---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Tamper Detection

# Tamper Detection {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Tamper Detection

Tamper Detection enhances security in your ServiceNow instance by identifying unauthorized changes to quorum control settings.
It uses hash-based message authentication codes (HMAC) to validate these settings and prevent the use of any tampered configurations.
This feature helps maintain the integrity of critical security settings and ensures that key security operations, such as key withdrawals, are only executed when settings are verified as untampered.
Show full answer Show less  

## How Tamper Detection Works

* When quorum control settings are created or changed, an HMAC is generated based on the setting's value.
* Each time these settings are used, tamper detection validates them by checking the HMAC.
* A daily scheduled job runs tamper detection checks and logs any validation failures.
* Key withdrawal operations are blocked if settings fail validation, requiring issues to be resolved before proceeding.

## Monitoring and Notifications

* Validation failures are logged in the node and security logs, including the unique sysid of the affected setting.
* Warnings appear directly on the Quorum Control Policy settings page for any setting that fails validation.
* Security Administrators and Key Management Framework (KMF) Administrators receive notifications when tampering is detected or resolved.

## Resolving Tampering Issues

If tamper detection identifies unauthorized changes, resolution requires contacting ServiceNow support. ServiceNow agents will assist in fixing validation failures. After resolution, administrators are notified that the issue has been cleared.  
Use tamper detection to improve security by detecting unauthorized changes to your
quorum control settings.

## Tamper detection process {#tamper-detect__section_axy_tch_15b}

When enabled, tamper detection validates your quorum control settings by checking for any
unauthorized modifications (tampering). Tamper detection uses hash-based message authentication
code (HMAC).

1. When a setting is changed or created, your instance creates an HMAC. The HMAC is based on the value of the setting (dare_property) record.
2. Whenever your instance uses these settings, tamper detection validates it using the HMAC.
3. If the setting validates successfully, it can be used by the platform, otherwise it cannot.

{#tamper-detect__ol_ix2_vdh_15b}

Tamper detection runs daily on your instance

:   Tamper detection checks your settings for tampering using a daily scheduled job, and reports validation failures in your node and security logs. Tamper detection sends a notification to Security and KMF admins
    for
    validation failures.

Tamper detection runs before executing a key withdrawal

:   Tamper detection also validates your properties when you request a key withdrawal. If your settings do not pass validation, the key withdrawal does not execute. In this case, you must resolve any validation issues
    before
    key withdrawal can compete.

## Identifying tampering {#tamper-detect__section_oyw_wc3_15b}

Tamper detection updates your logs when validation fails.

:   If tamper detection fails to validate any of your quorum control settings, these failures
    appear in your node and security logs. The log entry includes the sys_id of the settings
    (dare_property) record that failed validation.

        2022-06-28 13:45:46 (582) Default-thread-5 B6FAC1F6C3D01110CF37169D7940DD6E txid=231c4d72c310 SEVERE HMAC_VALIDATION_FAILED:The dare_property record with sys_id: 776e3200c3210110900b169d7940dd76 failed HMAC validation

        2022-06-28 13:47:35 (264) Default-thread-8 B6FAC1F6C3D01110CF37169D7940DD6E txid=8e8cc972c310 SEVERE HMAC_VALIDATION_FAILED:The dare_property record with sys_id: 758b3200c3210110900b169d7940dd76 failed HMAC validation

    Logging displays information similar to these examples when validation fails. Successful validations don't appear in the logs.

Tamper detection displays a warning message on your quorum control settings page

:   If a quorum control setting has failed validation, you can see a warning when you view
    the Quorum Control Policy settings page on your instance. The warning includes the sys_id of
    the settings (dare_property) record that failed validation.

Tamper detection sends notifications to users with the Security Admin
and KMF Admin roles

:   If tamper detection fails to validate any of your quorum control settings, your security
    admins and KMF admins receive a notification similar to this example.

## Resolving tampering issues with ServiceNow
support {#tamper-detect__section_yds_zfh_15b}

Important:  
Tamper detection validation failures can only be resolved with assistance of ServiceNow support.

If tamper detection fails to validate any of your quorum control settings, contact ServiceNow support for assistance in resolving the issue. After a support agent has resolved the validation failure, security and KMF admins receive a notification indicating that the issue has been
resolved.