Security Incident Response Task is in draft
"}, {label:"Ready", condition:"state=10^EQ", description:"Security Incident Response Task is ready to be assigned
"}, {label:"Assigned", condition:"state=16^EQ", description:"Security Incident Response Task is assigned
"}, {label:"Work in Progress", condition:"state=18^EQ", description:"Work has started on this Security Incident Response Task
"}, {label:"Closed", condition:"state=3^ORstate=4^ORstate=7^EQ", description:"Security Incident Response Task is complete
"}, ], The TASK_PF array is a collection of labels, conditions, and descriptions used to determine the text displayed in the process formatter bar (including order and activity). In the example, the text 'Ready' is the second item displayed. It is highlighted when the task satisfied the condition 'state=10\^EQ'. When the pointer hovers over the text, the description 'Security Incident Response Task is ready to be assigned' is displayed. Note: States can be combined to a single formatter state. In the example, both the 'Close Complete' and the 'Canceled' states show up as 'Closed' in the top bar. ###### Method calls The following methods must be present in the script include as they are used by sn_si.ProcessDefinition:{#process-definition-script-include__table_okr_g2j_54__entry__3} | Return type | Method summary | Description | |-|-|-| | String | getInitialIncidentState: function() | return the initial incident state numerical value | | String | getInitialTaskState: function(): | return the initial task state numerical value | | Array of string | getIncidentStates: function(): | return the incident state's array | | Array of string | getTaskStates: function(): | return the task state's array | | Array of objects | getIncidentProcessFlows: function(): | return the incident process flow definition array | | Array of objects | getTaskProcessFlows: function(): | return the task process flow definition array | [ ] {#process-definition-script-include__table_okr_g2j_54} The next set of methods are called whenever an incident or a task is updated and allows actions to be taken on specific change transitions. {#process-definition-script-include__table_nbk_ktf_2w__entry__3} | Return type | Method summary | Description | |-|-|-| | void | performIncidentStateChange: function(current, previous) | In the examples, this method is used to set SM-related values and ensure that an incident advances out of 'Draft' once someone is assigned to it. | | void | performTaskStateChange: function(current, previous) | In the example, this method is used to update timestamps (on assignment and closing) and advance the task from 'Ready' to 'Assigned' once the assigned_to field is filled. | [ ] {#process-definition-script-include__table_nbk_ktf_2w}The same actions performed by these two methods can be accomplished using a business rule. By defining them in the script include, switching process definitions is made easier. #### Correct an invalid security incident or task state with process definition {#ariaid-title8} An administrator can correct the security incident or task to valid states, either manually or using a script. Available states vary based on the current state of the incident. ##### Before you begin Role required: admin ##### About this task After you have switched process definitions, the new definition may not support some of the old states. To correct the orphan incident or task states, you can [change your process definition](https://www.servicenow.com/docs/YXyWDiYQPHq7PralL~8YdQ#create-process-definition-sir "You can create a process definition to define the way security incidents transition from one state to the next. Process definitions give service desks and end users help tracking the problem throughout its life cycle."), [edit your script include](https://www.servicenow.com/docs/YXyWDiYQPHq7PralL~8YdQ#process-definition-script-include "The Process Definition script include provides methods for defining a process definition."), or manually open each incident or task to update the state. Generally, updating the state (which can be done in bulk) is the easiest solution. To change states in bulk, do the following: ##### Procedure 1. Navigate to AllProcess Selection. 2. Highlight the State field for the incidents or tasks you want to change. 3. Double-click the State field in the first record, select the new State, and click the green check mark (![Green check mark]()) to complete the change. 4. Click Update. {#correct-invalid-state__steps_zpc_ztz_3x} ## Create a security incident group {#ariaid-title9} Set up a security incident group and assign the appropriate roles and users to the group. ### Before you begin Roles required: * If you have the user_admin role, you can create security incident assignment groups. * If you have the sn_si.admin role, you can create and edit security incident assignment groups. {#t_CreateSecurityIncidentAdminGroup__ul_hq4_2p5_jt} ### About this task Users in a group inherit the roles of the group, so you do not have to assign roles to each user separately. It is a good practice to create as many groups as needed in your organization. It is also a good practice to create one group for administrators and assign the admin role to this group only. ### Procedure 1. Navigate to AllUser AdministrationGroups or Security IncidentSetupGroups. 2. Click New. 3. On the form, fill in the fields. Note: For more information, see [Create a user group](https://www.servicenow.com/docs/access?context=t_CreateAGroup&version=yokohama&pubname=yokohama-platform-administration&ft:locale=en-US). 4. Make sure that you select the security incident type for this group. 1. If the Type field is not visible, configure the form to add it. 2. Click the lock icon beside the Type field. 3. Click the reference lookup icon (![lookup icon]()) 4. Search for and select the security incident type. {#t_CreateSecurityIncidentAdminGroup__substeps_hwh_5q5_jt} 5. Right-click the form header and select Save. 6. In the Roles related list, add the roles that each member of this group receives. For example, if you are making a group for Security Incident Response team members, add sn_si.analyst. If you are making a group for Security Incident Response administrators, add sn_si.admin. 7. In the Group Members related list, add users to this group. 8. Click Update. {#t_CreateSecurityIncidentAdminGroup__steps_tl4_grx_kt} ## Create a security incident calculator group {#ariaid-title10} Security incident calculator groups are used to group calculators. ### Before you begin Role required: sn_si.admin ### Procedure 1. Navigate to AllSecurity IncidentSetupSecurity Incident Calculator Groups. 2. Click New. 3. Fill in the fields on the form, as appropriate. {#t_CreateSecIncCalcGroup__table_t4d_4bd_5s__entry__2} | Field | Description | |-|-| | Name | The name of the security incident calculator. | | Application | The application that contains this record. | | Order | The order in which the security incident calculator is run. A calculator with an order entry of 100 runs before a calculator with an order entry of 200. | | Description | A description of this calculator group. | | Created by | Enter the name of the user who created | [ ] {#t_CreateSecIncCalcGroup__table_t4d_4bd_5s} 4. Click Submit. ### Create a security incident calculator {#ariaid-title11} Security incident calculators allow you to calculate the severity of a security incident based on pre-defined formulas. You can define your own security incident calculators, as needed. #### Before you begin Role required: sn_si.admin #### Procedure 1. Navigate to AllSecurity IncidentSetupSecurity Incident Calculator Groups. 2. Click the name of the group for which you want to create a calculator, or you can [create a calculator group](https://www.servicenow.com/docs/YXyWDiYQPHq7PralL~8YdQ#t_CreateSecIncCalcGroup "Security incident calculator groups are used to group calculators."). 3. Click New. 4. Fill in the fields on the form, as appropriate. {#t_CreateSecIncCalculator__table_t4d_4bd_5s__entry__2} | Field | Description | |-|-| | Name | The name of the security incident calculator. | | Calculator Group | Name of the group to which this calculator belongs. Note: Creating or changing the calculator group becomes available after you have entered a Name and Table. | | Table | Select the table to be used for this calculator. When you add calculators to tables other than Vulnerability \[sn_vul_vulnerability\] and Vulnerable Item \[sn_vul_vulnerable_item\], you must add business rules and UI Actions to those tables. To see examples: * Navigate to System DefinitionBusiness Rules, and locate the Calculate Severity business rule on the Vulnerable Item \[sn_vul_vulnerable_item\] table. * Navigate to System UIUI Actions, and locate the Calculate Severity UI action on the Vulnerable Item \[sn_vul_vulnerable_item\] table. {#t_CreateSecIncCalculator__ul_ppy_nh1_4v} Also, the vulnerability admin role must be granted full read, write (or save_as_template) capabilities on any table used by a calculator to properly see the values to apply to the template. | | Application | The scoped application to which the calculator belongs. | | Order | The order in which the security incident calculator runs. A calculator with an order entry of 100 runs before a calculator with an order entry of 200. | | Active | Turn the calculator on or off. | | Description | A description of this calculator. | [ ] {#t_CreateSecIncCalculator__table_t4d_4bd_5s} 5. Right-click the form header and select Save. The Conditions and Values to Apply tabs appear. 6. Fill in the fields in the Conditions tab, as appropriate. {#t_CreateSecIncCalculator__table_xl5_43j_tw__entry__2} | Field | Description | |-|-| | Use filter group | Select this check box to use a predefined filter group or [create a new filter group](https://www.servicenow.com/docs/3RBzSVAm1pH7ZDzfSccCRw "Create and use filter groups to locate records from any table on your instance. For example, you can create a group of all computers by the same manufacturer. You can also filter configuration items (CIs) that have similar vulnerabilities or that fall within a particular subnet IP address range.") to define the calculator criteria. | | Filter group | Select the filter group to use for defining a calculator. This field appears only if you selected the Use filter groups check box. | | Use advanced condition | Select this check box to indicate that a script condition is used to determine when this calculator is applied. When you select the check box, an Advanced condition scripting field appears. If you selected the Use filter group check box, this field is hidden. Note: Before you define advanced conditions and write scripts for determining when the security incident calculators are applied, return to the Security Incident Calculators list. Explore the calculator records shipped with the base system. | | Condition | Defines basic filter conditions for determining whether the calculator is used. If you selected either of the Use filter group or Use advanced conditions check boxes, this field is hidden. | [ ] {#t_CreateSecIncCalculator__table_xl5_43j_tw} 7. Click the Values to Apply tab and fill in the fields on the form, as appropriate. You have the choice of creating a script for defining the values to apply to the calculation or defining a template based on fields in the selected table.{#t_CreateSecIncCalculator__table_p2z_4jj_tw__entry__2} | Field | Description | |-|-| | Use script values | Select this check box to define field values with a script. | | Script values | Defines what values to apply the calculations to. This field appears only if you selected the Use script values check box. | | Template | Right-click the form header and select Save. Select the fields and values you want to use for the calculator. | [ ] {#t_CreateSecIncCalculator__table_p2z_4jj_tw} 8. When you have completed all entries, click Submit. ### Understanding security incident calculators {#ariaid-title12} Security incident calculators are used to update record values when pre-defined conditions are met. The calculators are grouped based on the criteria used to determine how the records are updated. The Security Incident Response base system includes the following security incident calculator groups and calculators. Within each group, the first calculator that matches the conditions is run. {#c_SecIncCalculators__table_wmy_bbn_2s__entry__3} | Security Incident Calculator Group Name | Calculators included in group | Description | |-|-|-| | Business Impact | Aggregate from Severity Calculators | This calculator delegates to the Security Criticality Calculator that determines criticality by weighing the values of other fields. | | Severity | Business Impacted | This severity calculator defines its selection criteria using a simple condition builder. | | Severity | Critical service affected | This severity calculator defines its selection criteria using an advanced condition. If the configuration item in the security incident is associated with a highly critical business service, the Risk score, Business Impact, and Priority fields are elevated as defined by the calculator. | | Severity | Critical service changes | This severity calculator defines its selection criteria using an advanced condition. If the security incident meets the conditions, a script runs to define what levels the fields are elevated to. If the configuration item in the security incident is associated with a most critical or somewhat critical business service, the Risk score, Business Impact, and Priority fields are elevated as defined by the calculator. | | Severity | Multi-Attack Vectors | This severity calculator defines its selection criteria using a simple condition builder. If the configuration item in the security incident is associated with web, email, and impersonation attack vectors, the Risk score, Business Impact, and Priority fields are elevated as defined by the calculator. | | Severity | Set priority with category and services | This severity calculator defines its selection criteria using an advanced condition builder. The security incident priority is set to 1 - Critical when the following conditions are met: * The security incident has associated affected services and one of them is critical. * The security incident category is one of the following: * Denial of Service * Spear Phishing * Malicious code activity {#c_SecIncCalculators__ul_lc3_mcm_wx} {#c_SecIncCalculators__ul_kc3_mcm_wx} Note: This calculator is available in the base system when you have the Starter Security Operation pricing tier. | | Severity | Set priority with observables | This severity calculator defines its selection criteria using an advanced condition builder. The security incident priority is set to1 - Critical when the following conditions are met: * The security incident has associated affected services and one of them is critical. * The security incident category is one of the following: * Denial of Service * Spear Phishing * Malicious code activity {#c_SecIncCalculators__ul_ink_bcm_wx} * One of the associated observables or indicators has a sighting count that exceeds two sightings with active indicators (that is, the observables or indicators are confirmed as being bad from multiple sources). {#c_SecIncCalculators__ul_osv_ybm_wx} Note: This calculator is available in the base system when you have the Advanced Security Operation pricing tier and you activate the Threat Feeds plugin. | | User criticality | Get user criticality | This severity calculator defines its selection criteria using a simple condition builder. This severity calculator causes user business criticality to change to 1 - Critical when the Department field is changed to Finance. | | User criticality | Get user group criticality | This severity calculator defines its selection criteria using an advanced condition builder. This severity calculator provides example of a calculator that runs on data in a related list. | [Table 5. Security incident calculators in the base system] {#c_SecIncCalculators__table_wmy_bbn_2s} #### Severity calculators When you create a security incident, the Risk score, Business Impact, and Priority fields contain default values. When you save the incident, a business rule automatically validates the information in the security incident against conditions defined in each of your active severity calculators. They are validated one security calculator at a time, in the order defined by the Order field in each calculator. If information in the security incident matches the conditions defined in one of the calculators, the severity field values are updated accordingly to the rules set up in the calculator. For example, assume that you create a security incident for an affected CI, and the CI is highly critical. When the security incident is saved, the CI information is compared to the conditions defined in the severity calculators. When the security incident is validated against the Critical service affected severity calculator, the severity fields are automatically updated, and a message similar to the following appears at the top of the security incident. ![Messages at top of security incident]() You can use these severity calculators as is or you can edit them to more closely meet the needs of your business. For example, if you want to identify web and email threats that are specific to the Finance business unit, you can change the conditions of the Multi Attack Vectors calculator: * \[Attack Vector\] \[contains\] \[Web\] * \[Attack Vector\] \[contains\] \[Email\] * \[Business Unit\] \[contains\] \[Finance\] {#c_SecIncCalculators__ul_q1r_bww_tt} You can also update the severity values in an existing security incident at any time by opening the record and clicking the Calculate Severity related link. #### Security incident risk score calculators The Set priority with category and services and Set priority with observables calculators are used to calculate a risk score for a security incident. #### User criticality calculators The two calculators in the User criticality group (Get user criticality and Get user group criticality) provide examples of how you can drive criticality based on criteria defined in a user record or based on the group to which a user belongs. They can be edited as needed, or new user criticality calculators can be created. The Get user criticality calculator causes user business criticality to change to 1 - Critical when the Department field is changed to Finance. The Get user group criticality calculator causes user business criticality to change to 1 - Critical when the user is added to the Database group. Note: Get user group criticality is an example of a calculator that runs on data in a related list. If you want to add more groups to initiate a criticality change, add a comma-separated list of group sys_ids in the first line of the script. Example: `var CRITICAL_GROUPS = [group1_sys_id, group2_sys_id, group3_sys_id]`. #### Security incident risk score calculations {#ariaid-title13} The risk score is calculated as an arithmetic mean that represents the risk based on the priority of a security incident, the type of security incident (Denial of Service, Spear Phishing, or Malicious code activity), and the number of sources that triggered a failed reputation score on an indicator. The risk score aids in prioritizing security incident work for the analysts. Important: If you want to use the new Risk Score Calculator, refer to [Define the new Risk Score Calculator Rules](https://www.servicenow.com/docs/s5AXv7Ymrh9Hqcy4Y~Pi9g "Use the new Risk Score Calculator to define and calculate the risk score of security incidents based on the user-defined criteria, which provide a transparent intelligence scoring of security incidents. The risk score is auto-calculated for the security incident records."). The Set priority with category and services and Set priority with observables [security incident calculators](https://www.servicenow.com/docs/YXyWDiYQPHq7PralL~8YdQ#c_SecIncCalculators "Security incident calculators are used to update record values when pre-defined conditions are met. The calculators are grouped based on the criteria used to determine how the records are updated.") are used to calculate a risk score for a security incident. Additionally, the following business rules trigger automatic calculation of risk scores: * Calculate Severity * Update risk score * Update SI risk score {#si-risk-score-calculations__ul_ccz_5fw_1y} Note: The risk calculator available in the base system depends on your Security Operations pricing tier. When you look at a list of security incidents in the base system, notice the Risk score column.Figure 1. Security Incidents The risk score is calculated using weights defined in Risk score configuration.Figure 2. Risk score configuration For example, if a security incident has a Business impact set to 2-High and a Priority set to 3-Moderate, the respective weights in the Risk Score Weights table are looked up and calculated thus: Security Incident Business Impact with a value of 2 = a weight of 60. Security Incident Priority with a value of 3 = a weight of 40. (60 + 40)/2 = a risk score of 50. The position of the security incident in the security incident list is then re-ordered based on its updated risk score. If, in the example above, the Business impact or Priority of the security incident are changed, the risk score is recalculated, and the changes are reflected in the work notes. Figure 3. Work notes The work notes are updated when the following fields are changed (causing the risk score to be updated): * Business impact on the Security Incident form * Priority on the Security Incident form * Severity on the Security Incident form (hidden by default) * Business impact on the Affected Users related list * Business impact on the Affected Services related list * Business impact on vulnerabilities on the Vulnerable items related list {#si-risk-score-calculations__ul_slr_ksr_yx} Additionally, the work notes are updated in the following situations: * When an association between affected users and a security incident is created or modified * When an association between affected services and a security incident is created or modified * When an association between vulnerable items and a security incident is created or modified {#si-risk-score-calculations__ul_ywx_xgw_1y} Work notes are also updated whenever Update All Risk Scores and Clear All Risk Scores on the [Risk Score Weights](https://www.servicenow.com/docs/YXyWDiYQPHq7PralL~8YdQ#maintain-risk-score-weights "The risk score weights used to calculate risk scores in security incidents can be removed or updated on an individual basis. They can also be removed or updated for all security incidents. The ability to remove them from security incidents is useful when changing weight values.") form are clicked. ##### Maintain risk score weights {#ariaid-title14} The risk score weights used to calculate risk scores in security incidents can be removed or updated on an individual basis. They can also be removed or updated for all security incidents. The ability to remove them from security incidents is useful when changing weight values. ###### Before you begin Role required: sn_sec_cmn.admin Note: Users with the sn_si.read role can view the risk score configuration in Security Incident Response. ###### Procedure 1. Navigate to AllSecurity IncidentSetupRisk Score configuration. Note: Users with the sn_si.read role can view the risk score configuration by navigating to Security IncidentAlerts \& EventsRisk Score Configuration. 2. To add a new risk score weight, click New and enter information in the fields. {#maintain-risk-score-weights__table_t4d_4bd_5s__entry__2} | Field | Description | |-|-| | Type | Select the type of risk score you are defining. | | Value | Specify the value associated with the selected type. If multiple values are available for the type, you may want to define multiple risk score weight records. Example: Security Incident Priority with a value of 1, Security Incident Priority with a value of 2, and so forth. | | Weight | The weight associated with the selected type/value pair. Valid entries are between 0 through 100, with 0 being the lowest weight and 100 the highest. | [ ] {#maintain-risk-score-weights__table_t4d_4bd_5s} 3. Click Submit. 4. Perform any of these steps, as needed. * To clear a risk score weight record, open it from the list and click Delete. * To clear all risk score weight records, click Clear All Risk Scores. * To update all risk score weight records, click Update All Risk Scores. {#maintain-risk-score-weights__ul_yh4_x4h_xx} ## Create a Security Incident Response SLA {#ariaid-title15} You can define a Service Level Agreement (SLA) for Security Incident Response. ### Before you begin Role required: sn_si.admin ### Procedure 1. Navigate to AllSecurity IncidentSetupSLAs. 2. Click New. For field descriptions and detailed instructions, see [Create an SLA definition](https://www.servicenow.com/docs/access?context=t_CreateAnSLADefinition&version=yokohama&pubname=yokohama-it-service-management&ft:locale=en-US). {#t_CreateSecurityIncidentSLA__steps_jdj_pnj_ks} ### Repair security incident SLAs {#ariaid-title16} You can repair SLA records to ensure that SLA timing and duration information is accurate. #### Before you begin Role required: sn_si.basic #### Procedure 1. If it is not already open, open the security incident you want to repair SLAs for. 2. Click the form header context menu and select Repair SLAs: 3. Click OK in the Warning confirmation box. For more information, see [Repair SLAs](https://www.servicenow.com/docs/access?context=c_RepairSLAs&version=yokohama&pubname=yokohama-it-service-management&ft:locale=en-US). {#repair-si-slas__steps_sg1_nfk_wz} ## Create a Security Incident Response runbook {#ariaid-title17} A runbook is an association between a published knowledge article and a specific task. While you are performing the task, a knowledge article in the runbook automatically opens, providing information pertinent to the task. ### Before you begin There must be existing knowledge articles in the Security Incident Response Runbook knowledge base. When you [create a security incident knowledge article](https://www.servicenow.com/docs/Mly7ii57tq4aNpLnOidRkA "As you work with security incidents and response tasks, knowledge articles automatically display to provide pertinent information about the task you are performing. Your organization can create and maintain articles in the security incident knowledge base."), be sure to select Security Incident Response Runbook in the Knowledge base field. After you publish the article, you can click the Create Runbook button. Role required: sn.si.knowledge_admin ### About this task You can use runbooks during the security incident or response task creation processes, or you can associate the knowledge base articles in a runbook with tasks in the playbook. ### Procedure 1. Navigate to AllSecurity IncidentManual RunbookCreate New Runbook. 2. Fill in the fields, as appropriate. {#create-runbook__table_qfl_nwk_cp__entry__2} | Field | Description | |-|-| | Knowledge article | Select a knowledge article to include in the runbook. | | Active | Check the box to make the runbook available from the Filter Navigator. | | Use filter group | Select this check box to use a predefined filter group or [create a new filter group](https://www.servicenow.com/docs/3RBzSVAm1pH7ZDzfSccCRw "Create and use filter groups to locate records from any table on your instance. For example, you can create a group of all computers by the same manufacturer. You can also filter configuration items (CIs) that have similar vulnerabilities or that fall within a particular subnet IP address range.") to define the runbook criteria. | | Filter group | Select the filter group to use for defining a runbook. This field appears only if the Use filter groups check box is selected. | | Table | Select either Security Incident \[sn_si_incident\] or Security Incident Response Task \[sn_si_task\]. If you selected the Use filter group check box and selected a filter group, this field defaults to the table associated with the selected filter group. | | Condition | Set the conditions that connect this runbook to the incident or task. If you selected the Use filter group check box and selected a filter group, the Condition fields are not displayed. | [ ] {#create-runbook__table_qfl_nwk_cp} 3. Right-click the form header and select Save. The Knowledge Article Details tab and a series of buttons appear. 4. To view the details of the runbook, click the Knowledge Base Details tab. 5. To see the knowledge article as it would appear to the user, click View Article. 6. To [edit the details of the knowledge article](https://www.servicenow.com/docs/access?context=create-knowledge-article&version=yokohama&pubname=yokohama-servicenow-platform&ft:locale=en-US), click Edit Article. {#create-runbook__steps_irt_3yj_fw} ## Create rules to validate user-reported phishing attacks {#ariaid-title18} When your employees receive emails that appear to be phishing attacks, they can report them to you using a phishing email address. The suspicious email is validated using rules defined by your organization. ### Before you begin Before email matching rules can be used to identify potential phishing attacks, define an email address to which emails forwarded from your employees would be sent for processing. You have the following options for defining this email address (assuming your company email domain is acme.com): * Define an email address such as acme+phishing@service-now.com. The +phishing tag is supported by SMTP to enable filtering and your instance can receive emails sent to it. * Define an email address, such as phishing@acme.com (your Exchange mailbox), which in turn forwards it to acme+phishing@service-now.com (your instance mailbox defined through a mail forwarding rule). {#create-email-matching-rules__ul_vwj_nwn_2db} Role required: sn_sec_cmn.write ### About this task When an employee encounters a suspicious email, they should forward it as an attachment to your phishing email address. If the attached email matches a rule defining a threat, a security incident is created. ### Procedure 1. Navigate to AllSecurity OperationsEmail ProcessingUser Reported Phishing. 2. Click New. 3. Fill in the fields, as needed. {#create-email-matching-rules__table_uwz_yvn_2db__entry__2} | Field | Description | |-|-| | Name | Name for this email matching rule. For example, User Reported Phishing. | | Conditions | Use the [condition builder](https://www.servicenow.com/docs/access?context=c_ConditionBuilder&version=yokohama&pubname=yokohama-platform-user-interface&ft:locale=en-US) to validate whether an email sent to your company phishing email address is a phishing attack. See the following example. | [Table 6. Email Matching Rules form] {#create-email-matching-rules__table_uwz_yvn_2db} 4. Click Submit. ### Example This example shows a matching rule for handling user-reported phishing.Figure 4. Example of Email matching rule *[\>]: and then