Security incidents created from events and alerts
Summarize
Summary of Security incidents created from events and alerts
This functionality enables the creation of security incidents from alerts generated by event management tools. Events are processed and grouped into alerts, which can then trigger the creation of security incidents based on defined rules or through manual selection for investigation.
Show less
Key Features
- Automated Incident Creation: A sample alert rule named "Create security incidents from critical alerts" automatically generates security incidents for critical events from ServiceNow or third-party tools.
- Customizable Alert Rules: Users can define multiple alert rules with varying conditions to handle different types of security incidents.
- Manual Incident Creation: Users with the Security Admin role can create incidents directly from suspicious alerts using the "Create Security Incident" button.
- Event Information Requirements: Essential data such as node identification, event classification, and descriptions must be included in external event communications.
- Dynamic Field Updates: Fields in the created security incidents can be updated based on the incoming event data, while preserving existing values where applicable.
Key Outcomes
By leveraging this feature, ServiceNow customers can streamline their incident response processes, ensuring that critical security alerts are promptly transformed into actionable security incidents. This integration enhances security monitoring and response efficiency, allowing for quicker resolution of potential threats.
As events are imported from alert monitoring tools, they are first processed by Event Management and grouped into alerts. These alerts can be used to create security incidents based on customizable alert rules, or manually reviewed to select those alerts to be investigated as a security incident.
You can find a sample alert rule called Create security incidents from critical alerts in the Alert Rules module of the Event Management application. This alert rule automatically creates security incidents when critical security-related events are received from within ServiceNow or from third-party monitoring applications. After the security incident has been created, it will be updated as new events are received. You can modify the task template in the alert rule to change the initial values for the security incident created by this alert rule. To handle each distinct variety of security incident that you would like to create, you can define other alert rules with different conditions.
Alternatively, if you are a user with the Security Admin role, you can manually create a security incident by clicking the Create Security Incident button from any suspicious alert.
- The node set to the name, IP address, or sys_id of the CI that becomes the affected resource.
- The event classification is set to Security to distinguish them from other IT events.
- The event description, which populates the description of the security incident.
- The additional information can include any extra information that does not fit into the previously listed fields or other event fields, such as the category, attack vectors, return URL, or correlation ID. The format is a
string that lists field names along with their values, using the following JSON format:
{ "fieldName" : "fieldValue", "fieldName" : "fieldValue" }