Security incidents created from events and alerts
Summarize
Summary of Security Incidents Created from Events and Alerts
This functionality enables ServiceNow customers to automatically or manually create security incidents from alerts generated by event monitoring tools. As critical security-related events are processed, alerts can be configured to trigger incident creation based on customizable rules, ensuring that security issues are promptly addressed.
Show less
Key Features
- Automated Incident Creation: Utilize the sample alert rule, "Create security incidents from critical alerts," to automatically generate security incidents from critical alerts received from ServiceNow or third-party applications.
- Manual Incident Creation: Users with the Security Admin role can manually create security incidents from suspicious alerts via the "Create Security Incident" button.
- Customizable Alert Rules: Define multiple alert rules with varying conditions to handle different types of security incidents.
- Event Information Requirements: Ensure that incoming events include critical information such as node details, event classification, and descriptions for accurate incident creation.
- Field Management: Automatically set or update fields in a security incident based on incoming event data, including the ability to incorporate custom fields.
Key Outcomes
By implementing this feature, ServiceNow customers can expect enhanced incident management capabilities, leading to quicker responses to security threats. The automatic creation and updating of incidents streamline the workflow and ensure that all relevant event information is recorded, facilitating effective security operations.
As events are imported from alert monitoring tools, they are first processed by Event Management and grouped into alerts. These alerts can be used to create security incidents based on customizable alert rules, or manually reviewed to select those alerts to be investigated as a security incident.
You can find a sample alert rule called Create security incidents from critical alerts in the Alert Rules module of the Event Management application. This alert rule automatically creates security incidents when critical security-related events are received from within ServiceNow or from third-party monitoring applications. After the security incident has been created, it will be updated as new events are received. You can modify the task template in the alert rule to change the initial values for the security incident created by this alert rule. To handle each distinct variety of security incident that you would like to create, you can define other alert rules with different conditions.
Alternatively, if you are a user with the Security Admin role, you can manually create a security incident by clicking the Create Security Incident button from any suspicious alert.
- The node set to the name, IP address, or sys_id of the CI that becomes the affected resource.
- The event classification is set to Security to distinguish them from other IT events.
- The event description, which populates the description of the security incident.
- The additional information can include any extra information that does not fit into the previously listed fields or other event fields, such as the category, attack vectors, return URL, or correlation ID. The format is a
string that lists field names along with their values, using the following JSON format:
{ "fieldName" : "fieldValue", "fieldName" : "fieldValue" }