Xanadu |
- Security Incident Response integration with AWS Security Hub
- Security Incident Response supports the AWS Security Hub findings integration. This enables you to ingest AWS Security Hub findings and automatically create security incidents in Security Incident Response.
- Security Incident Response supports a bidirectional exchange of data with AWS Security Hub. SIR ingests findings from AWS Security Hub to create aggregated security incidents. Simultaneously, any
change in a security incident is also updated on the related AWS Security Hub findings.
- Internet Content Adaption Protocol (ICAP) integration for DLP IR
- Internet Content Adaption Protocol (ICAP) integration helps you to track the usage and movement of sensitive data on various platforms.
- Configure and schedule DLP alerts ingestion from the specified Amazon S3 buckets which includes the capability to perform the delta imports to ensure only new or modified data is ingested.
- Display the ingested alerts in the DLP workspace by providing the key details on each alert such as the match content, alert severity, and relevant metadata.
- Download associated evidence files directly from the DLP workspace for further investigation or review.
- Enable users to apply automatic responses based on predefined criteria such as alert escalation, notifications, or enforcement policies.
- Remediate response actions such as blocking or quarantining sensitive data, or sending out alerts to stakeholders.
- Customize and define the severity mapping between ICAP DLP incidents with ServiceNow incidents.
- Playbook for zero-day vulnerability
- Get step-by-step procedure to address and mitigate zero-day threats—vulnerabilities in the software that are unknown to the vendor, leaving systems exposed to attacks.
- Configure Shift Handover Templates
- Provide detailed communication of critical information, tasks, and updates between outgoing and incoming personnel for a seamless transition between shifts by using the Shift Handover feature. Improve operational continuity,
reduce errors, and increase overall efficiency in the workplace.
- Configure Slack chat connector for major security incidents
- View and filter collaboration chat activities on Slack to more efficiently collaborate to resolve major security incidents.
- Playbook for Legal Request
- Get step-by-step guidance on how you can inform the legal team about the latest summary of a major security incident so they can notify the SEC in the 4-day time frame that is required for material breaches.
- Add Zscaler Internet Access URL category lists
- Enable Zscaler approvers to add observables to the list of required approvals or remove them when the Require Approval option is selected.
- Configure how an automatic event is created and MISP event data
- Add security tags during automatic MISP profile configuration.
- Mapping DLP incident status with Netskope
- Provide the mappings between the DLP Incident status in your ServiceNow instance and the Netskope Object status.
- Define the new Risk Score Calculator Rules
- The Risk score configuration in the Security Incident Response workspace has been enhanced with the following capabilities:
- Set up a Risk Score Calculator from either script or condition builders.
- Apply multiple conditions while setting up rule-based scoring.
- Apply weightage to each scoring line. Weights should add up to 100.
- For rule-based scoring, select table fields and values for setting up a condition.
- Capture conditions and scoring via scripts.
- Manually execute risk score calculators to recalculate after making changes.
- Managing MSIM status reports
- Share mobile-friendly Executive Status Reports with users outside your ServiceNow instance, including third-party vendors, other entities, or email distribution lists.
|
Yokohama |
- Process Mining for security incidents
- Identify factors contributing to delays in processing Security Incident Response (SIR) incidents that take a long time to close or resolve by scanning historical SIR records through Process Mining. Time-consuming factors can include multiple reassignments, prolonged hold
times, and periods of inactivity.
- CrowdStrike Next-Gen SIEM integration
-
As a Profile Admin:
- Discover CrowdStrike Next-Gen SIEM detections that are candidates for security incidents and automate the creation of these security incidents.
- Create detection profiles.
- Map CrowdStrike Next-Gen SIEM Detection and Events Fields to SIR security incident fields.
- Filter CrowdStrike Next-Gen SIEM defects.
- Aggregate detections to existing open security incidents so that you don't have to create duplicate security incidents.
- Schedule ongoing detection ingestion.
- Automate CrowdStrike Next-Gen SIEM detection status updates for Security Incident Response.
- Synchronize CrowdStrike Next-Gen SIEM detection comments with SIR Work notes.
- Create an event profile
-
- Enables bidirectional updates and closure synchronization between Splunk ES and Splunk integrations.
- Enables retrieval of historical, and ongoing data including closed events, with an option to pull the closed events into the
ServiceNow
Splunk ES instance.
- Receive updates for the mapped fields in SIR.
- Components installed with Security Incident Response
- A new Profile Admin role (sn_si.ingestion_profile_admin) provides access to configure plugins, and create, edit, delete, and manage profiles for the Splunk, Splunk ES, and Azure Sentinel Integration for Security Operations application.
- Add indirectly linked VITs to CVEs
- Identify all the Third-Party Entities (TPEs) associated with a Common Vulnerabilities and Exposures (CVE) and then calculate and display the total number of vulnerable items (VITs) indirectly linked to those CVEs through the
TPEs by setting the sn_ti.include_cve_vit_indirect_relation property.
- Configure on-call schedules
- As an admin:
- Create a shift and assign or remove members to/from the shift.
- Create/edit on-call schedules for groups.
- View any group’s on-call schedule, including those to which they belong.
As an analyst:
- Specify your availability and preferred contact methods.
- View your on-call schedule and see other members of your shift.
- Configure report templates in Security Incident Response
- As an admin, create report templates that can be used to generate an incident summary or an executive summary for analysis and sharing.
As an analyst, use the templates to generate analyst summary or executive summary
reports for a SIR incident that can be shared over email.
- Security Incident Response conference call integration
- Initiate conference calls using communication channels such as Microsoft Teams, Cisco Webex, or Zoom with customers and peer agents to resolve security incidents over a call by using the SIR conference call feature.
- Enhancements to relationship graphs
-
As an admin:
- Define default child nodes to populate in the relationship graph.
- Configure relationship labels.
As an analyst:
- Add or remove child nodes at the parent node level.
- Save the state of the relationship graph.
- Retrieve updated data.
- Proofpoint integration for Security Operations
- Proofpoint integration for Security Operations supports integration between SOAR (Security Orchestration, Automation, and Response) and Proofpoint Targeted Attack Protection (TAP) software. This integration provides the following benefits:
- Detect and block threats such as business email compromise and tags suspicious emails for tracking, analysis, and audit.
- Import data to automatically create security incidents for email events that are not captured by TAP products.
- Data Loss Prevention Incident Response Analyst Workspace
- Preview the evidence file of the incident from either the Data Loss Prevention analyst workspace or the DLP end user workspace.
|
Zurich |
- Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks
- As a profile admin:
- Create profiles for incident ingestion.
- Filter Cortex XSIAM incidents.
- Map Cortex XSIAM Incident, Alert, and Event fields to SIR security incident fields.
- Aggregate incidents to existing open security incidents to avoid having to create duplicate security incidents.
- Synchronize ServiceNow instance Work notes with Palo Alto Networks XSIAM comments.
- Set up Splunk environment
- The ServiceNow Security Operations Event Ingestion Add-on for Splunk ES enables seamless integration between Splunk and ServiceNow Security Operations, allowing you to send security-related events from Splunk ES to a ServiceNow security incident.
-
LLM-powered SIR integration builder
- With the ServiceNow platform's latest LLM powered integrations, you can create product-ready integration quickly. The LLM-powered integration builder has the following capabilities:
- Automatically generates integration code from a public API documentation.
- Provides guided setup built on existing capabilities.
- Provides easy edit and maintenance of the generated auto code.
- Deny rule for phishing emails
- The security admin can add rules to prevent the conversion of phishing emails such as false positives or low-risk messages into security incidents. Any new phishing email is verified first with the deny rules to avoid
unwanted security incidents.
- MITRE D3FEND framework
- Security administrators can now ingest MITRE D3FEND data. Security analysts can explore MITRE ATT&CK and D3FEND techniques through an interactive, node-based visualization that maps attack techniques, defense techniques,
and related artifacts within a Security Incident Response (SIR) record.
- Update information in security incident related records
- The security analysts can now edit related records such as associated observables, for a security incident directly from the Related Records list view. Security analysts can quickly update the records without leaving their
current context.
- Advanced Work Assignment for SIR
- Use Advanced Work Assignment (AWA) to streamline the security incident assignment process which ensure that critical incidents are handled by the most appropriate and available analysts. This improves overall response times
and efficiency in security operations.
As an admin, configure the following:
- Service channels
- Queues
- Assignment rules
- Presence states
- Rejection reasons
As an analyst, do the following:
- Set your availability
- Accept or reject incoming security incidents
- Prevent duplicate security incidents for IT incidents
- Prevent the creation of duplicate security incidents when ITIL users escalate an IT incident to a security incident, the system by enabling the
sn_si.disable_duplicate_security_incident system property.
- Ingest third-party risk scores
- Factor third-party risk scores into security incident risk calculation by ingesting and mapping those scores for better prioritization of high-risk threats.
- Simplified adding categories and sub-categories for security incidents
- Admin can create categories and subcategories in Security Incident Response Workspace based on threat types, compliance requirements, or reporting needs.
Security analysts can assign these categories and subcategories to security incidents.
- Security incident Details tab
- Include the Functional Impact, Recoverability and Information Impact fields on the Details tab of a security incident to improve triage accuracy, incident
handling efficiency, and executive reporting for calculating the risk score.
- Close multiple security incidents
- Close security incidents in bulk with predefined closure comments or codes to reduce the time that would be spent on manually closing individual incidents. Closure candidates might include multiple incidents with common root
causes such as alert misconfiguration, duplicates, or changes in system behavior.
- Process Mining for security incidents
- Identify factors contributing to delays in processing SIR incidents that take a long time to close or resolve by scanning historical SIR records through Process Mining. Time-consuming factors can include multiple reassignments, prolonged hold times, and periods of inactivity. Use analysis methods to identify these factors such
as multi-hop analysis or bottleneck analysis.
- Send Observables to TISC
- Add metadata to the observables such as confidence score, Traffic Light Protocol value, notes and TISC tags before sending them to TISC.
- Add indirectly linked VITs to CVEs
- In MITRE-ATT&CK framework, identify all third-party entities (TPEs) associated with common vulnerabilities and exposures (CVEs) and then calculate and display the total number of vulnerable items (VITs) indirectly
linked to those CVEs through the TPEs by setting the sn_ti.include_cve_vit_indirect_relation system property.
- Configure on-call schedules
- As an admin, manage on-call schedules through the following activities:
- Create a shift and assign or remove members to or from the shift.
- Create and edit on-call schedules for groups.
- View any group’s on-call schedule.
As an analyst, track your on-call responsibilities through the following activities:
- Specify your availability and preferred contact methods.
- View your on-call schedule.
- See other members of your shift.
- Users accessing the same incident
- When you open an incident, the initials of all the users currently accessing the same incident are displayed to avoid conflicts.
- Universal search field for linking observables
- Search across all the field values of the associated observables for an incident.
- CrowdStrike Next-Gen SIEM integration
-
As a Profile Admin:
- Discover CrowdStrike Next-Gen SIEM detections that are candidates for security incidents and automate the creation of these security incidents.
- Create detection profiles.
- Map CrowdStrike Next-Gen SIEM Detection and Events Fields to SIR security incident fields.
- Filter CrowdStrike Next-Gen SIEM defects.
- Aggregate detections to existing open security incidents so that you don't have to create duplicate security incidents.
- Automate CrowdStrike Next-Gen SIEM detection status updates for Security Incident Response.
- Synchronize CrowdStrike Next-Gen SIEM detection comments with SIR Work notes.
- Create an event profile
-
- Enables bidirectional updates and closure synchronization between Splunk ES and Splunk integrations.
- Enables retrieval of historical, and ongoing data including closed events, with an option to pull the closed events into the
ServiceNow
Splunk ES instance.
- Receive updates for the mapped fields in SIR.
- Components installed with Security Incident Response
- A new Profile Admin role (sn_si.ingestion_profile_admin) provides access to configure plugins, and to create, edit, delete, and manage profiles for the Splunk, Splunk ES, and Azure Sentinel Integration for Security Operations application.
- Enhancements to relationship graphs
-
As an admin:
- Define default child nodes to populate in the relationship graph.
- Configure relationship labels.
As an analyst:
- Add or remove child nodes at the parent node level.
- Save the state of the relationship graph.
- Retrieve updated data.
|
Australia |
Australia Patch 1
- ServiceNow product tiers
- The ServiceNow AI Platform now brings you a new AI experience with three licensing tiers available:
- Foundation: AI basics to deliver insights
- Advanced: AI to boost productivity across relevant use cases
- Prime: Act autonomously with all AI assets, and create your own
Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents.
- CrowdStrike Next-Gen SIEM integration
- As a profile admin:
- Discover CrowdStrike Next-Gen SIEM detections that are candidates for security incidents and automate the creation of these security incidents.
- Create detection profiles.
- Map CrowdStrike Next-Gen SIEM detection and events fields to SIR security incident fields.
- Filter CrowdStrike Next-Gen SIEM defects.
- Aggregate detections to existing open security incidents so you don't have to create duplicate security incidents.
- Automate CrowdStrike Next-Gen SIEM detection status updates for Security Incident Response.
- Synchronize CrowdStrike Next-Gen SIEM detection comments with SIR Work notes.
- Components installed with Security Incident Response
- A new Profile Admin role (sn_si.ingestion_profile_admin) provides access to configure plugins, and enables you to create, edit, delete, and manage profiles for Splunk ES, Splunk Enterprise Event Ingestion, and Microsoft Azure Sentinel integration for Security Operations application.
- Add unmatched affected user for security incidents
- The new “Security Incident Unmatched Users” table captures unmatched affected user records for security incidents, enabling analysts to identify and address discrepancies when user records don't match existing system
records.
- LLM-powered SIR integration builder
- With the latest LLM-powered integrations on the ServiceNow AI Platform, you can create product-ready integration quickly. The LLM-powered integration builder has the following capabilities:
- Automatically generates integration code from a public API documentation
- Provides guided setup built on existing capabilities
- Provides easy edit and maintenance of the generated auto code
- MITRE D3FEND framework
- Security administrators can now ingest MITRE D3FEND data. Security analysts can explore MITRE ATT&CK and D3FEND techniques through an interactive, node-based visualization that maps attack techniques, defense techniques,
and related artifacts within a Security Incident Response record.
- Preserve manual security tags and restrict removal
- Manual security tags applied by analysts are preserved when automatic tagging rules execute on security incidents, avoiding inadvertent tag removal during automated processes. Analysts can no longer manually remove security
tags once applied to an incident, ensuring tag consistency throughout the incident life cycle.
- Assign parent relationships to similar security incidents
- Select multiple similar security incidents from the Similar Security Incidents related list and link them as children to the current security incident using the Link as children button.
- View and update Security Incident Response system properties
- View and update system properties specific to the Security Incident Response workspace directly from the workspace administration settings interface.
- Create quick filters for Security Incidents and Response Tasks lists
- Enable rapid filtering of security incident lists based on predefined criteria by creating and managing quick filters for the Security incident [sn.si.incident] and Response tasks [sn_si_task] tables within the SIR Workspace. Filters are stored in the Quick Filters [sn_si_aw_quick_filters] table.
- Configure auto refresh interval for security incident lists
- Set up refreshing of the security incident list at specified intervals by using the
sn_si_incident.auto_refresh_interval system property. The default refresh rate is five minutes.
- Control external user access to security incident
- SOC users can grant read-only access to specific security incidents for defined external users through the Access to security incident field in the SIR workspace.
- Configure default landing tab for security analysts
- Customize the default landing tab for security analysts and security managers when they open a security incident.
- Compose emails from Response Tasks and Investigation tabs
- Send emails without having to switch tabs by composing them directly from the Response Tasks and the Investigation tabs of a security incident.
- Configure default view for contextual menu
- Determine whether the contextual menu panel for a security incident is expanded or collapsed by default when a security analyst opens a security incident.
|