---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable protected tables plugin

# Enable protected tables plugin {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Enable protected tables plugin

TheEnable protected tables pluginenhances security by preventing high-privilege users on a ServiceNow instance from tampering with critical log tables.
This protection helps maintain the integrity of audit and security logs, which is essential for forensic investigations and detecting malicious activity.
Show full answer Show less  
Protection is controlled by the system property **com.glide.security.protectedtable.enabled** . When set to **true** through the guided activation flow, it activates the Protected Tables plugin to safeguard specified logging tables.

## Key Features

* **Protected tables:** By default, the plugin protects key logging tables including `syslog`, `syslogtransaction`, `sysoutboundhttplog`, `sysevent`, `sysaudit`, `syspushnotification`, `protectedtableconfiguration`, and `syslogappscope`.
* **Controlled activation:** Only users with the `securityadmin` role can enable protection using the guided activation flow. Directly changing the property outside this flow is not recommended.
* **Extendable protection:** Customers can configure additional tables and specify insert, update, and delete protection rules within the `protectedtableconfiguration` table.
* **Security enforcement:** Attempts to create, update, or delete records in protected tables are evaluated and may be blocked or logged based on the configured protection level for each table.
* **Exception:** Insert operations on the `sysevent` table are never blocked or logged due to normal system processing requirements.

## Key Outcomes

* **Improved audit integrity:** Prevents unauthorized modification or deletion of critical logs, ensuring reliable audit trails for security incident detection and investigation.
* **Risk mitigation:** Reduces the risk of attackers with maintenance privileges tampering with logs to hide malicious activity.
* **Impact on integrations and business rules:** Any existing processes that modify protected tables may fail once protection is enabled, so customers should review and adjust accordingly.
* **Security rating:** The protection addresses a medium-severity security risk (CVSS score 4.0) related to audit log tampering.

## Activation Best Practices

* Use the guided activation flow within ServiceNow to enable the plugin to ensure proper configuration and role-based activation.
* Verify the protection levels configured for each table on your instance since they may vary depending on plugin installation duration.
* Plan for potential failures in integrations or business rules that interact with protected tables after enabling this feature.  
Use the com.glide.security.protected_table.enabled property to prevent higher privilege users from tampering with log tables.
When the com.glide.security.protected_table.enabled system property is set to true, The Protected Tables plugin is utilized to prevent higher privilege users on an instance from tampering
with log tables. The following logging tables will have special protections when this property is set to true:

* syslog (config not modifiable)
* syslog_transaction
* sys_outbound_http_log
* sysevent
* sys_audit
* sys_push_notification
* protected_table_configuration (config not modifiable)
* syslog_app_scope

{#sc-enable-protected-tables-plugin__ul_xz5_4tz_43c}

To enable table protection through the guided activation flow:

* Navigate to the Protected Tables plugin's guided activation flow.
* Complete the activation process to enable table protection. Only users with the security_admin role can activate this control.

{#sc-enable-protected-tables-plugin__ul_hvb_y2y_gkc}  
Important:  
Don't turn on this control by directly editing the com.glide.security.protected_table.enabled property outside that guided activation flow. Default protected tables: syslog, syslog_transaction, sys_outbound_http_log, sysevent, sys_audit, sys_push_notification, protected_table_configuration, syslog_app_scope.

To extend protection to additional tables, configure insert, update, and delete protection rules for each
additional table and operation in the protected_table_configuration list.

## More information {#sc-enable-protected-tables-plugin__section_wc1_cqn_phc}

{#sc-enable-protected-tables-plugin__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.security.protected_table.enabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | false |
| Fallback value | false |
| Category | [Error handling and logging](https://www.servicenow.com/docs/6IiaQ2VC~8mgbeGyGuLaKw "The error handling and logging category addresses the quality and verbosity of logged information exposed to stakeholders.") |
| Security risk | * Severity score: 4.0 * CVSS rating: Medium * Security risk details: When turned off (the default), Protected Tables protections don't apply, allowing maintenance-role users to modify or delete critical audit and security logs without detection. An attacker with maintenance credentials could tamper with syslog, sys_audit, and sysevent entries to cover malicious activity and evade forensic investigation. Disabling this property compromises the audit trail needed to detect and investigate security incidents. {#sc-enable-protected-tables-plugin__ul_g1g_3sf_xwb} |
| Functional impact | Enabling the com.glide.security.protected_table.enabled property causes create, update, and delete attempts on tables in the Protected Table Configuration list to be evaluated. Depending on that table's configured protection level, the attempt is blocked, logged, or ignored. The level shipped per table is not fixed. It depends on how long the Protected Tables plugin has been installed, so confirm the actual values on your instance rather than assuming a table is blocking. One exception holds everywhere: insert attempts on sysevent are never blocked or logged, since normal processing inserts sysevent records continuously. A refused attempt shows the message `Modifications to '<table>' have been refused due to the Protected Table configuration. Please contact your system administrator.` Any integration or business rule currently writing to or deleting from a blocking table will start failing once this property is enabled. |
| Dependencies and prerequisites | None |
[ ]

{#sc-enable-protected-tables-plugin__table_ajc_b43_3kb}