List page in the Vulnerability Manager Workspace
            • Bulk edit in the Vulnerability Manager Workspace
            • Understanding compensating controls for risk change
            • Analytics and reporting solutions for the Unified Vulnerability Response Dashboard
              • Unified Vulnerability Response Dashboard
          • Monitoring and managing vulnerable items and test results in the Vulnerability Manager Workspace
            • Open search results in Vulnerability Manager Workspace
            • Create and apply filters the summary of active records (VITs, AVITs, CVITs and CTRs)
            • Use watch topics in the Vulnerability Manager Workspace
              • Create a watch topic in the Vulnerability Manager Workspace
              • Edit or delete a watch topic in the Vulnerability Manager Workspace
              • Deactivate or activate a watch topic
            • Use Remediation Effort records
              • Create a remediation effort in the Vulnerability Manager Workspace
              • Create a remediation task on-demand in the Vulnerability Manager Workspace
              • Create a recurring remediation effort in the Vulnerability Manager Workspace
              • Transfer records to remediation efforts in the Vulnerability Manager Workspace
            • Add a compensating control to the library
              • Associate compensating controls with CVEs or TPEs for risk change requests
              • Disable or enable risk change for a CVE or TPE
            • Rescan records and remediation tasks in the Vulnerability Manager Workspace
            • Re-evaluate the remediation properties of the records in the Vulnerability Manager Workspace
            • Use the List view in the Vulnerability Manager Workspace
              • Create a customized list of records
              • Create a remediation task manually from the Vulnerability Manager Workspace
              • Enable or disable the import of test results for a Qualys test group
              • Modify the severity for a CVE or TPE
            • Approve or reject requests in the Vulnerability Manager Workspace
            • Set up email notifications in the Vulnerability Response Workspaces
          • Remediating vulnerable items and test results in the Vulnerability Manager Workspace
            • Using bulk edit in the Vulnerability Manager Workspace
              • Update the state of records in bulk in the Vulnerability Manager Workspace
              • Bulk edit host vulnerable items with patches and solutions
              • Assign records to an assignment group in bulk
              • Remove assignments for host vulnerable items in bulk
              • Request bulk exception in the Vulnerability Manager Workspace
              • Bulk edit for false positive in the Vulnerability Manager Workspace
              • Close records in bulk in the Vulnerability Manager Workspace
            • Request exceptions for remediation tasks and records from the Vulnerability Manager Workspace
            • Request an extension for a deferred vulnerable item in the Vulnerability Manager workspace
          • Vulnerability Manager Workspace reference information
            • Create Watch Topic form fields
            • GRC request exception form fields
            • Generate remediation digest form fields
            • Impact of the compensating controls on risk score and expiration date
            • Examples for remediation task creation in the Vulnerability Manager Workspace and IT Remediation Workspace
            • Re-evaluating the exceptions for selected records in the Vulnerability Manager Workspace
        • IT Remediation Workspace
          • Exploring the IT Remediation Workspace
            • View a workflow example in the IT Remediation Workspace
            • Home page in the IT Remediation Workspace
            • Dashboards in the IT Remediation Workspace
            • List page in the IT Remediation Workspace
          • Using the IT Remediation Workspace
            • Use the email digest in the Vulnerability Response Workspaces
            • Open search results in IT Remediation Workspace
            • Create a list in the IT Remediation Workspace
            • Use records in the IT Remediation Workspace
            • Use remediation task records in the IT Remediation Workspace
            • Assign a remediation task or record to yourself in the IT Remediation Workspace
            • View configuration items with vulnerabilities in the IT Remediation Workspace
            • Create a change request in the IT Remediation Workspace
            • Create a remediation task manually in the IT Remediation Workspace
            • Split a remediation task in the IT Remediation Workspace
            • Request a false positive in the IT Remediation Workspace
              • Request false positive for a set of test results
            • Request an exception in the IT Remediation Workspace
            • Request an exception using GRC: Policy and Compliance Management in the IT Remediation Workspace
            • Request risk change in the IT Remediation Workspace
            • Rescan vulnerable items and remediation tasks in the IT Remediation Workspace
              • Rescan Qualys vulnerable items from the Vulnerability Response workspaces
              • Rescan Rapid7 vulnerable items from the Vulnerability Response workspaces
              • Rescan Tenable.io and Tenable.sc vulnerable items from the Vulnerability Response workspaces
          • IT Remediation Workspace reference information
            • Create change request form fields
            • Request exception form fields for policy exceptions
            • Request exception form fields for risk reduction
        • Explore the Vulnerability Assessment workspace
          • Exploring exposure assessment
            • Exposure assessment by CVE
              • Add CVEs to assess exposure
              • Create VIs for CVEs for exposure assessment
              • Activate or deactivate CVEs for exposure assessment
              • Export impacted CIs for exposure assessment
              • Confidence score calculation example
                • View vulnerable software details
                • Confidence score reference tables for exposure assessment
            • Exposure assessment by software
              • Add software for exposure assessment
              • Create VIs for software for exposure assessment
              • Activate or deactivate software for exposure assessment
              • Export impacted CIs for software in the Vulnerability Assessment workspace
            • Exposure assessment by publisher software
              • Add software by a publisher for exposure assessment
              • Create VIs for software by a publisher for exposure assessment
              • Activate or deactivate software by a publisher for exposure assessment
              • Export impacted CIs for software by a publisher in the Vulnerability Assessment workspace
          • Exploring vulnerability assessment
            • Create a vulnerability assessment record
              • Update the vulnerability assessment auto-flush record
            • Modify the vulnerability assessment record
            • Perform an assessment
              • Assessment tab
              • Overview tab
              • Assign a priority and exposure level to the vulnerability assessment record
            • Add affected CIs to the assessment record
            • Create vulnerable items for the affected CI or affected software component
            • Link the vulnerability assessment record to major security incident in Major Security Incident Management
      • Software Bill of Materials
        • Exploring Software Bill of Materials
          • Exploring supported applications for Software Bill of Materials
        • Configuring Software Bill of Materials
          • Install the supported applications for Software Bill of Materials
            • Configuring the Deps.dev, OSV.dev, and PaCE integrations for Software Bill of Materials
        • Uploading and viewing your SBOM files in the SBOM Workspace
          • Uploading Software Bill of Materials files using a REST API
          • Upload Software Bill of Materials files manually
          • Uploading Software Bill of Materials for DevOps SBOM files
          • Classifying licenses and resolving component licenses in the Software Bill of Materials workspace
            • Classify imported licenses in the Software Bill of Materials Workspace
            • Resolve licenses to components in the Software Bill of Materials Workspace
          • Viewing reports and dashboards in the Software Bill of Materials workspace
            • Review the Home page in the Software Bill of Materials Workspace
            • Reviewing the Components module in the Software Bill of Materials Workspace
            • Creating rules for application vulnerable items in the Software Bill of Materials Workspace
            • View upload status for Software Bill of Materials files
            • Checking a Software Bill of Materials entity for vulnerabilities
        • Components installed with Software Bill of Materials applications
          • Create an application vulnerable item rule in the Software Bill of Materials Workspace
    • Enterprise security case management applications
      • Security Incident Response
        • Understanding Security Incident Response
          • Domain separation and Security Incident Response
        • Security Incident Response setup
          • Install and configure Security Incident Response
            • Download and install the Security Analyst Workspace
            • Components installed with Security Incident Response
            • Other additional Security Incident Response setup tasks
            • Setup Assistant reference
            • Configure the Security Analyst Workspace
              • Set up primary and secondary filters for Security Analyst Workspace
              • Security Analyst Workspace properties
              • Additional Security Analyst Workspace configuration
                • Landing page filter configuration
                • Enable UI Actions
                • Form UI actions
                • Related List configuration
                  • Related List UI Actions
                • Form configuration system properties
                • Enable playbooks for analyst selection
            • Troubleshooting Security Incident Response
          • Security Incident Response Platform Analytics Solutions
            • CISO dashboard
            • Security Incident Management Premium dashboard
            • Security Incident Management dashboard
            • Security Incident Explorer dashboard
            • Security Operations Efficiency dashboard
        • Security Incident Response Workspace
          • Exploring SIR Workspace
            • SIR Workspace plugins and roles
            • SIR Workspace features
            • SIR Workspace interface overview
            • Upcoming section
              • View upcoming tasks
            • Quick links section
              • Working with quick links
            • Shift Handover Records section
            • List view in SIR Workspace
              • Personalize a list
              • Assign Security Incidents
              • Close multiple security incidents
              • Assign Response Tasks
              • Report Phish Email
              • Working with quick filters
                • Add or modify quick filters
              • Export Security Incidents or Response Tasks
              • Manage Shift Handover records
          • Configuring SIR Workspace
            • Set up view of SIR Records
            • Configure SI design time investigation
              • Creating View for associated info tables
              • Adding an entry point list
              • Mapping View of the Associate Info to the entry point list
              • Configure each associated list from the view to handle run time data rendering
            • SIR Workspace Related Records
            • Define the new Risk Score Calculator Rules
              • Risk Score Calculator for Additional Related Tables
            • Configure Shift Handover
              • Configure Shift Handover Templates
              • Create shifts through Security Incident Response Workspace
            • Security Incident Response conference call integration
              • Manage Conference Call users and groups
              • Integrate SIR with third-party communication channels
            • Configure report templates in Security Incident Response
              • Create a Report Template in Security Incident Response
              • System properties for reports
              • Duplicate a report template in Security Incident Response
              • Edit a report template in Security Incident Response
            • On-Call scheduling in Security Incident Response
            • Category management in Security Incident Response
              • Create a category
              • Create a subcategory
          • Using SIR Workspace
            • Working with Security Incident Records
              • Security Incident Overview section
              • Security Incident Details section
                • Security incident Details tab
              • SIR Workspace Orchestration
                • SIR Workspace Investigation Canvas
                  • Explore Investigation Canvas
                • Unified experience framework for integrations powered by Capability Framework
                  • Unified experience capabilities and modal screens
                  • Unified Experience example
                    • Example 1: Select implementations: Threat Lookup
                      • Select implementations
                    • Example 2: Common Inputs: Sighting Search
                    • Example 3: Add specific runtime details inputs to an implementation: Run Additional Actions
              • Security Incident Response Tasks
                • Create a Response Task
              • Security Incident Response Other Records
              • Security Incident Response Post Incident Review
              • Edit Related Records in list view
              • TISC integration within SIR Workspace
                • Send data from SIR Workspace to TISC
                  • System properties to send data
                  • Add security incident to TISC case
                  • Add observables to TISC Case
                  • Send Observables to TISC
                  • Send Threat Lookup to TISC
                  • Send Sighting Search to TISC
                  • Send Observable Enrichment to TISC
                  • View TISC Context in SIR Workspace
                • Working with TISC Context
                  • Add observables to TISC Case
                  • View related info from TISC
                  • View Enrichment Results
              • Reports in Security Incident Response
                • Create a report
                • Edit a report
                • Delete a report
              • Collaborate using conference call or chat in Security Incident Response
                • Start a conference call in Security Incident Response
                • Add participants to active Conference Call
                • Start a Sidebar chat in Security Incident Response
              • Viewing incident details with a relationship graph
                • Customize a relationship graph
                • Create a relationship graph for an incident
            • Security Incident Playbook
            • Prerequisites for the Playbooks
            • Rebuilding existing playbooks in Workflow Studio
            • Activity Definitions
              • Example Activity Definition: Send email
                • Create an Activity Action
              • Submit to CSF X Sandbox
            • Sample Playbooks for SIR Workspace
            • Working with MSI Records
              • Propose as Major Security Incident
              • Promote to Major Security Incident
              • Link to Major Security Incident
            • Working with Form UI actions
            • Security Incident Closure workflow
            • Handle security incidents using AWA
          • Viewing SIR Workspace Dashboards
            • View Security Analyst Overview dashboard
            • View Security Incident Explorer dashboard
            • View Security Incident Management dashboard
            • View Security Operations Efficiency dashboard
            • View Security Incident Response Premium KPIs dashboard
            • View Context Sensitive Analytics - SI dashboard
            • View CISO dashboard
            • View CISO Reporting Overview dashboard
            • View Security Incident Manager Overview dashboard
            • View Security Incident Response Health dashboard
        • Security incident creation
          • Security incident manual creation
            • Create a security incident from the Security Incident list
            • Create a security incident from the Security Incident Catalog
            • Create a security incident from an Event Management alert
          • Security incident automatic creation
            • Security incidents created from events and alerts
              • Data imported into security alerts
            • Create security incidents from User Reported Phishing emails
          • Record creation from security incidents
            • Create a change, incident, or problem from a security incident
            • Create a Customer Service case from a security incident
            • Add a security incident to a security case
            • Create response tasks
        • Manage Predictive Intelligence for User Reported Phishing
          • Predictive Intelligence for User Reported Phishing
          • Required components and plugins
          • Final verdict generation for User Reported Phishing
          • Troubleshooting Predictive Intelligence for User Reported Phishing
        • Configure Predictive Intelligence for User Reported Phishing
        • Assigning security analysts
        • Process Mining Workspace for Security Incident Response
          • Create process mining project for security incidents
          • Process Mining use cases for security incidents
        • Managing security incidents and inbound requests
          • Create an inbound request
          • Manage observables
            • Show IoC information for a security incident
            • Create a security incident observable
            • Manage file observables
            • Edit a security incident observable list
            • Add multiple security incident observables
            • Automatic security incident observable log data enrichment
            • Publish observables to a third-party watchlist
          • Manage lookups and scans
            • Submit an IoC Lookup request from a security incident
            • Submit an IoC Lookup request from the Security Incident Catalog
            • Submit a vulnerability scan request from a security incident
            • Submit a vulnerability scan request from the Security Incident Response catalog
          • Manage on-demand orchestration
            • Perform on-demand orchestration from the Security Incident form
            • Perform on-demand orchestration from the Security Incident list
            • Define new on-demand orchestrations
              • Register new Security Operations applications for on-demand orchestration
          • Add information to a security incident
            • Add related problems, changes, and incidents to a security incident
          • Invoke a process dump for an enriched process in Windows
          • View information in a security incident
            • Parent and child security incident relationships
            • View affected items for a security incident
            • View related items for a security incident
            • View enrichment data for a security incident
            • View response task information for a security incident
            • View related events and alerts in security incidents
            • View security incident to customer service case mapping
            • View a Security Incident Response runbook
            • Identify all configuration items affected by a security incident
          • Calculate the severity of a security incident
          • Search for and delete phishing emails
          • Create a security incident knowledge article
          • Escalate a security incident
          • Manage post incident activities
            • Assign post incident review roles
            • Post incident review report
              • Manage Post Incident Review Report
            • Configure an assessment trigger condition
              • Assessment trigger conditions examples
            • Perform a questionnaire-based post incident review
              • Create post incident review questionnaire categories
              • Compose post incident review questions
            • Create PIR assignment rules
          • Close security incidents
            • Add closure information to a security incident
          • Restrict access to security incidents
        • Manage security threats using the Security Analyst Workspace
          • Resolve security threats with the playbook
          • Sightings searches on user-reported phishing and malware attacks
        • Playbook Resources
          • Activate a Security Incident Response flow
          • Security Incident Response playbooks
            • Process-based Playbooks
              • Playbook for Manual Phishing
                • Create playbooks for Manual Phishing in Workflow Studio
                  • Add parallel activities
                • Using the Manual Phishing playbook
                • Workspace Playbook summary
              • Playbook for Automated Phishing
                • Create processes for Automated Phishing in PAD
                • Using the Automated Phishing playbook
              • Playbook for Manual Malware
                • Create processes for Manual Malware in PAD
                • Using the Manual Malware playbook
              • Playbook for Automated Malware
                • Create processes Automated Malware in PAD
                • Using the Automated Malware playbook
              • Playbook for Failed Login Manual
                • Create processes for Failed Login Manual in PAD
                • Using the Failed Login Manual playbook
            • Flow-based Playbooks
              • Playbook for Automated Phishing
                • Run the automated phishing response playbook flow
                  • View automated phishing response playbook flow action designer
                  • View the automated phishing response playbook subflow designer
              • Playbook for Automated Malware
                • Run the automated malware playbook flow
              • Playbook for Failed Login Manual
              • Playbook for Child Security Incident Automation
              • Playbook for Office 365 - Malicious File Detected
                • Set up the Office Malicous File Detected playbook
                • Use the Office 365 Malicious File Detected playbook
              • Playbook for Repeat Detection
                • Set up the Repeat Detection playbook
                • Use the Repeat Detection playbook
              • Playbook for Spoofed Emails (using the same Display name)
                • Set up the Spoofed Emails playbook
                • Use the Spoofed Emails (using the same Display name) playbook
              • Playbook for Endpoint Detection
                • Set up the Endpoint Detection playbook
                • Use the Endpoint Detection playbook
              • Playbook for Possible Password Spray
                • Set up the Possible Password Spray playbook
                • Use the Possible Password Spray playbook
              • Playbook for T1003 - Detect Credential Dumping Tools
                • Set up the T1003 - Detect Credential Dumping Tools playbook
                • Use the T1003 - Detect Credential Dumping Tools playbook
              • Playbook for Email Domain Spoofing Detection
                • Set up the Email Spoof Detection playbook
                • Use the Email Domain Spoofing Detection playbook
              • Playbook for Typo Squatted Domain
                • Set up the Typo Squatted Domain playbook
                • Use the Typo Squatted Domain playbook
              • Playbook for Credential Sniffing
                • Set up the Credential Sniffing playbook
                • Use the Credential Sniffing playbook
              • Playbook for T1070 - Windows Events Logs Cleared
                • Set up the T1070 - Windows Events Logs Cleared playbook
                • Use the T1070 - Windows Events Logs Cleared playbook
              • Playbook for OSquery of External Address in /etc/hosts file
                • Set up the OSquery of External Address in the /etc/hosts file playbook
                • Use the OSquery of External Address in the /etc/hosts file playbook
              • Playbook for User Deleting Bash History - Cloud
                • Set up the User Deleting Bash History playbook
                • Use the User Deleting Bash History playbook
              • Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud
                • Set up the Successful VPN Attempts from the Service Accounts playbook
                • Use the Successful VPN Attempts from the Service Accounts playbook
              • Playbook for Attempted Access to Deactivated Accounts
                • Set up the Attempted Access Deactivated Account playbook
                • Use the Attempted Access to Deactivated Accounts playbook
              • Playbook for T1003 - Defense Evasion - Mimikatz DCShadow
                • Set up the T1003 - Defense Evasion - Mimikatz DCShadow playbook
                • Use the T1003 - Defense Evasion - Mimikatz DCShadow playbook
              • Playbook for T1003 - Credential Dumping - Mimikatz DCSync
                • Set up the T1003 - Credential Dumping - Mimikatz DCsync playbook
                • Use the T1003 - Credential Dumping - Mimikatz DCsync playbook
              • Playbook for Okta User Login Failures from Multiple IPs
                • Set up the Okta User Login Failures from Multiple IPs playbook
                • Use the Okta User Login Failures from Multiple IPs playbook
              • Playbook for ModSec Brute force by IP Burst
                • Set up the ModSec Brute force by IP Burst playbook
                • Use the ModSec Brute force by IP Burst playbook
          • Security Incident Response playbook actions
        • Visual representation of Security Incident Response reporting
          • Security Incident Response Overview dashboard
            • Access Security Incident Response Explorer
            • Security incident map
              • Add map to Security Incident Response overview
              • Modify security incident map
            • Security incident treemaps
              • Add treemaps to the Security Incident Response overview
              • Create or update a treemap category
              • Create or update a treemap indicator
            • Add vulnerability significance charts to an overview
        • Major Security Incident Management
          • Exploring Major Security Incident Management
            • Major Security Incident Management
            • Get started with MSIM
            • Checklist for MSIM setup
            • Major Security Incident Management roles
          • Integrating Major Security Incident Management
            • Integrate Major Security Incident Management with Microsoft SharePoint
              • Register a new application at Azure portal for SharePoint connections
              • Use certificates for authentication
              • Configure Microsoft SharePoint with Major Security Incident Management
            • Integrate Major Security Incident Management with Microsoft Teams
              • Register a new application at Azure portal for Microsoft Teams connections
              • Configure Microsoft Teams connection with Major Security Incident Management
            • Establish MS Teams Graph connection on ServiceNow AI Platform
              • Using Certificates for authentication
                • Attach a Java Key Store certificate for MS Teams
                • Configure the JWT signing key for MS Teams
                • Configure the JWT provider for MS Teams
                • Establish a connection using certificates
              • Using Client Secret value
                • Establish a connection using client secret
                • Activate MS Teams chat connector for MS Teams Graph Spoke user
            • Major Security Incident Management Conference Call Integration
              • Start a conference call
              • Add participants to a conference call
              • Mute participants in a conference call
              • View conference call details
              • Integrate MSIM Conference Calls with Microsoft Teams
                • Use the MSIM Conference Call Microsoft Teams integration
              • Integrate MSIM Conference Calls with Zoom
                • Use the MSIM Conference Call Zoom integration
              • Integrate MSIM Conference Calls with Cisco Webex
                • Use the Conference Calls Cisco Webex integration
          • Configuring Major Security Incident Management
            • Configure File Explorer Component
              • Get Started with File Explorer
              • Configure File Explorer Repository Drive
              • Configure Folder and File Action Settings
              • Create Folder Templates
              • File Explorer Activity Stream in Workspace
              • File Explorer troubleshooting
            • Configure Microsoft Teams
              • Get started with Microsoft Teams
              • Activate MS Teams as a chat provider
              • Create a chat channel template
              • View Chat Message Activity
              • MS Teams Chat Connector Troubleshooting for MSIM
            • Configure Slack chat connector for major security incidents
              • Get started with Slack chat connector configuration
              • Create a chat channel template for Slack
              • Activate Slack as a channel provider
              • View chat message activities in Slack
          • Major Security Incident Management administration
          • Major Security Incident Management workspace
          • Using Major Security Incident Management
            • Propose, promote, and link incident records
              • Propose as a Major Security Incident
              • Promote to a Major Security Incident
              • Link to Major Security Incident
            • Using MSI List view in the MSIM workspace
            • View Major Security Incident impact metrics
            • View Major Security Incident trend charts
            • Update Major Security Incident details
              • Restrict access to certain major security incidents
            • Link additional records to Major Security Incident
            • Unlink records from Major Security Incident
            • Manage tasks in a Major Security Incident
              • Manage tasks using the Visual Task Board
              • Manage tasks using the List view
            • Track collaboration activity via MSIM workspace
            • Create and distribute MSIM Status Reports
          • Managing MSIM status reports
            • Configure Major Security Incident status reports
              • Create a Report Template
                • Add Branding to your Report Templates
                • Use Visualizations in Report Templates
                • Use Reports Lists in Report Templates
                • Use Template Scripts in your Report Templates
                • Preview the Report Template
              • Create a Report Section Template
              • Create a Report Subsection Template
              • Create Report Subsection Element template
                • Create a Free Form Type Element
                • Create a Visualization Type Element
                • Create a List Type Element
                • Create a Custom Type Element
              • Add system properties
          • Major Security Incident Management Playbooks
            • Create processes for MSIM playbook
            • Using the MSIM playbook
            • Playbook for zero-day vulnerability
              • Using the Zero-day Vulnerability Playbook
            • Playbook for Legal Request
          • Rollup Framework for MSIM
            • Configure Linked Records in Major Security Incident Management
            • Configure Rollup Records in Major Security Incident Management
            • Configure List Layout in Major Security Incident Management
            • Rollup example use case implementation for a Security Case
              • Step 1. Create linked record configuration for a Security Case
              • Step 2. Create a view for modal window for a Security Case
              • Step 3. Create UI actions for the Source Table for a Security Case
              • Step 4. Create a view for a new Linked Record Tab for a Security Case
              • Step 5. Add Access Control Lists (ACLs) for Major Security Incident Management workspace users
              • Step 6. Create business rules for a Security Case
              • Step 7. Create rollup record configurations
            • Perform on demand atomic rollup
        • Security Incident Response integrations
          • ArcSight ESM Event Ingestion for Security Operations integration
            • Set up your ServiceNow AI Platform instance for the ArcSight ESM event ingestion integration
              • Set up the ArcSight ESM Query Viewer
              • Install and configure the ServiceNow application for the ArcSight ESM Event Ingestion integration
              • Create a profile for ArcSight ESM correlation event ingestion integration
                • Create and name the profile for ArcSight ESM event ingestion integration
                • Select correlation events for ArcSight ESM event ingestion integration
                • Mapping correlation event fields for the ArcSight ESM event ingestion integration
                  • Create mappings for ArcSight ESM event ingestion integration
                • Preview the security incident for the ArcSight ESM event ingestion Integration
                • Create a schedule for ArcSight ESM event ingestion ingestion
                • Additional options: Automate correlated event updates and closure based on SIR incident status
            • ArcSight ESM Integration Settings for event ingestion integration
            • Troubleshooting ArcSight ESM event ingestion integration
            • Copy ArcSight ESM profile for event ingestion integration
            • Use the script editor to format correlation event values for ArcSight ESM integration
            • Flow Designer usage with ArcSight ESM event ingestion integration
          • Amazon Web Services (AWS) Security Hub integration
            • Get started with AWS Security Hub integration
            • Register and configure the AWS Security Hub portal
            • Install and configure the AWS Security Hub integration
            • Create a profile for AWS Security Hub finding integration
            • Map the AWS Security Hub finding fields
            • Define filter and aggregation criteria for AWS Security Hub findings ingestion
            • Schedule the AWS Security Hub finding retrieval
            • Automate the AWS Security Hub finding updates and closures by the SIR incident status
            • SIR form after an AWS Security Hub finding ingestion
          • Carbon Black - Incident Enrichment integration
            • Get started with the Carbon Black - Incident Enrichment integration
          • Carbon Black integration
            • Get started with the Carbon Black integration
          • Check Point Anti-bot - Email Parser integration
          • Check Point Next Generation Threat Prevention integration
            • Check Point NGTP setup
              • Create an API account for the Check Point NGTP integration
              • Set up the Check Point NGTP integration
              • Activate the Check Point NGTP integration
            • Working with block lists
              • Create a block list for the Check Point NGTP integration
              • Activate a block list for the Check Point NGTP integration
              • Configure a block list as a Custom Intelligence Feed on the Check Point NGTP integration
              • Submit block list entries from a security incident for the Check Point NGTP integration
              • Submit block list entries directly from the Block List Entry Table
              • Approve block list entries for the Check Point NGTP integration
              • Block list entry exceptions for the Check Point NGTP integration
              • Edit the security tag name for the Check Point NGTP integration
              • Uninstall the Check Point NGTP integration
          • CrowdStrike Falcon Host integration
            • Get started with the CrowdStrike Falcon Host integration
            • Security Operations CrowdStrike Falcon Host - Publish to Watchlist Flow
          • CrowdStrike Falcon Insight for Security Operations integration
            • Getting started with the CrowdStrike Falcon Insight integration
            • Create CrowdStrike API client and generate keys
            • Install and configure CrowdStrike Falcon Insight
            • Create an approval group
            • Create a capability profile for the CrowdStrike Falcon Insight integration
            • Configure profiles and security incidents for the CrowdStrike Falcon Insight integration
            • How trigger conditions work with a configuration item for a profile
            • Verify CrowdStrike Falcon Insight profile trigger conditions
            • Trigger a CrowdStrike Falcon Insight profile manually from a security incident
            • Create and configure a profile for the sighting search
            • Configure and trigger additional actions in CrowdStrike Falcon Insight
            • Using CrowdStrike Falcon Insight integration in Analyst Workspace
          • CrowdStrike Next-Gen SIEM integration for Security Operations
            • Get started with CrowdStrike Next-Gen SIEM integration
            • Install and configure CrowdStrike Next-Gen SIEM integration
            • Create a detection profile for CrowdStrike Next-Gen SIEM
            • Set correlation rules for CrowdStrike Next-Gen SIEM integration
            • Map the CrowdStrike Next-Gen detection fields
            • Defining filter and aggregation criteria
            • Set the filtering conditions for security incidents
            • Define aggregation conditions
            • Schedule the CrowdStrike Next-Gen SIEM detection retrieval
            • Automate detection updates and closures
          • CrowdStrike Falcon X Sandbox for Security Operations integration
            • Get started with the CrowdStrike Falcon X Sandbox integration
            • Set up Sandbox submission configurations
            • Manually submit files or URLs to Sandbox
            • Automate CrowdStrike Falcon Sandbox submissions using Flow Designer
            • Monitor the submission results in the sandbox
            • Tag security incidents with the Sandbox submission status
            • Review the sandbox global settings
          • Elasticsearch Incident Enrichment integration
            • Get started with the Elasticsearch - Incident Enrichment integration
          • FireEye Endpoint Security integration
            • Set up your NowPlatform instance for FireEye integration
            • Configuring Timestamp Settings for Triage Acquisition
            • Install the application and configure a source for the integration
              • FireEye Default Settings
            • Create a new capability profile for the FireEye Endpoint integration
            • Understand how trigger conditions work with a configuration item
            • Configure profiles and security incidents for the FireEye HX integration
              • Verify the Trigger Condition Filters
            • Trigger a FireEye capability profile from Related Links
            • Trigger a FireEye Capability profile from Configuration Item related list
            • FireEye Get File Capability
            • FireEye Additional Actions on Endpoint
            • Create and configure a profile for sightings search with the FireEye Integration
            • Invoke Sighting Search from a Security Incident
          • Have I been pwned? integration
            • Security Operations Have I been pwned? integration setup
              • Threat Lookup - Have I been pwned? flow
              • Activate the Security Operations Have I been pwned? integration
              • Update your X.509 certificate
          • HPE Security ArcSight ESM - Email Parser integration
          • HPE ArcSight Logger - Incident Enrichment integration
            • Get started with the HPE ArcSight Logger - Incident Enrichment integration
          • Hybrid Analysis integration
            • Install and configure Hybrid Analysis
            • Verify expected results for Hybrid Analysis
            • (Optional) Manually attach an observable for Hybrid Analysis
          • IBM QRadar Offense Ingestion Integration
            • Install and configure the ServiceNow application for the IBM QRadar offense ingestion integration
            • Set up your ServiceNow AI Platform instance for the IBM QRadar offense ingestion integration
              • Create a profile for IBM QRadar offense ingestion integration
                • Create profiles for ingesting IBM QRadar offenses
                • Select IBM QRadar rules
                • Mapping of offense fields for the IBM QRadar integration
                  • Ingesting the sample IBM QRadar offenses
                  • Mapping IBM QRadar offense fields to security incident response fields
                • Preview the security incident for the IBM QRadar integration
                • Define schedule for the IBM QRadar integration
                • Automate offense updates and closure based on SIR incident status
            • IBM QRadar integration configuration settings
            • Optional: Copy a IBM QRadar profile
            • Domain separation and IBM QRadar Offense Ingestion
            • Security Incident Response form after offense ingestion
            • Flow Designer and Integration Hub usage with IBM QRadar offense ingestion integration
            • Troubleshooting IBM QRadar offense ingestion integration
          • IBM QRadar - Incident Enrichment Integration
            • Get started with the IBM QRadar - Incident Enrichment integration
          • LogRhythm Overview
            • Set up the REST API for LogRhythm
            • Install the plugin and configure LogRhythm
            • Creating an alarm profile for LogRhythm
              • Mapping LogRhythm alarms to the security incident
                • Map LogRhythm alarm fields to security incident fields
              • Filter alarms for LogRhythm
              • Previewing the security incident with mapped LogRhythm alarm values
              • Schedule and retrieve LogRhythm alarms
              • Additional options for LogRhythm alarms
            • Additional configurations for the LogRhythm integration
              • Use the script editor to format LogRhythm values
              • Copy an alarm profile for LogRhythm
              • Disable automated alarm closure for LogRhythm
              • View LogRhythm drilldown events
            • Troubleshooting the LogRhythm integration
              • Verify connectivity for LogRhythm
              • Script execution and system log for LogRhythm
          • McAfee ePO integration
            • Integration architecture for McAfee ePO
            • Checklist for the McAfee ePO integration
            • Set up your ServiceNow AI Platform instance for the McAfee ePO integration
            • Set up your McAfee ePO console to integrate with Security Incident Response (SIR)
            • Install the application and configure a server for the McAfee ePO integration
            • Edit security tags in the ServiceNow AI Platform for the McAfee ePO integration
            • Create an approval group
            • McAfee ePO integration capability profiles
              • Create a capability profile for the McAfee ePO integration
              • Defining triggering conditions with a Configuration item (CI) field for a McAfee ePO profile
              • Configuring profiles for the McAfee ePO integration
                • Configure profiles and security incidents for system enrichment queries for the McAfee ePO integration
            • Trigger McAfee ePO profile manually from a security incident
            • Trigger additional actions in McAfee ePO integration
            • Using McAfee ePO integration in Analyst Workspace
          • McAfee ESM - Email Parser integration
            • Configure McAfee ESM - Email Parser integration
          • McAfee ESM - Incident Enrichment Integration
            • Get started with the McAfee ESM - Incident Enrichment integration
          • Microsoft Azure Sentinel integration
            • Get started with Microsoft Azure Sentinel integration
            • Register and configure the Microsoft Azure portal
            • Install and configure the Microsoft Azure Sentinel integration
            • Create a profile for Microsoft Azure Sentinel
            • Map the Microsoft Azure Sentinel incident fields
            • Defining filter and aggregation criteria
            • Schedule the Microsoft Azure Sentinel incident retrieval
            • Automate the incident updates and closures by the SIR incident status
            • Copy a Microsoft Azure Sentinel profile
            • SIR form after an incident ingestion
            • Review the Microsoft Azure Sentinel integration settings
            • Domain separation
            • Comparing Microsoft Azure Sentinel and Microsoft Graph Security API integrations with SIR
          • Microsoft Defender for Endpoint integration
            • Register and configure the Microsoft Defender for Endpoint in the Microsoft Azure portal
            • Get started with the Microsoft Defender for Endpoint integration
            • Install the application and configure a source for the integration
              • Microsoft Defender for Endpoint Default Settings
            • Map the Microsoft Defender for Endpoint indicator types
            • Create a capability profile for the Microsoft Defender for Endpoint integration
            • Trigger conditions in a configuration item
            • Configure profiles and security incidents for the Microsoft Defender for Endpoint integration
              • Verify the Trigger Condition Filters
            • Trigger the Microsoft Defender for Endpoint capabilities from Related Links
            • Trigger the Microsoft Defender for Endpoint from Configuration Item related list
            • Additional Configurations in Microsoft Defender for Endpoint
              • Configure Isolate Host capability in Microsoft Defender for Endpoint
              • Configure Remove Host Isolation capability in Microsoft Defender for Endpoint
              • Configure Run Antivirus Scan capability in Microsoft Defender for Endpoint
              • Configure Restrict App Execution capability in Microsoft Defender for Endpoint
              • Configure Remove App Restriction capability in Microsoft Defender for Endpoint
              • Configure Get Related Machines from Defender Capability in Microsoft Defender for Endpoint
              • Configure Stop and Quarantine File capability in Microsoft Defender for Endpoint
            • Create and configure a profile for sightings search with the Microsoft Defender for Endpoint integration
              • Perform a manual sighting search in Microsoft Defender for Endpoint
              • Perform an automatic observable enrichment in Microsoft Defender for Endpoint
              • Perform a manual observable enrichment in Microsoft Defender for Endpoint
            • Create indicators in Microsoft Defender for Endpoint
              • Update indicators in Microsoft Defender for Endpoint
            • Domain separation in Microsoft Defender for Endpoint integration
            • Rate limit configuration in Microsoft Defender for Endpoint integration
          • Microsoft Exchange Online integration
            • Set up your Microsoft Azure account
            • Install Microsoft Exchange Online application
            • Configure the Microsoft Exchange Online integration
            • Define email search criteria and request a search on the Microsoft Exchange Online service
            • Request delete approval for emails on Microsoft Exchange online service
            • Approve delete email requests for the Microsoft Exchange Online integration
            • Recover deleted emails on the Microsoft Exchange Online service
            • Edit security tags for the Microsoft Exchange Online integration
          • Microsoft Exchange On-Premises integration
            • Get started with the Microsoft Exchange On-Premises integration
            • Microsoft Exchange - Perform Email Search and Deletion flow
          • Microsoft Graph Security API alert ingestion integration
            • Set up your ServiceNow AI Platform instance for the Microsoft Graph Security API integration
              • Configure the Microsoft Azure portal
              • Install and configure the Servicenow application for Microsoft Graph Security API alert ingestion integration
            • Create a profile for the Microsoft Graph Security API alert ingestion integration
              • Identify the source for the profile
              • Mapping of alert fields for Microsoft Graph Security API alert ingestion integration
                • Ingest sample Microsoft Graph Security API alerts
                • Mapping alerts to security incident response fields
              • Preview the security incident for the Microsoft Graph Security API integration
              • Define schedule for Microsoft Graph Security API integration
              • Automate alert updates and closure based on SIR incident status
            • Microsoft Graph Security API integration configuration settings
            • Security Incident Response form after alert ingestion
            • Optional: Copy a Microsoft Graph Security API profile
            • Domain separation and Microsoft Graph Security API alert ingestion
            • Flow Designer and Integration Hub usage in Microsoft Graph Security API integration
            • Troubleshooting Microsoft Graph Security API integration
          • Palo Alto Networks - AutoFocus integration
            • Activate and configure Palo Alto Networks - AutoFocus integration
            • Get AutoFocus Session Info Enrichment Flow
          • Palo Alto Networks - Firewall integration
            • Set up SSH credentials to the MID Server
            • Activate and configure the Palo Alto Networks Firewall Integration
            • Security Operations Integration Palo Alto Networks Firewall Launcher workflow
            • Security Operations Palo Alto Networks - Check and Block Value workflow
            • Get Log Data Flow
          • Palo Alto Networks - WildFire integration
            • Activate Security Operations Palo Alto Networks - WildFire
            • Get WildFire Data Enrichment Flow
          • Palo Alto Networks Next-Generation Firewall integration
            • Create a certificate profile for the Palo Alto Networks Next-Generation Firewall
            • Set up and install Palo Alto Networks Next-Generation Firewall
            • Create the API account role for Palo Alto Networks Next-Generation Firewall
            • Supported External Dynamic Lists for Palo Alto Networks Next-Generation Firewall
            • Create an EDL for Palo Alto Networks Next-Generation Firewall
            • Activate an EDL for Palo Alto Networks Next-Generation Firewall
              • Activate an EDL manually for Palo Alto Networks Next-Generation Firewall
                • Configure an EDL in Palo Alto Networks Next-Generation Firewall
              • Activate an EDL for Palo Alto Networks Next-Generation Firewall with a change request
            • Submit EDL entries from a security incident record for Palo Alto Networks Next-Generation Firewall
            • Submit EDL entries from the blocklist for Palo Alto Networks Next-Generation Firewall
            • Approve EDL entries for Palo Alto Networks Next-Generation Firewall
            • EDL entry exceptions for Palo Alto Networks Next-Generation Firewall
            • (Optional) Edit the security tag name for Palo Alto Networks Next-Generation Firewall
            • Uninstall Palo Alto Networks Next-Generation Firewall
          • PhishTank integration
            • Install and configure PhishTank
            • Verify expected results for PhishTank
            • (Optional) Manually attach an observable for PhishTank
          • Proofpoint Integration for Security Operations
            • Exploring the Proofpoint Integration for Security Operations
            • Configuring the Proofpoint Integration for Security Operations
              • Install and configure the Proofpoint Integration for Security Operations
              • Create an event profile for the Proofpoint Integration for Security Operations
              • Review Proofpoint integration settings
              • View Proofpoint Analytics Dashboard
          • Reverse Whois integration
            • Install and configure Reverse Whois
            • (Optional) Install and configure Whois
            • Initiate the lookup for Reverse Whois
            • Verify expected results for Reverse Whois
            • (Optional) Run enrichment lookup and verify expected results for Whois
          • RISKIQ and WHOISIQ integration
            • Supported observables for RISKIQ and RISKIQ WHOISIQ
            • Install and configure RISKIQ and WHOISIQ
            • Verify expected results for RISKIQ SSL certificate lookups
              • RISKIQ SSL certificate lookups that return an exact match
              • RISKIQ SSL certificate lookups that return multiple certificates or no certificates
            • Verify expected results for WHOISIQ URL lookups
            • Create an observable for manual WHOISIQ lookups
            • Verify expected results for manual WHOISIQ lookups
          • Shodan integration
            • Install and configure Shodan
            • Verify expected results for Shodan
            • (Optional) Manually attach an observable for Shodan
          • Secureworks CTP Ticket Ingestion Integration
            • Set up your ServiceNow AI Platform instance for the Secureworks CTP ticket ingestion integration
              • Install and configure the ServiceNow application for the Secureworks CTP ticket ingestion integration
            • Create a profile for Secureworks CTP ticket ingestion integration
              • Identify the source of the profile
              • Mapping of ticket fields for the SecureWorks CTP integration
                • Ingesting the sample Secureworks tickets
                • Mapping Secureworks ticket fields to security incident response fields
              • Preview the mapped values in the security incident
              • Define schedule for the Secureworks CTP Ticket ingestion
              • Automate ticket updates and closure based on SIR incident status
            • Optional: Copy a Secureworks CTP profile
            • Security Incident Response form changes after ticket ingestion
            • View the Secureworks tickets and the corresponding security incidents
              • Secureworks CTP Master Ticket Closure Notice
            • Secureworks CTP integration configuration settings
          • Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks
            • Install and Configure
            • Create an incident profile
            • Set Alert Sources
            • Map incident fields
            • Define filter and aggregation criteria
            • Schedule incident retrieval
            • Automate incident updates and closures
          • Security Incident Response integration with Zscaler
            • Getting started with Security Incident Response integration with Zscaler
            • Configure access to Zscaler Internet Access APIs
            • Install and configure Security Incident Response integration with Zscaler
            • Add Zscaler Internet Access URL category lists
            • Submit observables from a security incident record to a URL category list
            • Approve observables to URL category lists
            • Submit the security incident to the Zscaler URL category list
            • Run a threat lookup by using the Zscaler global threat library
            • Submit to Zscaler Sandbox analysis
            • Set up email alerts for Patient 0 events
          • ServiceNow Security Operations add-on for Splunk overview
            • Splunk integration setup
              • Download the ServiceNow Security Operations application
              • Install the ServiceNow Security Operations add-on for Splunk
              • Setup Splunk environment
                • Configure Application Registry on the ServiceNow instance
                • Using ServiceNow Security Operations Integration add-on
            • Manual search commands
            • Splunk event actions
            • Single-record Splunk alerts
            • Multiple-record, custom field Splunk alerts
              • Create a multi-record, custom field Splunk alert
              • Multi-record, custom field Splunk alert examples
            • Splunk error reporting
          • Splunk Enterprise Event Ingestion integration for Security Operations by ServiceNow
            • Set up your ServiceNow AI Platform instance for the Splunk Enterprise Event Ingestion integration
            • Install and configure the ServiceNow application for the Splunk Enterprise Event Ingestion integration
              • Configure Splunk Enterprise Event Ingestion settings
            • Create and name an event profile for the Splunk Enterprise Event Ingestion integration
              • Select scheduled alerts for the Splunk Enterprise Event Ingestion integration
              • Mapping alerts and events for the Splunk Enterprise Event Ingestion integration
              • Map alerts for the Splunk Enterprise Event Ingestion integration
              • Preview the security incident for the Splunk Enterprise Event Ingestion integration
              • Schedule and retrieve alerts for the Splunk Enterprise Event Ingestion integration
            • Integration architecture and external systems connection for the Splunk Enterprise Event Ingestion integration
              • Copy Splunk Enterprise Event Ingestion profiles from one instance to another using export/import functionality
              • Copy an event profile for the Splunk Enterprise Event Ingestion integration
              • Set up ServiceNow Event Ingestion Integration add-on
              • Using ServiceNow Event Ingestion Integration add-on
              • Save searches in your Splunk Enterprise console for the Splunk Enterprise Event Ingestion integration
              • Use the script editor to format alert values for the Splunk Enterprise Event Ingestion integration
              • Checklist for the Splunk Enterprise Event Ingestion integration
          • Splunk Enterprise Security event ingestion integration
            • Key terms used in this integration
            • Set up your ServiceNow AI Platform instance for the Splunk Enterprise Security integration
            • Install and configure the ServiceNow application for the Splunk Enterprise Security Notable Event Ingestion integration
              • Configure Splunk Enterprise Security settings
              • Authentication errors
            • Create and name an event profile for the Splunk Enterprise Security event ingestion integration
            • Setup ServiceNow Security Operations Event Ingestion Addon for Splunk ES
            • Using ServiceNow Security Operations Event Ingestion Add-on for Splunk ES
            • Copy an event profile for the Splunk Enterprise Security Event Ingestion integration
            • Use the script editor to format alert values for the Splunk Enterprise Security Event Ingestion integration
            • Copy Splunk Enterprise Security profiles from one instance to another using export/import functionality
            • Checklist for the Splunk Enterprise Security Notable Event Ingestion integration
          • Splunk - Incident Enrichment integration
            • Get started with the Splunk Search integration for Security Operations
        • Mobile Experience for Security Incident Response
          • Set up checklist for the Security Incident Response Mobile app
          • Log in to the Security Incident Response Mobile app
          • View, edit, and assign open security incidents with the Security Incident Response Mobile app
          • View, edit, and reassign security incidents assigned to you with the Security Incident Response Mobile app
          • View, edit and assign unassigned security incidents with the Security Incident Response Mobile app
          • View, edit, and assign high priority incidents with the Security Incident Response Mobile app
          • View, edit, and assign security incidents with a risk score greater than 60 with the Security Incident Response Mobile app
          • Search for security incidents with the Security Incident Response Mobile app
          • View, edit, and assign open response tasks with the Security Incident Response Mobile app
          • View, edit, and reassign your response tasks with the Security Incident Response Mobile app
          • Filter records with the Security Incident Response Mobile app
        • Security Incident Response Orchestration
          • Set up Security Incident Response Orchestration
          • Understand Security Incident Response Orchestration workflows and workflow templates
            • Security Incident Response Orchestration flows and actions
              • Create Lookup Request for IoC Changes Flow
                • Create IoC Lookup Request Flow Action
              • Security Incident Response- Get Network Statistics Flow
              • Security Incident Response - Get Running Services Flow
                • Determine Shell Script by OS Flow Action
                • Get Running Services - WMI Enrichment
              • Run procdump flow
                • Execute procdump action
              • Security Incident - Evaluate response task outcome workflow
      • Threat Intelligence
        • Understanding Threat Intelligence
          • Domain separation and Threat Intelligence
        • Set up Threat Intelligence
        • IoC Repository
          • Attack modes and methods
            • Define an attack mode/method
            • Add an IoC to an attack mode/method
            • Add a related attack mode method
            • Add associated task to an attack mode/method
          • Indicators of compromise
            • View an IoC
            • Add a related observable to an IoC
            • Add a related attack mode/method to an IoC
            • Identify associated indicator types
            • Identify indicator sources
            • Add associated tasks to an IoC
          • Observables
            • Define an observable
            • Add a related IoC to an observable
            • Add associated tasks to an observable
            • Add a related observable
            • Load more IoC data
            • Identify observable sources
            • Perform lookups on observables
            • Perform threat enrichment on observables
          • Attack patterns
            • Define an attack pattern
          • Campaigns
            • Define a campaign
          • Course of actions
            • Define a course of action
          • Identities
            • Define identities
          • Infrastructure
            • Define infrastructure
          • Intrusion set
            • Define an intrusion set
          • Locations
            • Define Location
          • Malware
            • Define a Malware
          • Malware analysis
            • Define malware analysis
          • Observed data
            • Define observed data
          • Threat actors
            • Define threat actors
          • Threat groupings
            • Define threat groupings
          • Marking definitions
            • Define marking definitions
          • Threat notes
            • Define threat notes
          • Threat opinions
            • Define threat opinions
          • Threat reports
            • Define threat reports
          • Sightings
            • Define indicator sightings
            • Define object sightings
          • Tools
            • Define tools
          • Vulnerabilities
            • Define vulnerabilities
          • Relationships
            • Define object-object relationships
            • Define object-indicator relationships
            • Define object-observable relationships
          • STIX Visualizer
        • MITRE-ATT&CK framework overview
          • MITRE-ATT&CK administration
            • Get started with MITRE-ATT&CK framework
            • Understand the MITRE to STIX data model
            • Domain separation and MITRE-ATT&CK
            • Set up the MITRE-ATT&CK framework
            • Manage matrices
            • Manage techniques
            • Manage mitigations
            • Manage groups
            • Manage malware
            • Manage tools
            • Manage MITRE relationships
            • Manage CVE and technique mapping
            • Extend the MITRE-ATT&CK data
            • Define the data source and detection tool mapping
            • Define the data source and data component mapping
            • Define the technique detection coverage
              • MITRE-ATT&CK Scoring definition
            • Map your technique detection coverage to a technique
            • Define the mitigation coverage
              • Technique mitigation coverage definitions
            • Map your mitigation coverage to a technique
              • Overall technique mitigation coverage calculator
            • Create and map detection rules
            • Auto-extract technique rules for importing MITRE-ATT&CK information
            • Review threat group and MITRE-ATT&CK techniques mapping
            • Threat group to technique heatmap definition
            • Review the MITRE-ATT&CK system properties
          • Using MITRE-ATT&CK to detect and analyze threats
            • Associate MITRE-ATT&CK information with security incidents
            • Associate MITRE-ATT&CK information with observables
            • Associate MITRE-ATT&CK information with security case
            • Rollup MITRE-ATT&CK information using Threat Lookup results
            • Rollup MITRE-ATT&CK information from detection rules
            • Rollup MITRE-ATT&CK information from child security incidents
            • Perform link analysis and threat hunting using MITRE-ATT&CK specific filters
            • MITRE-ATT&CK heat map and navigator
            • Using the MITRE-ATT&CK dashboard
        • Threat Intelligence administration
          • Threat Lookup Finding Calculators
            • Using Threat Lookup Finding Calculators
        • Threat Intelligence integrations
          • CrowdStrike Falcon Intelligence integration
            • CrowdStrike Falcon Intelligence integration overview
          • Have I been pwned? integration
            • Security Operations Have I been pwned? integration setup
              • Threat Lookup - Have I been pwned? flow
              • Activate the Security Operations Have I been pwned? integration
              • Update your X.509 certificate
          • MISP integration for Security Operations
            • MISP administration
              • Getting started with MISP integration for Security Operations
                • MISP user roles and permissions
              • Install and configure the MISP integration for Security Operations
              • Review the MISP integration settings
              • Configure MISP sighting searches
              • Configure how an automatic event is created
              • MISP event data
              • Associated MISP events
              • MISP user information
              • Domain separation and MISP
              • Troubleshooting MISP integration
            • Using MISP to investigate and analyze threats
              • Sighting searches in MISP
              • Observable enrichment in MISP
              • Managing events in MISP
              • Roll up MITRE-ATT&CK information using MISP enrichment results
          • OPSWAT Metadefender Integration
            • OPSWAT Metadefender integration overview
          • VirusTotal integration
            • VirusTotal integration setup
              • Activate and configure the VirusTotal integration
            • Threat Lookup - VirusTotal workflow
          • WhoisXML API integration
            • WhoisXML API integration setup
              • Activate and configure the Security Operations Whois integration
              • Update your X.509 certificate
            • Enrich Observable WhoIs workflow
        • Threat Intelligence Orchestration
          • Set up Threat Intelligence Orchestration
          • Threat Intelligence Orchestration workflows and activities
        • Security Case Management
          • Create cases in Security Case Management
            • Add artifacts to a case
            • Associate MITRE-ATT&CK information with security case
          • Case creation from security artifacts
            • IoCs and observables in cases
              • Create a case from IoCs or observables
              • Add IoCs and observables to an existing case
              • Create an observable from a case
              • Run a sightings search on observables in a case
            • Security incidents in cases
              • Create a case from security incidents
              • Add security incidents to an existing case
            • Configuration items in cases
              • Create a case from CIs
              • Add CIs to existing cases
            • Affected users in cases
              • Create a case from affected users
              • Add affected users to existing cases
          • Security artifact analysis
            • Related details for case artifacts
              • View related details for a security incident artifact
              • View related details for a configuration item artifact
              • View related details for an IoC artifact
              • View related details for an affected user artifact
              • View related details for an observable artifact
            • Security artifact exclusion and inclusion
              • Exclude security artifacts from a case
              • Return excluded security artifacts to a case
            • Annotate security artifacts
            • Search for security artifacts
    • Security Posture Control
      • Exploring Security Posture Control
        • Install the supported applications for Security Posture Control
        • Service Graph Connectors for Security Posture Control
        • Policies for Security Posture Control
          • Policies included with the Security Posture Control application
          • Creating your own policies in the Security Posture Control application
        • Key insights and configured insights for Security Posture Control
      • Using the Security Posture Control workspace
        • Activate a policy included with the Security Posture Control application
        • Create and activate custom policies for Security Posture Control
        • Edit an activated policy in Security Posture Control
        • Clone a policy or create a child policy in Security Posture Control
        • Create and activate a configured insight for Security Posture Control
        • Create an asset profile in Security Posture Control
          • Delete an asset profile in Security Posture Control
        • View findings for Security Posture Control
          • Test result and remediation task state transitions in the Security Posture Control application
        • Creating your own API connectors in Security Posture Control
          • Enter metadata
          • Create connector alias and connection credentials
          • Select a connector template
          • Provide input values for your API connector
          • Map API response to SPC attributes
          • Validate your API connector
          • Create an instance and set the import schedule
        • Create an asset search in Security Posture Control
        • Resolving duplicate configuration items in Security Posture Control
          • Resolve duplicate configuration items in Security Posture Control
      • Using mitigation controls monitoring with Security Posture Control
        • Mitigation controls policies
        • Mitigation controls and policies required for Exploit Protection (EDR) mitigation controls
          • Install and configure the CrowdStrike integrations for mitigation controls monitoring
          • Install and configure the Service Graph Connector for Microsoft SCCM and the Microsoft Defender Mitigation Control Integration
            • Create multiple instances for the Microsoft Defender Mitigation Control Integration
          • Install and configure the Service Graph Connector for SentinelOne and the SentinelOne Mitigation Control Integration
        • Exploit Protection (WAF) mitigation controls
          • Configure the F5 BIG-IP integrations for mitigation controls monitoring
          • Configure the AWS WAF integration for mitigation controls monitoring
          • Create a policy for the AWS WAF integration for mitigation controls monitoring
        • View detected mitigations
        • Mitigation controls to vulnerable item mapping
      • Use cases, policy examples, and supported service graph connectors in Security Posture Control
        • Security Posture Control use case: Detecting assets with missing endpoint protection
        • Security Posture Control use case: Detecting assets missed by vulnerability assessment tools
        • Security Posture Control use case: Detecting unmanaged assets
        • Security Posture Control use case: Detecting assets missing an endpoint management solution
        • Security Posture Control use case: Detecting assets with vulnerabilities and security tool coverage gaps
        • Security Posture Control use case: Detecting internet exposure of cloud assets  and high-risk combinations
        • Supported hardware service graph connectors for Security Posture Control
        • Supported software service graph connectors for Security Posture Control
        • Examples of base, child, and cloned policies for Security Posture Control
          • Create a base policy for Security Posture Control (example)
          • Create a child policy from a base policy for Security Posture Control (example)
          • Clone a policy for Security Posture Control (example)
    • Cybersecurity Executive Dashboard
      • Opt-in for benchmark scores
      • Set targets
      • Security Simulation and Training Integration for Security Operations
        • Configure Knowbe4 integration
        • Configure Microsoft Defender for Office 365 integration
      • Risk and compliance dashboard for GRC: Metrics
        • Risk and Compliance Dashboard reports and solutions
    • Threat Intelligence Security Center
      • Exploring Threat Intelligence Security Center
        • TISC Key terminology
        • View Threat Intelligence Security Center Homepage
      • Configuring Threat Intelligence Security Center
        • Download TISC application from ServiceNow Store
        • Set up Threat Intelligence Security Center
      • Integrating Threat Intelligence Security Center
        • Threat Intelligence Security Center Catalog
        • Threat Intelligence Feeds
          • Configure a new threat intelligence feed
          • Configure Custom Field Mapping
          • View Threat Intel Feeds
            • View STIX TAXII Feeds
            • View STIX HTTPs Feeds
            • View MISP Feeds
            • View Text Feeds
            • View CSV Feeds
            • View JSON Feeds
            • View RSS Feeds
            • View Custom Feed
              • Configure custom CrowdStrike feed
                • System Properties for CrowdStrike
              • Configure custom MISP feed
          • Understanding STIX TAXII
            • Configure a new TAXII Feed
          • Duplicate threat intelligence feeds
        • TISC Enrichment Integrations
          • Configure Observable Enrichment
          • Configure Sighting Search
            • Define queries for Sighting Search
            • Using Sighting Search Parameters
          • Configure Threat Lookup
            • View Threat Lookup Reputation Calculators
        • TISC API References
        • TISC Integrations
          • Observable Enrichment
            • Whois integration
              • Configure and enable Whois integration
            • Shodan integration
              • Configure and enable Shodan integration
          • Sighting Search
            • Get started with Elasticsearch integration
              • Configure and enable Elasticsearch integration
            • Get started with Splunk Search integration
              • Configure and enable Splunk integration
          • Threat Lookup
            • TISC VirusTotal integration
              • Configure and Enable VirusTotal Integration
            • TISC CrowdStrike Falcon Intelligence integration
              • Configure and Enable CrowdStrike Falcon Intelligence integration
        • TISC Security Tools - EDR
          • CrowdStrike Falcon EDR integration
            • Configure Crowdstrike Falcon EDR integration
            • Send observables to EDR
          • Microsoft Defender for EDR Integration
            • Register and configure the Microsoft Defender in the Microsoft Azure portal
            • Install and configure Microsoft Defender for EDR Integration
            • System properties for Microsoft Defender EDR
            • Send observables to EDR
          • TISC Security Tools - Firewall
            • Palo Alto Networks integration
              • Create new EDL for Palo Alto Networks
              • Palo Alto EDL Approval Rules
              • Add Observables to EDL
              • Remove Observables from EDL
              • Approve EDL entries for Palo Alto Networks
          • TISC add-on for Splunk overview
            • TISC integration with Splunk
            • Creating users in ServiceNow TISC instance
            • Configuring TISC add-on in Splunk
              • Data storage in Splunk
        • TISC - Azure Sentinel integration
          • TISC playbook templates
      • Administration
        • Defining Data Imports Approval Rules
        • Defining Expiration Rules
          • Expiration rules for source records
        • Create Inbound Data Exclusion Rules
        • Custom Threat Score Calculator in TISC
          • Define Threat Score Calculator
        • MITRE ATT&CK Technique Extraction Rules
          • MITRE ATT&CK Technique Extraction method
        • Defining Security Control Lists
        • Creating Taxonomies
          • Bulk import Taxonomies
        • Managing the Threat Lookup Reputation Calculator
        • Manage email Notifications
          • Email Notifications
          • Email logs
        • Report Templates
          • Create a new Report Template
          • System properties for Reports
          • Edit a Published Report Template
          • Duplicate a Report Template
        • Working with Webhooks
          • System properties for Webhooks
          • Configure webhooks
            • Subscribe Triggers
            • View webhook error logs
            • View webhook batches
          • Webhook Triggers
        • Configure tooltips for nodemaps
        • Working with automated flows
          • Automated IOC Enrichment
          • Analyze, assess, and disseminate observables
          • Analyze and assess threat IoC’s
          • Vulnerability Management Support
          • Zero-day vulnerability tracking
          • Automated flows tables
      • Threat Intelligence Security Center reference
        • Domain separation and Threat Intelligence Security Center
        • Components installed with Threat Intelligence Security Center
      • Using Threat Intelligence Security Center
        • TISC integration with SIR Workspace
        • Configuring Threat Intelligence External Sharing
          • Exploring Outbound Intel Sharing
            • Configuring Outbound Intel Sharing Controls
            • Configuring Outbound Intel Data Exclusion Rule
            • Configuring Outbound Intel Sharing Profiles
            • Configuring Outbound Intel Sharing Groups
            • Defining Approval Rule for Outbound Intel
            • Configuring Outbound Intel Sharing Templates
            • Working on the Redaction Library
              • Bulk Import of Redaction Categories and Values
          • Exploring Inbound Intel Sharing
            • Configuring Inbound Intel Sharing Profiles
            • Configuring Inbound Intel Sharing Groups
            • Defining Approval Rule for Inbound Intel
          • Exploring TAXII Outbound Server
            • Create TAXII Collection
            • Automated Sharing of TAXII Collections
            • Viewing TAXII Collection Records
        • Viewing Threat Intelligence External Sharing
          • Viewing Outbound Intelligence
          • Viewing Inbound Intelligence
          • Viewing TAXII Collections
        • Viewing Redaction Imports
          • View all Redaction Imports
          • View my Redaction Imports
        • Sharing of Outbound Intelligence Records from GUI
        • Threat Intelligence Sharing Approval Workflow
        • Automated Sharing of Outbound Intelligence Records
        • Working with Data Imports
          • Viewing all imports
          • Viewing my imports
          • Viewing my approvals
        • Import Threat Intelligence
          • Import data using structured file
          • Import data using standard format
          • Import data using raw text
          • Import data using unstructured file format
        • Threat Analyst Workbench
          • Workbench Overview
          • Creating cases using Threat Analyst Workbench
            • Enforced Restrictions for case(s)
              • Access controls for a case
              • External user access for case tasks
            • Associate MITRE Techniques to a Case
            • Roll up of MITRE technique associations
          • Create case task using Threat Analyst Workbench
          • Working with Investigation Canvases
            • Understanding investigation canvas actions
            • Linking an existing case from Investigation Canvas
            • Creating a Case and Linking from Investigation Canvas
            • Linking Canvas from a Case
            • Create an investigation canvas
            • Adding a new node to the canvas
            • Investigation canvas and MITRE ATT&CK
              • Investigation Canvas MITRE Filters
          • Add artifacts to case(s) or case task(s)
            • Roll up of MITRE Techniques from Artifacts to Case
            • Show MITRE ATT&CK Framework for a Case(s)
          • Run Enrichment Actions within a case
          • View Case Reports
          • Create a security incident from a TISC case
          • Upload Secure File Attachments
        • Threat Intelligence Security Center Library
          • Understanding the Data Model
          • TISC Library Objects form view
          • TISC Library Repository
            • Observables
              • Define an Observable
              • Observables source records
              • Link Threat Intel Related Records
              • Fetch Observables Data
              • View details in Relationship Graph
                • Link node actions in Relationship Graph
              • Working with Internal Intelligence Records
                • View Internal Intelligence Records
              • Run Enrichment Actions from Observable
              • Add to Case
              • Run Enrichment operations in TISC
                • Run Threat Lookup
                • Run Sighting Search
                • Run Observable Enrichment
              • View Enrichment Results
            • Indicators
              • Define an Indicator
            • Attack Patterns
              • Define an attack pattern
            • Campaign
              • Define Campaign
            • Courses of Action
              • Define Courses of Action
            • Identity
              • Define identities
            • Infrastructure
              • Define infrastructure
            • Intrusion Set
              • Define Intrusion Set
            • Location
              • Define Location
            • Malware
              • Define Malware
            • Malware Analysis
              • Define Malware Analysis
            • Object Sighting
              • Define Object Sighting
            • Observed Data
              • Define Observed Data
            • Threat Actor
              • Define Threat Actor
            • Threat Event
              • Define Threat Event
            • Threat Grouping
              • Define Threat Grouping
            • Threat Note
              • Define Threat Note
            • Threat Opinion
              • Define Threat Opinion
            • Threat Report
              • Define Threat Report
            • Tool
              • Define Tools
            • Vulnerability
              • Define Vulnerability
              • Fetch Vulnerability Data
            • Marking Definition
              • Define Marking Definition
            • Data Component
              • Define Data Component
            • Data Sources
              • Define Data Sources
            • Define RSS Feeds
            • Relationships Objects
              • Define observable-observable relationships
              • Define object-object relationships
              • Define object-observable relationships
              • Define object-indicator relationships
              • Define indicator-indicator relationships
              • Define indicator-observable relationships
            • Potential Relationships
              • Confirm observable-observable potential relationship
              • Confirm object-object potential relationships
              • Confirm indicator-indicator potential relationships
          • Export intelligence data
          • Confirm Potential Relationships from Related Records
          • Automated Correlation
        • Working with Data Exports
          • View all exports
          • View my exports
          • Export intelligence system properties
        • MITRE-ATT&CK Repository
          • Manage Matrices
          • Manage Techniques
          • Manage Mitigations
          • Manage Groups
          • Manage Malware
          • Manage Tools
          • Manage MITRE Relationships
        • Data migration in TISC
          • Data migration from SIR TI to TISC
        • TISC Data Processing Functional Flow
        • TISC Data Archival
          • TISC Data Archival
            • Archive TISC related records
            • Destroy Rules in TISC
          • Delete intelligence records
    • Data Loss Prevention Incident Response
      • Exploring Data Loss Prevention Incident Response
        • DLP Incident Response overview
        • Get started with DLP Incident Response
      • Installing and configuring DLP IR Incident Response
        • Install and configure the DLP Incident Response application
        • Domain separation and DLP Incident Response
      • DLP Incident Response Administration
        • DLP default configuration settings
        • Create end user lookup rules
        • Create assignment rules
        • Create incident consolidation rules
        • Create response due date rules
          • Add multiple users to access DLP incidents
        • Create Approval Rules
        • Create user instructions templates
          • Configure DLP UI user instructions
        • Create email templates
        • Create a Data Loss Prevention Incident Response SLA trigger
        • Create a Data Loss Prevention Incident Response SLA definition
        • Create assessments
        • Configure response option for your DLP incidents
        • Create incident response option rules
        • Create age chart configurations
        • Create user delegate configurations
        • Create repeat offender identification rules
        • Create Additional Incident Data Fields
        • DLP SLA Definition form
        • Configure advanced settings
        • Monitor DLP Integration Run process
        • DLP Incident Access Restrictions
          • Create field level restrictions
          • Create record level restrictions
        • DLP Incidents Archival
          • Archive DLP related records
      • Data Loss Prevention Incident Response Incident Management
        • Data Loss Prevention Incident Response User Workspace
          • Report or respond to DLP incidents
          • Working with my approvals module
        • Data Loss Prevention Incident Response Analyst Workspace
        • Data Loss Prevention Incident Response Dashboard
      • Inbound Integration for Data Loss Prevention Incident Response
      • DLP integrations
        • Symantec Integration for Data Loss Prevention Incident Response
          • Getting started with Symantec DLP integration for Data Loss Prevention
          • Install and configure the Symantec DLP integration for Data Loss Prevention
          • Create a profile for Symantec DLP integration
            • Define filters to apply for the Incident creation
            • Configure evidence file storage
            • Schedule the Symantec DLP Incident Retrieval
            • Mapping Symantec DLP incident statuses with ServiceNow incident Status
          • Severity mapping between Symantec DLP incidents with ServiceNow incidents
          • Configure Smart Response Rules
          • Execute Smart Response Rules
          • Download evidence files on Symantec
          • Preview evidence files
          • Configure the Symantec DLP  integration settings
          • Domain Separation in the Symantec DLP integration
        • Data Loss Prevention Incident Response Integration with Proofpoint
          • Getting started with Proofpoint integration for Data Loss Prevention
          • Install and configure the Proofpoint integration for Data Loss Prevention
            • Create an Application in Proofpoint and Obtain Client Credentials
            • Configure the Webhook on the Proofpoint DLP tenant for alert notifications to ServiceNow
          • Create a Profile for Proofpoint DLP integration
            • Define filters to apply for the Incident creation
            • Configure evidence file storage
            • Download DLP incidents evidence files on Proofpoint
            • Preview evidence files
            • Email remediation actions
          • Map Proofpoint DLP incidents status with ServiceNow incident status
          • Configure Proofpoint DLP integration settings
          • Domain Separation in Proofpoint DLP integration
        • Data Loss Prevention Incident Response Integration with Netskope
          • Getting started with Netskope DLP integration for Data Loss Prevention
          • Install and configure the Netskope DLP integration for Data Loss Prevention
          • Create a Profile for Netskope DLP integration
            • Define Filters to apply for the Incident creation
            • Schedule the Netskope DLP incidents retrieval
          • Mapping DLP incident status with Netskope
          • Configure Netskope DLP integration settings
          • Download evidence files
          • Preview evidence files
          • Notifications for users on retry mechanism
          • Email notifications on credential expiration
          • Domain Separation in Netskope DLP integration
        • Internet Content Adaption Protocol (ICAP) integration for DLP IR
          • Getting started with ICAP DLP integration for Data Loss Prevention
          • Install and configure the ICAP DLP integration
          • Create a profile for ICAP DLP integration
            • Define filters to apply for the Incident creation
            • Schedule the ICAP DLP incidents retrieval
          • View sensitive information for DLP alerts
          • Download evidence files for DLP alerts
          • Preview evidence files for ICAP
          • Review the ICAP DLP integration settings
        • Data Loss Prevention Incident Response with Microsoft
          • Getting started with Microsoft DLP IR integration for data loss prevention
          • Install and configure the Microsoft DLP integration
          • Create a new incident profile for Microsoft DLP integration
            • Microsoft purview endpoint storage configuration
            • Define filters to apply for the Incident creation
            • Configure the match content for the incident
            • Schedule the DLP IR Microsoft incident retrieval
          • Configure Microsoft DLP IR integration settings
          • Configure evidence file storage for Microsoft
          • Request release email from quarantine
          • Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
            • Download files approval flow
          • Preview Evidence files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
          • Domain separation in Microsoft DLP integration
    • Security Operations common functionality
      • Create and define filter groups in Security Operations
      • Shared data transformation
        • Create duplication rules in Security Operations
      • Security Operations email processing
        • Security Operations email properties
          • Create Security Operations email properties
        • Security Operations email parsing
          • Create email parsers in Security Operations
          • Edit email records in Security Operations
        • Unmatched Security Operations email events
          • View and reprocess unmatched Security Operations emails
      • Security Operations field mapping
        • Map tables to tables with Security Operations field mapping
      • Security Operations field value transforms
        • Create Security Operations field value transforms
      • Security Operations enrichment data mapping
        • Create a Security Operations enrichment data map
      • Security Operations user-defined escalation
        • Create a Security Operations user-defined escalation group
      • Create domain-separated property overrides
      • Create an operating system group
      • Set up security tag groups and tags
        • Create security tag rules
        • Import security tag rules
      • Security annotations
        • Create security annotations for CIs
        • Create security annotations for observables
        • Create security annotations for users
        • View security annotations reports
      • Components installed with Security Support Common
        • View components installed with Security Support Common
      • Search Security Operations
      • Security Operations Integration Reference
        • ServiceNow Security Operations integration development guidelines
          • Types of ServiceNow integrations provided
          • Security Operations Integration Configurations
            • Activate and configure third-party integrations
            • Create an integration
          • Tips for writing integrations
          • Integration troubleshooting
            • Replace an untrusted or expired third-party SSL certificate
        • Integrations Capabilities framework 2.0
        • REST APIs for third-party integration with Security Operations
        • Integration capabilities
          • Security Operations Integration- Block Request capability
            • Run Block Request
            • Security Operations Integration - Block Request Flow
          • Security Operations Integration- Email Search and Delete capability
            • Security Operations Integration - Email Search and Delete flow
              • Execution Tracking Begin (Mail Search) activity
          • Security Operations Integration- Enrich CI capability
            • Security Operations Integration - CI Enrichment flow
          • Security Operations Integration- Enrich Observable capability
            • Security Operations Integration - Enrich Observable workflow
          • Security Operations Integration- Get Network Statistics capability
            • Security Operations Integrations - Get Network Statistics workflow
            • Execution Tracking - Begin (CIs) Flow Action
            • Security Incident Response- Get Network Statistics Flow
          • Security Operations Integration- Get Running Processes capability
            • Security Operations - Get Running Processes Flow
            • Security Operations Carbon Black Integration - Get Running Processes Flow
              • Collect Carbon Black Configurations Flow Action
              • Check MID Server Status
              • Get Sensor ID Flow Action
              • Create Session Flow Action
              • Check Session Status Flow Action
              • Create Command Process Flow Action
              • Check Command Status and Get Process Flow Action
              • Map Processes Data Flow Action
              • Close Session Flow Action
            • Security Operations System Command Integration- Get Running Processes flow
              • Combine results activity
              • Execute Shell Script activity
              • Extract Shell Script from MID Script activity
              • Get Running Processes via PowerShell activity
          • Security Operations Integration- Isolate Host capability
            • Security Operations - Isolate Host Flow
            • Run Isolate Host
            • Security Operations Carbon Black Integration - Isolate Host Flow
              • Get Sensor ID Flow Action
              • Set Network Isolation Enabled Flow Action
              • Update Sensor Flow Action
            • Security Operations Carbon Black Integration- Remove Host Isolation Flow
          • Security Operations Integration- Publish to Watchlist capability
            • Security Operations Integration - Publish to Watchlist Flow
          • Security Operations Integration- Sightings Search capability
            • Create sightings search configuration records
              • Run a Sightings Search
              • Security Operations Integration - Sightings Search Flow
                • Security Operations - QRadar Sightings Search Flow
                • Security Operations - McAfee ESM Sightings Search Flow
                • Security Operations - Arcsight Logger Sightings Search Flow
                • Security Operations - Elasticsearch Sightings Search Flow
                • Security Operations Integration - Splunk Sightings Search Flow
              • View Sightings Search Results
                • Share Sightings Search results
                • Share observables from a security incident
              • View Sightings Search Details
              • View Sightings Search Data
          • Security Operations Integration - Threat Lookup capability
            • Security Operations Integration - Threat Lookup workflow
          • Change the order of workflow execution
        • Common Security Operations integration flows and orchestration Flow Actions
          • Execution Tracking - Begin Flow Action
          • Capability Execution Tracking - Complete Flow Action
          • Capability Execution Tracking- Failure Flow Action
          • Capability - Determine CIs activity
          • Create Enrichment Data records Flow Action
          • Get Configuration Item FQDN Flow Action
          • Determine Observables activity
          • Get Supported Security Capabilities activity
          • Capability Execution Tracking- No Impls activity
          • Create Compliance Search Action
          • Get IP from CI activity
          • Get Network Statistics via netstat Flow Action
          • Get running processes via WMI activity
          • Check Compliance Search Status Action
          • Update Task Worknotes activity
          • Roll up lookup info to security incident activity
          • Update security incident with lookup results workflow
          • Filter Allowlisted Observables activity
          • Write content to record as attachment activity
          • Get IP from CI Flow Action
      • Security Operations workflow triggers
        • Create Security Operations workflow triggers
      • Security Operations Orchestration
    • Security Operations and the ServiceNow Store
      • Download an application from the ServiceNow Store for the first time
        • Get entitlement for a Security Operations product or application
        • Activate a ServiceNow Store application
      • Install a Security Operations integration
      • Update an application previously downloaded from the ServiceNow Store
      • Upgrade your instance to the next family release
Table of Contents

ServiceNow Security Operations add-on for Splunk overview

Save as PDF
Save topicSave topic & subtopicsSave entire publication
Share this page
Share to emailCopy latest version URL
Print
  •  
  • UpdatedJul 31, 2025
  • 1 minute read
    • Xanadu
    • ServiceNow Security Operations add-on for Splunk

ServiceNow Security Operations add-on for Splunk overview

The ServiceNow Security Operations add-on for Splunk allows a Splunk software administrator to collect data and create incidents and events in the ServiceNow AI Platform.

The add-on is installed from Splunkbase.
Important: Splunk is also supported for Managed Service Provider (MSP) environment.

Setup Splunk environment

Configure Application Registry on the ServiceNow instance

Using ServiceNow Security Operations Integration add-on

Previous

No previous section

Next

No next section

Previous

No previous section

Next

No next section

Log in to get a better experience

Log in
ServiceNow LogoThe world works with ServiceNow.™
  • Terms and conditions
  • Privacy statement
  • GDPR
  • AI Acceptable Use Policy
  • Cookie policy
©2025 ServiceNow. All rights reserved.
Title