Quick links section

Xanadu Security Management
Release
xanadu
ft:locale
en-US
ft:publication_title
Xanadu Security Management
ft:clusterId
security
bundleId
security
workflow
Technology
  • Security Operations
  • Exploring Security Operations
  • Now Assist for Security Incident Response
  • Exploring Now Assist for Security Incident Response
  • Supporting information for Now Assist for Security Incident Response
  • Configuring Now Assist for Security Incident Response
  • Configure and activate a skill for Now Assist for Security Incident Response
  • Customize a Now Assist for Security Incident Response skill
  • Inputs and triggers for Now Assist for Security Incident Response
  • Using Now Assist for Security Incident Response to close security incidents
  • Summarize a security incident with Now Assist for Security Incident Response
  • Generate closure notes for a security incident with Now Assist for Security Incident Response
  • Generate recommended actions for a security incident with Now Assist for Security Incident Response
  • Generate recommended actions in UI16 for a security incident with Now Assist for Security Incident Response
  • Generate a post-incident analysis for a security incident with Now Assist for Security Incident Response
  • Generate a post-incident analysis in UI16 for a security incident with Now Assist for Security Incident Response
  • Exploring correlation insights with Now Assist for Security Incident Response
  • Generate correlation insights from the Security Incident Response Workspace with Now Assist for Security Incident Response
  • Generate correlation insights with Now Assist for Security Incident Response
  • Request generative AI skills in the Now Assist panel for Now Assist for Security Incident Response
  • Using AI agentic workflows in Now Assist for Security Incident Response
  • Activate an agentic workflow for Now Assist for Security Incident Response
  • Security Incident Response AI agent collection close security incident use case
  • Close a security incident
  • Security Incident Response AI agent collection Resolve security incident agentic workflow
  • Resolve a security incident
  • Security Incident Response AI agent collection for the Analyze security operations metrics agentic workflow
  • Analyze security operations metrics agentic workflow
  • Now Assist for Vulnerability Response
  • Exploring Now Assist for Vulnerability Response
  • Supporting information for Now Assist for Vulnerability Response
  • Configuring Now Assist for Vulnerability Response
  • Activate an agentic workflow for Now Assist for Vulnerability Response
  • Using agentic workflows in Now Assist for Vulnerability Response
  • Vulnerability Response AI agent collection for the Assess vulnerability exposure agentic workflow
  • Assess vulnerability exposure agentic workflow
  • Vulnerability Response AI agent collection for the Analyze vulnerability remediation status agentic workflow
  • Analyze vulnerability remediation status agentic workflow
  • Unified Security Exposure Management
  • Explore
  • Security Exposure Management Workspace
  • Administration
  • Visualization library
  • Cloud Exposure view
  • Approvals view
  • Finding view
  • Remediation view
  • List view
  • Watch topics
  • Health Dashboard
  • Security Exposure Management workflow
  • Automating prioritization and triaging
  • Associating finding with a configuration item using lookup rules
  • Managing unmatched configuration items (CIs)
  • Managing unclassed hardware
  • Steps to help prevent duplicate or orphaned records after running lookup rules
  • Categorizing findings and discovered items using classification rules
  • Prioritizing vulnerabilities and other findings using roll-up calculators
  • Vulnerability Response Rollup Calculators
  • Assigning findings to remediation teams using assignment rules
  • Removing assignments from findings and remediation tasks
  • Defining your own service level agreements (SLAs) using remediation target rules
  • Deferring findings automatically without manual intervention using exception rules
  • Grouping multiple findings as remediation tasks for easy processing using remediation task rules
  • Closing stale detections and findings automatically using auto-close rules
  • Deleting stale findings automatically using auto-delete rules
  • Controlling the ingestion volume with automatic exclusion
  • Severity mapping for Unified Security Exposure Management
  • Implement
  • Migrate to USEM
  • Installing Security Exposure Management Workspace applications
  • Migration upgrade prerequisites
  • Install Unified Security Exposure Management
  • Download and activate applications
  • Security Exposure Management Workspace Roles
  • Access control lists (ACLs) for administration rules
  • Security Exposure Management Workspace personas and granular roles
  • Assign the Vulnerability Response persona roles using Setup Assistant
  • Manage persona and granular roles for Vulnerability Response
  • Configure rules to manage findings
  • Configuring lookup rules
  • Configuring classification rules
  • Configuring roll-up calculator rules
  • Configuring assignment rules
  • Configuring remediation target rules
  • Configuring an exception rule
  • Create an exception rule
  • Approve an exception rule request
  • Activating an exception rule
  • Reopen an exception rule
  • Update an approved exception rule
  • Delete an exception rule
  • Define fields and weights for the risk rule for Unified Security Exposure Management risk calculators
  • Configuring remediation task rules
  • Configuring auto-close rules
  • Configuring auto-delete rules
  • Configuring exclusion rules
  • Create or edit exclusion rules
  • Approve or reject an unassign request
  • Approval workflow configurations for unassign request
  • Configure Exception Management for Security Exposure Management
  • Request an exception using GRC: Policy and Compliance Management
  • Specify the duration of an exception requested for a remediation task
  • Configure email notifications in Unified Security Exposure Management
  • Configure email templates in Unified Security Exposure Management
  • Configure a severity map in the Security Exposure Management Workspace
  • Configure Visualization library
  • Create a custom widget
  • Update a widget
  • Localize widget titles
  • Integrate
  • Review Unified Security Exposure Management integrations
  • Use
  • Create a dashboard in the Findings view page
  • Reclassify unclassed hardware
  • Bulk edit in the Security Exposure Management Workspace
  • Using bulk edit in the Security Exposure Management Workspace
  • Update the state of records in bulk in the Security Exposure Management Workspace
  • Bulk edit host vulnerable items with patches and solutions
  • Assign records to an assignment group in bulk
  • Remove assignments for host vulnerable items in bulk
  • Request bulk exception in the Security Exposure Management Workspace
  • Bulk edit for false positive in the Security Exposure Management Workspace
  • Close records in bulk in the Security Exposure Management Workspace
  • Use the List view in the Security Exposure Management Workspace
  • Create a customized list of records
  • Create a remediation task manually in the Security Exposure Management Workspace
  • Enable or disable the import of test results for a Qualys test group
  • Modify the severity for a CVE or TPE
  • Use Remediation Effort records
  • Create a remediation effort in the Security Exposure Management Workspace
  • Create a remediation task on-demand from Remediation Effort in the Vulnerability Manager Workspace
  • Create a recurring remediation effort in the Security Exposure Management Workspace
  • Transfer records to remediation efforts in the Security Exposure Management Workspace
  • Approve or reject requests in the Security Exposure Management Workspace
  • Add a compensating control to the library
  • Associate compensating controls with CVEs or TPEs for risk reduction requests
  • Disable or enable risk reduction for a CVE or TPE
  • Examples for remediation task creation in the Security Exposure Management Workspace
  • Exception Management Overview
  • Approver roles required for Security Exposure Management Workspace
  • Questionnaire support in Exception Management via Smart Assessment
  • Questionnaire Configuration form fields
  • Configure an assessment template
  • Use case for False positive or Request Exception Questionnaire
  • Defer a Remediation task
  • Request an extension for a deferred remediation task
  • Request a false positive for a vulnerable item or remediate task
  • Unified Approvals View
  • Add an approver
  • Configure Approval List and Form View
  • Reviewing an Approval Request
  • Review questionnaire to approve or reject requets
  • Employee service center for Vulnerability Response
  • Managing Approvals via the Employee Service Center
  • Reference
  • Security Exposure Management Workspace Components
  • Security Exposure Management Workspace Roles
  • Security Exposure Management Workspace Tables
  • Security Exposure Management Workspace Scheduled Jobs
  • Security Exposure Management Knowledge Base articles
  • Security Exposure Management Workspace remediation task rule examples
  • Migration upgrade reference information
  • Security Exposure Management Workspace Roles
  • Visualization widget fields
  • Re-evaluating the exceptions for selected records in the Security Exposure Management Workspace
  • Vulnerability Response
  • Exploring the Vulnerability Response application
  • Migrating to USEM
  • USEM migration planning
  • Installation of Vulnerability Response and supported applications
  • Vulnerability Response personas and granular roles
  • Vulnerability Response assignment rules overview
  • Vulnerability Response remediation tasks and remediation task rules overview
  • Vulnerability Response remediation target rules
  • Vulnerability classification groups and rules
  • Machine Learning solutions for Vulnerability Response
  • CI lookup rules for identifying configuration items from Vulnerability Response third-party vulnerability integrations
  • Unclassed hardware
  • Unmatched CIs
  • Creating CIs for Vulnerability Response using the Identification and Reconciliation engine
  • Updating CI class for unmatched cloud assets
  • Discovered Items
  • CI changes for discovered items
  • Re-evaluating discovered items
  • Vulnerability Response remediation task and vulnerable item states
  • Vulnerable item age calculation and display
  • Removing assignments from vulnerable items and remediation tasks
  • Vulnerability Response calculators and vulnerability calculator rules
  • Vulnerability Response vulnerable item detections from third-party integrations
  • Vulnerability Solution Management
  • Understanding the Microsoft Security Response Center Solution Integration
  • Understanding the Red Hat Solution Integration
  • Rapid7 solution management
  • Generic framework to ingest data from any solution vendor
  • Patch orchestration with Vulnerability Response
  • Exception Management overview
  • Exception rules overview
  • Exclusion rules overview
  • False Positive overview
  • Questionnaire support in Exception Management via Smart Assessment
  • Configure Assessment template
  • Smart Assessment workflow
  • Questionnaire for False positive or Request Exception
  • Watchdog for Vulnerability Response
  • Change management for Vulnerability Response
  • Software exposure assessment using Software Asset Management (SAM Foundation)
  • Vulnerability Crisis Management
  • Domain separation and Vulnerability Response
  • Service Mapping in Vulnerability Response
  • Vulnerability Response implementation
  • Migrate to USEM
  • Install Vulnerability Response
  • Components installed with Vulnerability Response
  • Configuring Vulnerability Response using the Setup Assistant
  • Assign the Vulnerability Response persona roles using Setup Assistant
  • Manage persona and granular roles for Vulnerability Response
  • Install Vulnerability Response third-party applications using Setup Assistant
  • Importing data with the NVD and CWE integrations and managing third-party libraries
  • Install the Solution Management for Vulnerability Response application
  • Install and configure the Performance Analytics for Vulnerability Response [PA] application
  • Vulnerability Response applications and CSDM tables
  • Create or edit Vulnerability Response assignment rules
  • Create a Vulnerability Response assignment rule using ML
  • Create a Vulnerability Response assignment rule for service support
  • Create or edit Vulnerability Response remediation task rules
  • Define fields and weights for the risk rule for Vulnerability Response Risk Calculators
  • Vulnerability Response Rollup Calculators
  • Create or edit a Vulnerability Response remediation target rule
  • Recalculate RT date
  • Examples
  • Configure installed third-party integrations using the Setup Assistant
  • Configure installed solution integrations for Vulnerability Solution Management using Setup Assistant
  • Configure the MS TVM Vulnerability Integration using Setup Assistant
  • Configure the Qualys Vulnerability Integration using Setup Assistant
  • Configure the Tenable Vulnerability Integration using Setup Assistant
  • Setting up vulnerability solution providers
  • Prepare solution integration checklist
  • Preparing the Common Vulnerability Reporting Framework (CVRF) solution integration
  • Preparing the Common Security Advisory Framework (CSAF) solution integration
  • Configure vulnerability solution providers
  • Common Vulnerability Reporting Framework (CVRF)
  • Import Common Vulnerability Reporting Framework data through file import
  • Configure Connection and Credential aliases
  • Configure a Common Vulnerability Reporting Framework vendor other than Cisco
  • Import Common Vulnerability Reporting Framework data from advisories
  • Import Common Vulnerability Reporting Framework (CVRF) data through CVRF URL
  • Troubleshooting Common Vulnerability Reporting Framework data import
  • Common Security Advisory Framework (CSAF)
  • Import Common Security Advisory Framework data through file import
  • Configure Connection and Credential aliases for the Common Security Advisory Framework (CSAF)
  • Configure a Common Security Advisory Framework vendor other than Red Hat
  • Import Common Security Advisory Framework data from advisories
  • Import Common Security Advisory Framework (CSAF) data through CSAF URL
  • Troubleshooting Common Security Advisory Framework data import
  • Additional Vulnerability Response setup and configuration tasks
  • Quick start tests for Vulnerability Response
  • Run the Automated Test Framework (ATF) test suite for Vulnerability Response
  • Install Vulnerability Assignment Recommendations for Vulnerability Response
  • Configure Vulnerability Assignment Recommendations for Vulnerability Response
  • Create and train a solution definition for Vulnerability Response
  • Create a Vulnerability Response calculator
  • Disable the default vulnerability calculator if not used
  • Create, enable, or, modify Vulnerability Response auto delete rules
  • Add vulnerability significance charts to the Vulnerability Response homepage
  • Define Vulnerability Response email notifications
  • Define Vulnerability Response email templates
  • Create or edit remediation target notifications
  • Configure the Vulnerability Exposure Assessment
  • Configure Exception Management for Vulnerability Response
  • Add an exception approver
  • Configure approval rules for Exception Management
  • Create configurations for an approval rule
  • Create approval levels for Exception Management
  • Exception management workflow versus flow designer
  • Add a false positive approver
  • Configure questionnaire for risk reduction
  • View Vulnerability Response SLAs for remediation tasks
  • Configure watchdog
  • Configure maximum rows in related list
  • Advanced Vulnerability Response configuration tasks
  • Create domain-separated imports for an integration
  • Create and support multiple domains in the background jobs framework
  • Create a Vulnerability Response CI lookup rule
  • Ignore CI classes
  • Filter decommissioned CIs
  • Auto-promote CIs
  • Detection key configurations for Vulnerability Response
  • Run detection key configuration
  • Configure the vulnerable item key
  • Adding proof to Rapid7 vulnerable item keys
  • Delete all your vulnerable item records and related data in Vulnerability Response
  • Filtering within Vulnerability Response
  • Severity mapping for Vulnerability Response
  • Create a Vulnerability Response severity map
  • Define service classifications for Vulnerability Response reporting and related lists
  • Audit selected fields in the vulnerable items table
  • Vulnerability Response background job framework configuration
  • Define background job configurations in Vulnerability Response
  • Advanced parallel processing for background jobs in Vulnerability Response
  • Vulnerability Response integrations
  • Understanding the NVD integrations
  • Preparing for the NVD integrations
  • Configure and run the scheduled job for updating CWE records
  • Install the Vulnerability Response Integration with the NIST National Vulnerability Database
  • Optional NVD integration modification and activities
  • Perform a manual NVD integration import
  • View the (National Vulnerability Database) NVD integration import run status
  • Add CVEs to third-party entries
  • View Vulnerability Response vulnerability libraries
  • CISA Known Exploit Vulnerability (KEV) Integration
  • Preparing for the CISA integration
  • Install the ServiceNow Vulnerability Response Integration with CISA application
  • Understanding the Exploit Prediction Scoring System (EPSS) integration
  • Configure and run a scheduled job to update CVE records with EPSS data
  • Add EPSS Score condition in Risk calculator Business Rule
  • Understanding the Microsoft Threat and Vulnerability Management Vulnerability integration
  • Preparing for the Microsoft Threat and Vulnerability Management Vulnerability Integration
  • Set up Microsoft Azure for the MS TVM integration
  • Install and configure the Vulnerability Response Integration with the MS TVM application using Setup Assistant
  • Data retrieval settings for the Microsoft Threat and Vulnerability Management Integration
  • REST messages for the Microsoft Threat and Vulnerability Management Vulnerability Integration
  • Data transformation for the Microsoft Threat and Vulnerability Management Vulnerability Integration
  • Integration run status chart for the Microsoft Threat and Vulnerability Management Vulnerability Integration
  • Verify the Microsoft Threat and Vulnerability Management integration import run status
  • Split Microsoft TVM detections based on the vulnerability instance to split vulnerable items
  • Understanding the HCL BigFix patch orchestration integration with Vulnerability Response
  • Integrations and dependencies of the Vulnerability Response Patch Orchestration integration with HCL BigFix
  • Prepare for the Vulnerability Response Patch Orchestration integration with HCL BigFix
  • Install the Vulnerability Response Patch Orchestration with HCL BigFix application
  • Configure the Vulnerability Response patch orchestration integration with HCL BigFix
  • Viewing patch data for the Vulnerability Response patch orchestration integration with HCL BigFix
  • Schedule patches with the Vulnerability Response patch orchestration integration HCL BigFix
  • REST messages for the Vulnerability Response patch orchestration integration with HCL BigFix
  • Data transformation for the patch orchestration integration with HCL BigFix
  • Example workflow for the Vulnerability Response patch orchestration integration with HCL BigFix
  • Understanding the Vulnerability Response patch orchestration integration with Microsoft SCCM
  • Integrations and dependencies of the Vulnerability Response Patch Orchestration with the Microsoft SCCM application
  • Prepare for the Vulnerability Response patch orchestration integration with Microsoft SCCM
  • Install the Vulnerability Response Patch Orchestration with Microsoft SCCM application
  • Configure the Vulnerability Response Patch Orchestration with Microsoft SCCM integration
  • Viewing patch data and patch data rollup for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM
  • Schedule patches with the Microsoft SCCM integration with Vulnerability Response
  • REST messages for the Vulnerability Response Patch Orchestration with Microsoft SCCM
  • Data transformation for the Patch Orchestration with Microsoft SCCM Integration
  • Example workflow for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM
  • Understanding the Qualys Vulnerability Integration
  • Preparing for the Qualys Vulnerability Integration
  • Install the Qualys Vulnerability Integration
  • Activate the Qualys scanners
  • Installed components
  • Update configuration items with the network partition identifier for the Qualys Vulnerability Integration
  • Optional Qualys modifications
  • Advanced Qualys configurations and modifications
  • Qualys metadata for vulnerabilities
  • Import additional metadata from Qualys
  • Qualys metadata values for vulnerabilities
  • Set additional filter parameters for Qualys imports
  • Resolving Qualys Vulnerability Integration issues
  • Qualys Vulnerability Integration reporting
  • Qualys integration run status chart
  • Qualys data transformation
  • Dynamic Search List Import
  • Static Search List Import
  • Asset Group Import
  • Appliance Import
  • REST messages
  • Understanding the Rapid7 Vulnerability Integration
  • Preparing for the Rapid7 Vulnerability Integration
  • Set up for the Rapid7 data warehouse Integration
  • Set up for the Rapid7 InsightVM Integration
  • Install the Rapid7 Vulnerability Integration
  • Configure the Rapid7 Vulnerability Integration
  • Filtering by Rapid7 sites
  • Prepend SITE to your Rapid7 InsightVM site tags
  • Deduplicate Rapid7 Vulnerability Integration data warehouse records
  • Rapid7 Vulnerability Integration run status chart
  • View the Rapid7 Vulnerability Integration import runs status dashboard
  • Initiate rescan for the Rapid7 Vulnerability Integration
  • Set additional filter parameters for Rapid7 InsightVM imports
  • Understanding the Shodan Exploit Integration
  • Preparing for the Shodan Exploit Integration
  • Install and configure the Shodan Exploit Integration for Security Operations
  • Set Shodan Exploit Integration import time
  • Perform a manual Shodan exploit import
  • View the Shodan Exploit Integration import run status
  • Understanding the Tenable Vulnerability Integration
  • Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications
  • Tenable.sc integrations with the Vulnerability Response application
  • Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application
  • Preparing for the Tenable Vulnerability Integration
  • Install the Vulnerability Response Integration with Tenable application using Setup Assistant
  • Data retrieval settings for the Tenable Vulnerability Integration
  • REST messages for the Tenable Vulnerability Integration
  • Data transformation
  • Set additional filter parameters for Tenable.io imports
  • Tenable Vulnerability Integration reporting
  • Integration run status chart for the Tenable Vulnerability Integration
  • Initiate rescan for the Tenable.sc integration
  • Initiate rescan for the Tenable.io integration
  • Update configuration items with the network partition identifier for the Tenable Vulnerability Integration
  • Import modifications for the Tenable Vulnerability Integration
  • Split Tenable detections
  • Configure Test Result Granularity
  • Understanding the Atlassian Jira integration with Vulnerability Response
  • Preparing for the Jira Vulnerability Response integration
  • Install the Vulnerability Response Integration with Jira
  • Configure rules in the agile tool configuration
  • Create agile issue manually using list action
  • Create agile issue manually using form action
  • Manually synchronize the status of the Jira issue
  • Configure scheduler to create issues automatically
  • Configure scheduler to update issues automatically
  • Configure scheduler to synchronize the Jira status to ServiceNow automatically
  • Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
  • Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
  • Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
  • Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application
  • Integration run status chart for Prisma Cloud Compute Integration
  • Wiz Vulnerability Response Integration
  • Install
  • Configure
  • Identify Wiz Resource types for import
  • Filter host vulnerabilities
  • Filter container vulnerabilities
  • Configure container vulnerable item keys
  • Filter test results
  • Filter issues
  • Filter host test results
  • Backfill integrations
  • Use
  • Field mapping
  • Manually create a vulnerability integration
  • Define a new vulnerability integration
  • Vulnerability integration script
  • Single call integrations
  • Multiple call integrations
  • Attachments as retrieveData() return values
  • Report processor strategies
  • Use the data source attachment report processor strategy
  • About custom report processor scripts
  • Integration factory script fields
  • Manually run a vulnerability integration
  • Manual ingestion of vulnerabilities
  • Ingest vulnerabilities manually
  • Verify manual integration run
  • Configure auto-close manual detections
  • Verify upload status
  • Template for manual ingestion of vulnerabilities
  • Vulnerability Response remediation overview
  • Verify successful completion of Vulnerability Response integration imports
  • View Vulnerability Response vulnerable item detection data
  • Verify Vulnerability Response vulnerable item detection data on integration run (VINTRUN) records
  • Viewing patch data and scheduling patches in Vulnerability Response
  • Patch data and state rollup for patch orchestration in Vulnerability Response
  • View patches without solutions in Vulnerability Response
  • Viewing patch orchestration data on the Vulnerability Response dashboards
  • View a solution
  • Create a vulnerability solution
  • Manually exclude solutions from third-party records or vice versa
  • Triage vulnerabilities automatically
  • Edit vulnerable items in bulk in Vulnerability Response
  • Ungrouped Vulnerability Response vulnerable items
  • View ungrouped Vulnerability Response vulnerable items
  • Manually add a vulnerable item to a remediation task
  • Remove assignments from vulnerable items and remediation tasks
  • Approve or reject an unassign request in Vulnerability Response
  • Automatic closing of vulnerable items and detections
  • Working with retired configuration items
  • Automatically close vulnerable items related to retired CIs
  • Closing stale detections in Vulnerability Response
  • Automatically close stale detections in Vulnerability Response
  • Create auto-close rules
  • Reclassify unclassed hardware
  • Manually create a remediation task in Vulnerability Response
  • Add users to the Vulnerability Response group
  • Manage individual vulnerable items manually
  • Create Vulnerability Response vulnerable items
  • Defer a vulnerable item
  • Request an extension for a deferred vulnerable item
  • Refresh Vulnerability Response vulnerable items
  • Identify and escalate security issues in third-party software
  • Identify and escalate security issues using NVD
  • Identify and escalate security issues using CWE
  • View the remediation target status of a Vulnerability Response vulnerable item
  • Working with unmatched CIs
  • View and reclassify unmatched configuration items
  • Reconcile unmatched discovered items
  • Reapply CI lookup rules on selected discovered items
  • Reapply CI Lookup Rules Enhancements
  • Steps to help prevent duplicate or orphaned records after running Vulnerability Response CI lookup rules
  • De-duplicating existing configuration items
  • Working with unmatched CIs
  • Resolve remediation tasks
  • Defer a Remediation task
  • Request an extension for a deferred remediation task
  • Close a remediation task
  • Identifying duplicate vulnerable items from multiple scanners
  • Automatically resolve duplicate vulnerabilities
  • Create and edit a classification group
  • Create and edit a classification rule
  • Apply a rule to an existing vulnerability
  • Deactivate or delete a classification rule
  • Create an exclusion rule
  • Change Management tasks for Vulnerability Response
  • Create a change request from a remediation task
  • Associate a remediation task to an existing change request
  • Split a remediation task
  • State synchronization between change requests and remediation tasks
  • Assess your exposure to vulnerable software
  • Viewing assignment recommendations
  • Request assignment group recommendations for a vulnerable item
  • Request assignment group recommendations for multiple vulnerable items
  • Request assignment group recommendations for a remediation task
  • Requesting and approving an exception
  • Request an exception for a vulnerable item
  • Request an exception for a remediation task
  • Request a bulk exception
  • Request an exception using GRC: Policy and Compliance Management
  • Request a bulk exception using GRC: Policy and Compliance Management
  • Approve or reject an exception request in Vulnerability Response
  • Working with an exception rule
  • Create an exception rule
  • Approve an exception rule request
  • Activating an exception rule
  • Request an extension for an exception rule
  • Reopen an exception rule
  • Update an approved exception rule
  • Delete an exception rule
  • Marking and approving a false positive
  • Mark as a false positive
  • Bulk edit for false positive
  • Approve or reject a false positive
  • Analytics and Reporting Solutions for Vulnerability Response
  • Using the default Vulnerability Response dashboards
  • Platform Analytics Solutions for Vulnerability Management
  • Vulnerability Management CISO dashboard
  • Configure the Scan Coverage reports
  • Configure the PA indicators for the CISO Dashboard
  • SecOps Vulnerability Response Health dashboard
  • Modifying the threshold values
  • Vulnerability Management (PA) dashboard
  • View Performance Analytics for Vulnerability Response [PA] reports in real-time
  • View the Performance Analytics indicators for Vulnerability Response [PA]
  • Aggregated reports framework
  • Configure an aggregation for source data
  • Run multiple aggregations simultaneously
  • Configure the number of aggregations that can run simultaneously
  • Create a report using an aggregation
  • Vulnerability Response reference information
  • Implementation checklist for the Vulnerability Response application
  • Vulnerability Response remediation task states
  • Detections, remediation tasks, and vulnerable item states
  • Remediation tasks and vulnerable item states
  • State roll-up and roll-down scenarios
  • Remediation task state for Vulnerable Items (VITs) in multiple groups
  • Additional settings for domain separation
  • Discovered Items form fields
  • Vulnerability Response vulnerability form fields
  • Remediation target rule fields
  • Remediation task form fields
  • Questionnaire Configuration form fields
  • Vulnerability Response vulnerable item form fields
  • Solution form fields
  • Approval workflow configurations for unassign request
  • Vulnerability Response remediation task rule examples
  • Risk score calculation example for Vulnerability Response
  • Error handling for detections
  • Mobile experience for Vulnerability Response
  • Set up checklist for the Vulnerability Response Mobile app
  • Log in to the Vulnerability Response Mobile app
  • View, assign, and edit remediation tasks with the Vulnerability Response Mobile app
  • View, reassign, and edit remediation tasks assigned to you with the Vulnerability Response Mobile app
  • Search for remediation tasks with the Vulnerability Response Mobile app
  • Filter records with the Vulnerability Response Mobile app
  • Vulnerability Response Orchestration
  • Scan vulnerability workflow
  • Scan vulnerability item workflow
  • Variables for Create Scan Record for Vulnerabilities activity
  • Application Vulnerability Response
  • Exploring Application Vulnerability Response
  • Configuring Application Vulnerability Response
  • Configure Application Vulnerability Response
  • Verify that the scheduled job for updating CWE records is running
  • Verify that the scheduled job for updating NVD records is running
  • Activate Application Vulnerability Response Integrations
  • Define Application Vulnerability Response email notifications
  • Create or edit remediation target notifications in Application Vulnerability Response
  • Exception Management in Application Vulnerability Response
  • Configure Exception Management for Application Vulnerability Response
  • Configure approval rules for Exception Management
  • Deferring remediation in Application Vulnerability Response
  • Add an exception approver for Application Vulnerability Response
  • Requesting and approving an exception in Application Vulnerability Response
  • Request an exception for an application vulnerable item
  • Request an exception for application vulnerabilities using GRC: Policy and Compliance Management
  • Request an exception for an application remediation task
  • Approve exception rules and exception rule extension requests in Application Vulnerability Response
  • Define policy reason mapping
  • Request an extension for an exception rule in Application Vulnerability Response
  • Request an extension for a deferred remediation task in Application Vulnerability Response
  • Request an extension for a deferred application vulnerable item in Application Vulnerability Response
  • Create, delete, and cancel an exception rule for Application Vulnerability Response
  • Application Vulnerability Response remediation tasks and task rules overview
  • Create, edit, and delete Application Vulnerability Response remediation task rules
  • Create an application remediation task manually in Application Vulnerability Response
  • Create auto-close rules
  • Configure penetration testing
  • Configure sprints for penetration testing
  • Configure assessment types for penetration testing
  • Integrating Application Vulnerability Response with other applications
  • Vulnerability Response Integration with Black Duck
  • Prepare pre-integration tasks for Vulnerability Response Integration with Black Duck
  • Install the ServiceNow Vulnerability Response Integration with Black Duck
  • Configure the Vulnerability Response Integration with Black Duck
  • View the Vulnerability Response Integration with Black Duck import run status
  • Data transformation for the Vulnerability Response Integration with Black Duck
  • Import the project information from the Black Duck integration instance
  • Import Vulnerability Response Integration with Black Duck project versions to the Discovered Applications table
  • Import the application vulnerable items from the Vulnerability Response Integration with Black Duck
  • Set the import times for the Vulnerability Response Integration with Black Duck
  • Include Closed Black Duck application vulnerable items
  • Fortify on Demand Vulnerability Integration
  • Preparing for the Fortify on Demand Vulnerability Integration
  • Install the ServiceNow Vulnerability Response Integration with Fortify on Demand
  • Configure the Fortify on Demand Vulnerability Integration
  • View the Fortify Vulnerability Integration import run status
  • Fortify on Demand Vulnerability modification and activities
  • Perform a manual Fortify application vulnerability import
  • Import data using the Fortify on Demand Vulnerability Integration
  • Include Closed Fortify on Demand application vulnerable items
  • GitHub Application Vulnerability Integration
  • Preparing for the GitHub Application Vulnerability Integration
  • Creating OAuth 2.0 credentials for GitHub Apps - JWT for the GitHub Application Vulnerability Integration
  • Install the ServiceNow GitHub Application Vulnerability Integration
  • Configure the GitHub Application Vulnerability Integration
  • View the GitHub Application Vulnerability Integration import run status and imported repository data
  • View GitHub Application Vulnerability Integration import sets
  • Invicti Vulnerability Integration
  • Prepare for the Invicti Vulnerability Integration
  • Install the ServiceNow Vulnerability Response Integration with Invicti
  • Configure the Invicti Vulnerability Integration
  • Viewing the Invicti Vulnerability Integration import run status and records
  • Invicti Vulnerability Integration state mapping
  • Veracode Vulnerability Integration
  • Preparing for the Veracode Vulnerability Integration
  • Install the ServiceNow Vulnerability Response Integration with Veracode
  • Configure the Veracode Vulnerability Integration
  • View the Veracode Application Vulnerability Integration import run status
  • View Veracode scan summaries
  • Data transformation for the Veracode Vulnerability Integration
  • Veracode Vulnerability Integration modifications and activities
  • Manual ingestion of vulnerabilities for Application Vulnerability Response
  • Upload application vulnerabilities using a template file
  • Verify integration run
  • Verify upload status
  • Tenable Web Application Scanning Vulnerability Response Integration
  • Configure Tenable Web Application Scanning Vulnerability Response Integration using Setup Assistant
  • Import Applications Data from Tenable Web Application Scanning Vulnerability Response Integration
  • Import Vulnerabilities Data from Tenable Web Application Scanning Vulnerability Response Integration
  • Remediating Application Vulnerability Response vulnerabilities
  • View vulnerability libraries
  • Application Vulnerability fields
  • Identify applications in Application Vulnerability Response automatically
  • Create a CI lookup rule
  • Reapplying CI Lookup rules in Application Vulnerability Response
  • Prevent duplicate or orphaned records after running Application Vulnerability Response CI lookup rules
  • Assign application vulnerable items in Application Vulnerability Response automatically
  • Create or edit Application Vulnerability Response assignment rules
  • Removing assignments from Application Vulnerability Response vulnerable items and remediation tasks
  • Calculate risk in Application Vulnerability Response automatically
  • Define fields and weights for the risk rule
  • Create an application vulnerability calculator
  • Map the severity of an application vulnerable item automatically
  • Filtering within Application Vulnerability Management
  • Automate remediation target tracking in Application Vulnerability Response
  • Create or edit application remediation target rules
  • View the remediation target status of an application vulnerable item
  • Close a remediation task
  • Change Management for Application Vulnerability Response
  • Create a change request for Application Remediation task
  • Associate a remediation task to an existing change request
  • Penetration testing
  • Create a penetration test assessment request from existing requests (v19.0)
  • Create a penetration test assessment request (prior to v19.0)
  • Replicate a penetration test request in closed state
  • Create penetration test findings based on assessment requests (prior to v19.0)
  • Create an application vulnerability entry
  • Penetration testing workspace
  • Create a new penetration testing assessment request
  • Create penetration test findings based on an assessment questionnaire
  • Publish the assessment questionnaire
  • Use an assessment questionnaire
  • Penetration Testing Dashboard
  • Penetration Dashboard components
  • Understanding compensating controls for risk reduction in Application Vulnerability Response
  • Platform Analytics Solutions for Application Vulnerability Response
  • Application Vulnerability Management (PA) dashboard
  • My Application Vulnerabilities dashboard
  • Aggregated reports framework for Application Vulnerability Response
  • Application Vulnerability Response references
  • Application Vulnerability Response user groups and roles
  • Components installed with Application Vulnerability Response
  • Application Vulnerable Item (AVI) states
  • Application Vulnerability Response remediation task rule examples
  • Scanned application fields
  • Application Vulnerable Item fields
  • Penetration testing states
  • Managing state mapping for deferrals and false positives in Application Vulnerability Response
  • Application Vulnerability Response references
  • Exception rule example for Application Vulnerability Response
  • Application Vulnerability Response product view
  • Container Vulnerability Response
  • Exploring Container Vulnerability Response
  • Container Vulnerability Response remediation task and container vulnerable item states
  • Configuring Container Vulnerability Response
  • Install Vulnerability Response and Configuration Compliance for Containers
  • Define Container Vulnerability Response email notifications
  • Create or edit remediation target notifications
  • Configure Exception Management for Container Vulnerability Response
  • Configure approval rules for Exception Management
  • Quick start tests for Container Vulnerability Response
  • Run the Automated Test Framework (ATF) test suite for Container Vulnerability Response
  • Integrating Container Vulnerability Response with other applications
  • Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
  • Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
  • Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
  • Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application
  • Wiz Container Vulnerability Integration
  • Remediating container vulnerabilities
  • Container Vulnerability Response calculator rules
  • Container Vulnerability Response assignment rules
  • Container Vulnerability Response remediation target rules
  • Exception management in Container Vulnerability Response
  • Requesting and approving an exception in Container Vulnerability Response
  • Request an exception for a container vulnerable item
  • Request an exception for a container remediation task
  • Request an exception for container vulnerabilities using GRC: Policy and Compliance Management
  • Define a policy reason mapping
  • Approve an exception request in Container Vulnerability Response
  • Defer a container vulnerable item in Container Vulnerability Response
  • Request an extension for a deferred container vulnerable item
  • Working with an exception rule in Container Vulnerability Response
  • Create an exception rule in Container Vulnerability Response
  • Activating an exception rule in Container Vulnerability Response
  • Reopen an exception rule in Container Vulnerability Response
  • Update an approved exception rule in Container Vulnerability Response
  • Delete an exception rule in Container Vulnerability Response
  • Request an extension for a deferred remediation task in Container Vulnerability Response
  • Request an extension for an exception rule in Container Vulnerability Response
  • Marking and approving a false positive container vulnerability item
  • Mark as a false positive in Container Vulnerability Response
  • Approve a false positive
  • Container Vulnerability Response remediation tasks and task rules overview
  • Create, edit, and delete Container Vulnerability Response remediation task rules
  • Create auto-close rules for Container Vulnerability Response
  • Removing assignments from container vulnerable items and remediation tasks
  • Close a remediation task
  • IT Operations Management and pattern discovery
  • Analytics and Reporting Solutions for Container Vulnerability Response
  • Container Vulnerability Response dashboard
  • Aggregated reports framework for Container Vulnerability Response
  • Container Vulnerability Response reference
  • Components installed with Container Vulnerability Response
  • Container Vulnerability Response glossary
  • Container Vulnerable Item form fields
  • Prisma Cloud Compute Configuration form
  • Request Exception form
  • Exception Rule form
  • Domain separation and Container Vulnerability Response
  • Configuration Compliance
  • Exploring Configuration Compliance
  • Configuration Compliance imported data
  • Configuration Compliance discovery
  • Configuration Compliance correlation
  • Discovered Items for Configuration Compliance
  • CI changes for discovered items for Configuration Compliance
  • Reconcile unmatched discovered items for Configuration Compliance
  • Reapply CI lookup rules on selected discovered items for Configuration Compliance
  • The Tenable Vulnerability Integration with Configuration Compliance
  • CI Lookup Rules for identifying configuration items from Configuration Compliance third-party vulnerability integrations
  • Deduplicating existing configuration items for Configuration Compliance
  • Creating CIs for Configuration Compliance using the Identification and Reconciliation Engine
  • Configuration Compliance assignment rules overview
  • Removing assignments from Configuration Compliance remediation tasks
  • Configuration Compliance remediation tasks and remediation task rules overview
  • Configuring calculator groups and calculators for Configuration Compliance
  • Configuration Compliance Exception Management overview
  • Configuration Compliance change management
  • Setting up, installing, and configuring the Configuration Compliance application
  • Install Configuration Compliance
  • Components installed with Configuration Compliance
  • Create or edit Configuration Compliance assignment rules
  • Configuration Compliance remediation target rules
  • Configuration Compliance calculator groups
  • Create a Configuration Compliance calculator group
  • Configuration Compliance calculators and calculator rules
  • Define fields and weights for the risk rule
  • Edit risk rollup calculators for Configuration Compliance
  • Create, edit, and reapply risk calculators for Configuration Compliance
  • Examples for Configuration Compliance risk score calculation
  • Create or edit Configuration Compliance remediation task rules
  • Specify the duration of an exception requested for a remediation task
  • Configure Exception Management for Configuration Compliance
  • Add an exception approver for Configuration Compliance
  • Create a Configuration Compliance criticality map
  • Create email notifications
  • Configure approval rules for Exception Management in Configuration Compliance
  • Create configurations for an approval rule in Configuration Compliance
  • Create approval levels for Exception Management in Configuration Compliance
  • Exception management workflow versus flow designer in Configuration Compliance
  • Configuration Compliance integrations
  • Microsoft Defender for Cloud Integration for Security Operations
  • Install and configure Microsoft Defender for Cloud Integration for Security Operations
  • Configuration Compliance imported data for Microsoft Defender for Cloud Integration
  • Understanding the Vulnerability Response Integration with Palo Alto Prisma Cloud
  • Preparing for installing the Vulnerability Response Integration with Palo Alto Prisma Cloud
  • Install and configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application
  • Configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application
  • Verify the Vulnerability Response Integration with Palo Alto Prisma Cloud import run status
  • Data mapping
  • Prisma Cloud REST Messages
  • Qualys
  • Configure PCRS
  • Components installed with the Qualys Integration for Security Operations
  • Update configuration items with the network partition identifier for the Qualys Integration
  • Set Import Filters
  • Resolving Qualys Vulnerability Integration issues
  • Attachments not appearing after import
  • Modify transform maps
  • Check XML attachment property size
  • Data retrieval limitations
  • Qualys Knowledge Base Integration is failing
  • Qualys integration run status chart
  • REST messages
  • Understanding the Tenable Vulnerability Integration
  • Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications
  • Tenable.sc integrations with the Vulnerability Response application
  • Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application
  • Preparing for the Tenable Vulnerability Integration
  • Install the Vulnerability Response Integration with Tenable application using Setup Assistant
  • Data retrieval settings for the Tenable Vulnerability Integration
  • REST messages for the Tenable Vulnerability Integration
  • Data transformation
  • Set additional filter parameters for Tenable.io imports
  • Tenable Vulnerability Integration reporting
  • Integration run status chart for the Tenable Vulnerability Integration
  • Initiate rescan for the Tenable.sc integration
  • Initiate rescan for the Tenable.io integration
  • Update configuration items with the network partition identifier for the Tenable Vulnerability Integration
  • Import modifications for the Tenable Vulnerability Integration
  • Split Tenable detections
  • Configure Test Result Granularity
  • Explore Wiz Test Results and Issues
  • Configuration Compliance remediation
  • Manually create a Configuration Compliance remediation task
  • Manually create a Configuration Compliance remediation task from the Test Results list
  • Create a change request in Configuration Compliance
  • Associate a remediation task to an existing change request
  • Split a remediation task
  • Remove assignments from remediation tasks for you or your groups
  • Approve an unassign request in Configuration Compliance
  • Automatic closing of test results
  • Working with retired configuration items in Configuration Compliance
  • Automatically close test results related to retired CIs
  • Automatically closing stale test results in Configuration Compliance
  • Use Auto-Close Stale Test Results in Configuration Compliance
  • Close a remediation task
  • Requesting and approving an exception for a remediation task
  • Request an exception for a remediation task in Configuration Compliance
  • Request an extension for an exception rule in Configuration Compliance
  • Request an exception for remediation tasks using GRC: Policy and Compliance Management
  • Approve an exception request in Configuration Compliance
  • Define policy reason mappings
  • Analytics and reporting for Configuration Compliance
  • Reporting overview
  • Configuration Compliance dashboard
  • Activate Performance Analytics for Configuration Compliance
  • Viewing the Performance Analytics for Configuration Compliance dashboard
  • Aggregated reports framework for Configuration Compliance
  • Configuration Compliance reference information
  • View Configuration Compliance test groups
  • View Configuration Compliance authoritative sources
  • View Configuration Compliance technologies
  • View Configuration Compliance tests
  • View Configuration Compliance test results
  • View a remediation task
  • Test result and remediation task state transitions in the Configuration Compliance application
  • State synchronization
  • Domain separation and Configuration Compliance
  • Test Results fields
  • Configuration Compliance criticality maps
  • States, precedence, examples
  • Resolving Configuration Compliance import issues
  • Modify Qualys PC Results start date
  • CI lookup rules for Microsoft Defender for Cloud Integration for Security Operations and Palo Alto Prisma Cloud
  • Vulnerability Response Workspaces
  • Patch orchestration with the Vulnerability Response Workspaces
  • Vulnerability Response Workspaces and updates to remediation tasks and remediation task rules
  • Configure the Vulnerability Response Workspaces
  • Vulnerability Manager Workspace
  • Exploring the Vulnerability Manager Workspace
  • Home page in the Vulnerability Manager Workspace
  • Watch Topics page in the Vulnerability Manager Workspace
  • Related items list and visualizations in a watch topic
  • Remediation efforts in the Vulnerability Manager Workspace
  • Life cycles of remediation efforts, remediation tasks, and records in the Vulnerability Response Workspaces
  • Dashboards in the Vulnerability Manager Workspace
  • List page in the Vulnerability Manager Workspace
  • Bulk edit in the Vulnerability Manager Workspace
  • Understanding compensating controls for risk change
  • Analytics and reporting solutions for the Unified Vulnerability Response Dashboard
  • Unified Vulnerability Response Dashboard
  • Monitoring and managing vulnerable items and test results in the Vulnerability Manager Workspace
  • Open search results in Vulnerability Manager Workspace
  • Create and apply filters the summary of active records (VITs, AVITs, CVITs and CTRs)
  • Use watch topics in the Vulnerability Manager Workspace
  • Create a watch topic in the Vulnerability Manager Workspace
  • Edit or delete a watch topic in the Vulnerability Manager Workspace
  • Deactivate or activate a watch topic
  • Use Remediation Effort records
  • Create a remediation effort in the Vulnerability Manager Workspace
  • Create a remediation task on-demand in the Vulnerability Manager Workspace
  • Create a recurring remediation effort in the Vulnerability Manager Workspace
  • Transfer records to remediation efforts in the Vulnerability Manager Workspace
  • Add a compensating control to the library
  • Associate compensating controls with CVEs or TPEs for risk change requests
  • Disable or enable risk change for a CVE or TPE
  • Rescan records and remediation tasks in the Vulnerability Manager Workspace
  • Re-evaluate the remediation properties of the records in the Vulnerability Manager Workspace
  • Use the List view in the Vulnerability Manager Workspace
  • Create a customized list of records
  • Create a remediation task manually from the Vulnerability Manager Workspace
  • Enable or disable the import of test results for a Qualys test group
  • Modify the severity for a CVE or TPE
  • Approve or reject requests in the Vulnerability Manager Workspace
  • Set up email notifications in the Vulnerability Response Workspaces
  • Remediating vulnerable items and test results in the Vulnerability Manager Workspace
  • Using bulk edit in the Vulnerability Manager Workspace
  • Update the state of records in bulk in the Vulnerability Manager Workspace
  • Bulk edit host vulnerable items with patches and solutions
  • Assign records to an assignment group in bulk
  • Remove assignments for host vulnerable items in bulk
  • Request bulk exception in the Vulnerability Manager Workspace
  • Bulk edit for false positive in the Vulnerability Manager Workspace
  • Close records in bulk in the Vulnerability Manager Workspace
  • Request exceptions for remediation tasks and records from the Vulnerability Manager Workspace
  • Request an extension for a deferred vulnerable item in the Vulnerability Manager workspace
  • Vulnerability Manager Workspace reference information
  • Create Watch Topic form fields
  • GRC request exception form fields
  • Generate remediation digest form fields
  • Impact of the compensating controls on risk score and expiration date
  • Examples for remediation task creation in the Vulnerability Manager Workspace and IT Remediation Workspace
  • Re-evaluating the exceptions for selected records in the Vulnerability Manager Workspace
  • IT Remediation Workspace
  • Exploring the IT Remediation Workspace
  • View a workflow example in the IT Remediation Workspace
  • Home page in the IT Remediation Workspace
  • Dashboards in the IT Remediation Workspace
  • List page in the IT Remediation Workspace
  • Using the IT Remediation Workspace
  • Use the email digest in the Vulnerability Response Workspaces
  • Open search results in IT Remediation Workspace
  • Create a list in the IT Remediation Workspace
  • Use records in the IT Remediation Workspace
  • Use remediation task records in the IT Remediation Workspace
  • Assign a remediation task or record to yourself in the IT Remediation Workspace
  • View configuration items with vulnerabilities in the IT Remediation Workspace
  • Create a change request in the IT Remediation Workspace
  • Create a remediation task manually in the IT Remediation Workspace
  • Split a remediation task in the IT Remediation Workspace
  • Request a false positive in the IT Remediation Workspace
  • Request false positive for a set of test results
  • Request an exception in the IT Remediation Workspace
  • Request an exception using GRC: Policy and Compliance Management in the IT Remediation Workspace
  • Request risk change in the IT Remediation Workspace
  • Rescan vulnerable items and remediation tasks in the IT Remediation Workspace
  • Rescan Qualys vulnerable items from the Vulnerability Response workspaces
  • Rescan Rapid7 vulnerable items from the Vulnerability Response workspaces
  • Rescan Tenable.io and Tenable.sc vulnerable items from the Vulnerability Response workspaces
  • IT Remediation Workspace reference information
  • Create change request form fields
  • Request exception form fields for policy exceptions
  • Request exception form fields for risk reduction
  • Explore the Vulnerability Assessment workspace
  • Exploring exposure assessment
  • Exposure assessment by CVE
  • Add CVEs to assess exposure
  • Create VIs for CVEs for exposure assessment
  • Activate or deactivate CVEs for exposure assessment
  • Export impacted CIs for exposure assessment
  • Confidence score calculation example
  • View vulnerable software details
  • Confidence score reference tables for exposure assessment
  • Exposure assessment by software
  • Add software for exposure assessment
  • Create VIs for software for exposure assessment
  • Activate or deactivate software for exposure assessment
  • Export impacted CIs for software in the Vulnerability Assessment workspace
  • Exposure assessment by publisher software
  • Add software by a publisher for exposure assessment
  • Create VIs for software by a publisher for exposure assessment
  • Activate or deactivate software by a publisher for exposure assessment
  • Export impacted CIs for software by a publisher in the Vulnerability Assessment workspace
  • Exploring vulnerability assessment
  • Create a vulnerability assessment record
  • Update the vulnerability assessment auto-flush record
  • Modify the vulnerability assessment record
  • Perform an assessment
  • Assessment tab
  • Overview tab
  • Assign a priority and exposure level to the vulnerability assessment record
  • Add affected CIs to the assessment record
  • Create vulnerable items for the affected CI or affected software component
  • Link the vulnerability assessment record to major security incident in Major Security Incident Management
  • Software Bill of Materials
  • Exploring Software Bill of Materials
  • Exploring supported applications for Software Bill of Materials
  • Configuring Software Bill of Materials
  • Install the supported applications for Software Bill of Materials
  • Configuring the Deps.dev, OSV.dev, and PaCE integrations for Software Bill of Materials
  • Uploading and viewing your SBOM files in the SBOM Workspace
  • Uploading Software Bill of Materials files using a REST API
  • Upload Software Bill of Materials files manually
  • Uploading Software Bill of Materials for DevOps SBOM files
  • Classifying licenses and resolving component licenses in the Software Bill of Materials workspace
  • Classify imported licenses in the Software Bill of Materials Workspace
  • Resolve licenses to components in the Software Bill of Materials Workspace
  • Viewing reports and dashboards in the Software Bill of Materials workspace
  • Review the Home page in the Software Bill of Materials Workspace
  • Reviewing the Components module in the Software Bill of Materials Workspace
  • Creating rules for application vulnerable items in the Software Bill of Materials Workspace
  • View upload status for Software Bill of Materials files
  • Checking a Software Bill of Materials entity for vulnerabilities
  • Components installed with Software Bill of Materials applications
  • Create an application vulnerable item rule in the Software Bill of Materials Workspace
  • Enterprise security case management applications
  • Security Incident Response
  • Understanding Security Incident Response
  • Domain separation and Security Incident Response
  • Security Incident Response setup
  • Install and configure Security Incident Response
  • Download and install the Security Analyst Workspace
  • Components installed with Security Incident Response
  • Other additional Security Incident Response setup tasks
  • Setup Assistant reference
  • Configure the Security Analyst Workspace
  • Set up primary and secondary filters for Security Analyst Workspace
  • Security Analyst Workspace properties
  • Additional Security Analyst Workspace configuration
  • Landing page filter configuration
  • Enable UI Actions
  • Form UI actions
  • Related List configuration
  • Related List UI Actions
  • Form configuration system properties
  • Enable playbooks for analyst selection
  • Troubleshooting Security Incident Response
  • Security Incident Response Platform Analytics Solutions
  • CISO dashboard
  • Security Incident Management Premium dashboard
  • Security Incident Management dashboard
  • Security Incident Explorer dashboard
  • Security Operations Efficiency dashboard
  • Security Incident Response Workspace
  • Exploring SIR Workspace
  • SIR Workspace plugins
  • SIR Workspace features
  • SIR Workspace interface overview
  • Upcoming section
  • View upcoming tasks
  • Quick links section
  • Working with quick links
  • Shift Handover Records section
  • List view in SIR Workspace
  • Personalize a list
  • Assign Security Incidents
  • Close multiple security incidents
  • Assign Response Tasks
  • Report Phish Email
  • Working with quick filters
  • Add or modify quick filters
  • Export Security Incidents or Response Tasks
  • Manage Shift Handover records
  • Configuring SIR Workspace
  • Set up view of SIR Records
  • Configure SI design time investigation
  • Creating View for associated info tables
  • Adding an entry point list
  • Mapping View of the Associate Info to the entry point list
  • Configure each associated list from the view to handle run time data rendering
  • SIR Workspace Related Records
  • Define the new Risk Score Calculator Rules
  • Risk Score Calculator for Additional Related Tables
  • Configure Shift Handover
  • Configure Shift Handover Templates
  • Create shifts through Security Incident Response Workspace
  • Security Incident Response conference call integration
  • Manage Conference Call users and groups
  • Integrate SIR with third-party communication channels
  • Configure report templates in Security Incident Response
  • Create a Report Template in Security Incident Response
  • System properties for reports
  • Duplicate a report template in Security Incident Response
  • Edit a report template in Security Incident Response
  • On-Call scheduling in Security Incident Response
  • Category management in Security Incident Response
  • Create a category
  • Create a subcategory
  • Using SIR Workspace
  • Working with Security Incident Records
  • Security Incident Overview section
  • Security Incident Details section
  • Security incident Details tab
  • SIR Workspace Orchestration
  • SIR Workspace Investigation Canvas
  • Explore Investigation Canvas
  • Unified experience framework for integrations powered by Capability Framework
  • Unified experience capabilities and modal screens
  • Unified Experience example
  • Example 1: Run Threat Lookup
  • Select implementations
  • Example 2: Common Inputs: Sighting Search
  • Example 3: Add specific runtime details inputs to an implementation: Run Additional Actions
  • Security Incident Response Tasks
  • Create a Response Task
  • Security Incident Response Other Records
  • Security Incident Response Post Incident Review
  • Edit Related Records in list view
  • TISC integration within SIR Workspace
  • Send data from SIR Workspace to TISC
  • System properties to send data
  • Add security incident to TISC case
  • Add observables to TISC Case
  • Send Observables to TISC
  • Send Threat Lookup to TISC
  • Send Sighting Search to TISC
  • Send Observable Enrichment to TISC
  • View TISC Context in SIR Workspace
  • Working with TISC Context
  • Add observables to TISC Case
  • View related info from TISC
  • View Enrichment Results
  • Reports in Security Incident Response
  • Create a report
  • Edit a report
  • Delete a report
  • Collaborate using conference call or chat in Security Incident Response
  • Start a conference call in Security Incident Response
  • Add participants to active Conference Call
  • Start a Sidebar chat in Security Incident Response
  • Viewing incident details with a relationship graph
  • Customize a relationship graph
  • Create a relationship graph for an incident
  • MITRE attack and defend technique graph
  • Security Incident Playbook
  • Prerequisites for the Playbooks
  • Rebuilding existing playbooks in Workflow Studio
  • Activity Definitions
  • Example Activity Definition: Send email
  • Create an Activity Action
  • Submit to CSF X Sandbox
  • Sample Playbooks for SIR Workspace
  • Working with MSI Records
  • Propose as Major Security Incident
  • Promote to Major Security Incident
  • Link to Major Security Incident
  • Working with Form UI actions
  • Security Incident Closure workflow
  • Handle security incidents using AWA
  • Viewing SIR Workspace Dashboards
  • View Security Analyst Overview dashboard
  • View Security Incident Explorer dashboard
  • View Security Incident Management dashboard
  • View Security Operations Efficiency dashboard
  • View Security Incident Response Premium KPIs dashboard
  • View Context Sensitive Analytics - SI dashboard
  • View CISO dashboard
  • View CISO Reporting Overview dashboard
  • View Security Incident Manager Overview dashboard
  • View Security Incident Response Health dashboard
  • Security incident creation
  • Security incident manual creation
  • Create a security incident from the Security Incident list
  • Create a security incident from the Security Incident Catalog
  • Create a security incident from an Event Management alert
  • Security incident automatic creation
  • Security incidents created from events and alerts
  • Data imported into security alerts
  • Create security incidents from User Reported Phishing emails
  • Record creation from security incidents
  • Create a change, incident, or problem from a security incident
  • Create a Customer Service case from a security incident
  • Add a security incident to a security case
  • Create response tasks
  • Manage Predictive Intelligence for User Reported Phishing
  • Predictive Intelligence for User Reported Phishing
  • Required components and plugins
  • Final verdict generation for User Reported Phishing
  • Troubleshooting Predictive Intelligence for User Reported Phishing
  • Configure Predictive Intelligence for User Reported Phishing
  • Assigning security analysts
  • Process Mining Workspace for Security Incident Response
  • Create process mining project for security incidents
  • Process Mining use cases for security incidents
  • Managing security incidents and inbound requests
  • Create an inbound request
  • Manage observables
  • Show IoC information for a security incident
  • Create a security incident observable
  • Manage file observables
  • Edit a security incident observable list
  • Add multiple security incident observables
  • Automatic security incident observable log data enrichment
  • Publish observables to a third-party watchlist
  • Manage lookups and scans
  • Submit an IoC Lookup request from a security incident
  • Submit an IoC Lookup request from the Security Incident Catalog
  • Submit a vulnerability scan request from a security incident
  • Submit a vulnerability scan request from the Security Incident Response catalog
  • Manage on-demand orchestration
  • Perform on-demand orchestration from the Security Incident form
  • Perform on-demand orchestration from the Security Incident list
  • Define new on-demand orchestrations
  • Register new Security Operations applications for on-demand orchestration
  • Add information to a security incident
  • Add problems, changes, and incidents
  • Invoke a process dump for an enriched process in Windows
  • View information in a security incident
  • Parent and child security incident relationships
  • View affected items for a security incident
  • View related items for a security incident
  • View enrichment data for a security incident
  • View response task information for a security incident
  • View related events and alerts in security incidents
  • View security incident to customer service case mapping
  • View a Security Incident Response runbook
  • Identify all configuration items affected by a security incident
  • Calculate the severity of a security incident
  • Search for and delete phishing emails
  • Create a security incident knowledge article
  • Escalate a security incident
  • Manage post incident activities
  • Assign post incident review roles
  • Post incident review report
  • Manage Post Incident Review Report
  • Configure an assessment trigger condition
  • Assessment trigger conditions examples
  • Perform a questionnaire-based post incident review
  • Create post incident review questionnaire categories
  • Compose post incident review questions
  • Create PIR assignment rules
  • Close security incidents
  • Add closure information to a security incident
  • Restrict access to security incidents
  • Manage security threats using the Security Analyst Workspace
  • Resolve security threats with the playbook
  • Sightings searches on user-reported phishing and malware attacks
  • Playbook Resources
  • Activate a Security Incident Response flow
  • Security Incident Response playbooks
  • Process-based Playbooks
  • Playbook for Manual Phishing
  • Create playbooks for Manual Phishing in Workflow Studio
  • Add parallel activities
  • Using the Manual Phishing playbook
  • Workspace Playbook summary
  • Playbook for Automated Phishing
  • Create processes for Automated Phishing in PAD
  • Using the Automated Phishing playbook
  • Playbook for Manual Malware
  • Create processes for Manual Malware in PAD
  • Using the Manual Malware playbook
  • Playbook for Automated Malware
  • Create processes Automated Malware in PAD
  • Using the Automated Malware playbook
  • Playbook for Failed Login Manual
  • Create processes for Failed Login Manual in PAD
  • Using the Failed Login Manual playbook
  • Flow-based Playbooks
  • Playbook for Automated Phishing
  • Run the automated phishing response playbook flow
  • View automated phishing response playbook flow action designer
  • View the automated phishing response playbook subflow designer
  • Playbook for Automated Malware
  • Run the automated malware playbook flow
  • Playbook for Failed Login Manual
  • Playbook for Child Security Incident Automation
  • Playbook for Office 365 - Malicious File Detected
  • Set up the Office Malicous File Detected playbook
  • Use the Office 365 Malicious File Detected playbook
  • Playbook for Repeat Detection
  • Set up the Repeat Detection playbook
  • Use the Repeat Detection playbook
  • Playbook for Spoofed Emails (using the same Display name)
  • Set up the Spoofed Emails playbook
  • Use the Spoofed Emails (using the same Display name) playbook
  • Playbook for Endpoint Detection
  • Set up the Endpoint Detection playbook
  • Use the Endpoint Detection playbook
  • Playbook for Possible Password Spray
  • Set up the Possible Password Spray playbook
  • Use the Possible Password Spray playbook
  • Playbook for T1003 - Detect Credential Dumping Tools
  • Set up the T1003 - Detect Credential Dumping Tools playbook
  • Use the T1003 - Detect Credential Dumping Tools playbook
  • Playbook for Email Domain Spoofing Detection
  • Set up the Email Spoof Detection playbook
  • Use the Email Domain Spoofing Detection playbook
  • Playbook for Typo Squatted Domain
  • Set up the Typo Squatted Domain playbook
  • Use the Typo Squatted Domain playbook
  • Playbook for Credential Sniffing
  • Set up the Credential Sniffing playbook
  • Use the Credential Sniffing playbook
  • Playbook for T1070 - Windows Events Logs Cleared
  • Set up the T1070 - Windows Events Logs Cleared playbook
  • Use the T1070 - Windows Events Logs Cleared playbook
  • Playbook for OSquery of External Address in /etc/hosts file
  • Set up the OSquery of External Address in the /etc/hosts file playbook
  • Use the OSquery of External Address in the /etc/hosts file playbook
  • Playbook for User Deleting Bash History - Cloud
  • Set up the User Deleting Bash History playbook
  • Use the User Deleting Bash History playbook
  • Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud
  • Set up the Successful VPN Attempts from the Service Accounts playbook
  • Use the Successful VPN Attempts from the Service Accounts playbook
  • Playbook for Attempted Access to Deactivated Accounts
  • Set up the Attempted Access Deactivated Account playbook
  • Use the Attempted Access to Deactivated Accounts playbook
  • Playbook for T1003 - Defense Evasion - Mimikatz DCShadow
  • Set up the T1003 - Defense Evasion - Mimikatz DCShadow playbook
  • Use the T1003 - Defense Evasion - Mimikatz DCShadow playbook
  • Playbook for T1003 - Credential Dumping - Mimikatz DCSync
  • Set up the T1003 - Credential Dumping - Mimikatz DCsync playbook
  • Use the T1003 - Credential Dumping - Mimikatz DCsync playbook
  • Playbook for Okta User Login Failures from Multiple IPs
  • Set up the Okta User Login Failures from Multiple IPs playbook
  • Use the Okta User Login Failures from Multiple IPs playbook
  • Playbook for ModSec Brute force by IP Burst
  • Set up the ModSec Brute force by IP Burst playbook
  • Use the ModSec Brute force by IP Burst playbook
  • Security Incident Response playbook actions
  • Visual representation of Security Incident Response reporting
  • Security Incident Response Overview dashboard
  • Access Security Incident Response Explorer
  • Security incident map
  • Add map to Security Incident Response overview
  • Modify security incident map
  • Security incident treemaps
  • Add treemaps to the Security Incident Response overview
  • Create or update a treemap category
  • Create or update a treemap indicator
  • Add vulnerability significance charts to an overview
  • Major Security Incident Management
  • Exploring Major Security Incident Management
  • Major Security Incident Management
  • Get started with MSIM
  • Checklist for MSIM setup
  • Major Security Incident Management roles
  • Integrating Major Security Incident Management
  • Integrate Major Security Incident Management with Microsoft SharePoint
  • Register a new application at Azure portal for SharePoint connections
  • Use certificates for authentication
  • Configure Microsoft SharePoint with Major Security Incident Management
  • Integrate Major Security Incident Management with Microsoft Teams
  • Register a new application at Azure portal for Microsoft Teams connections
  • Configure Microsoft Teams connection with Major Security Incident Management
  • Establish MS Teams Graph connection on ServiceNow AI Platform
  • Using Certificates for authentication
  • Attach a Java Key Store certificate for MS Teams
  • Configure the JWT signing key for MS Teams
  • Configure the JWT provider for MS Teams
  • Establish a connection using certificates
  • Using Client Secret value
  • Establish a connection using client secret
  • Activate MS Teams chat connector for MS Teams Graph Spoke user
  • Major Security Incident Management Conference Call Integration
  • Start a conference call
  • Add participants to a conference call
  • Mute participants in a conference call
  • View conference call details
  • Integrate MSIM Conference Calls with Microsoft Teams
  • Use the MSIM Conference Call Microsoft Teams integration
  • Integrate MSIM Conference Calls with Zoom
  • Use the MSIM Conference Call Zoom integration
  • Integrate MSIM Conference Calls with Cisco Webex
  • Use the Conference Calls Cisco Webex integration
  • Configuring Major Security Incident Management
  • Configure File Explorer Component
  • Get Started with File Explorer
  • Configure File Explorer Repository Drive
  • Configure Folder and File Action Settings
  • Create Folder Templates
  • File Explorer Activity Stream in Workspace
  • File Explorer troubleshooting
  • Configure Microsoft Teams
  • Get started with Microsoft Teams
  • Activate MS Teams as a chat provider
  • Create a chat channel template
  • View Chat Message Activity
  • MS Teams Chat Connector Troubleshooting for MSIM
  • Configure Slack chat connector for major security incidents
  • Get started with Slack chat connector configuration
  • Create a chat channel template for Slack
  • Activate Slack as a channel provider
  • View chat message activities in Slack
  • Major Security Incident Management administration
  • Major Security Incident Management workspace
  • Using Major Security Incident Management
  • Propose, promote, and link incident records
  • Propose as a Major Security Incident
  • Promote to a Major Security Incident
  • Link to Major Security Incident
  • Using MSI List view in the MSIM workspace
  • View Major Security Incident impact metrics
  • View Major Security Incident trend charts
  • Update Major Security Incident details
  • Restrict access to certain major security incidents
  • Link additional records to Major Security Incident
  • Unlink records from Major Security Incident
  • Manage tasks in a Major Security Incident
  • Manage tasks using the Visual Task Board
  • Manage tasks using the List view
  • Track collaboration activity via MSIM workspace
  • Create and distribute MSIM Status Reports
  • Managing MSIM status reports
  • Configure Major Security Incident status reports
  • Create a Report Template
  • Add Branding to your Report Templates
  • Use Visualizations in Report Templates
  • Use Reports Lists in Report Templates
  • Use Template Scripts in your Report Templates
  • Preview the Report Template
  • Create a Report Section Template
  • Create a Report Subsection Template
  • Create Report Subsection Element template
  • Create a Free Form Type Element
  • Create a Visualization Type Element
  • Create a List Type Element
  • Create a Custom Type Element
  • Add system properties
  • Major Security Incident Management Playbooks
  • Create processes for MSIM playbook
  • Using the MSIM playbook
  • Playbook for zero-day vulnerability
  • Using the Zero-day Vulnerability Playbook
  • Playbook for Legal Request
  • Rollup Framework for MSIM
  • Configure Linked Records in Major Security Incident Management
  • Configure Rollup Records in Major Security Incident Management
  • Configure List Layout in Major Security Incident Management
  • Rollup example use case implementation for a Security Case
  • Step 1. Create linked record configuration for a Security Case
  • Step 2. Create a view for modal window for a Security Case
  • Step 3. Create UI actions for the Source Table for a Security Case
  • Step 4. Create a view for a new Linked Record Tab for a Security Case
  • Step 5. Add Access Control Lists (ACLs) for Major Security Incident Management workspace users
  • Step 6. Create business rules for a Security Case
  • Step 7. Create rollup record configurations
  • Perform on demand atomic rollup
  • Security Incident Response integrations
  • ArcSight ESM Event Ingestion for Security Operations integration
  • Set up your ServiceNow AI Platform instance for the ArcSight ESM event ingestion integration
  • Set up the ArcSight ESM Query Viewer
  • Install and configure the ServiceNow application for the ArcSight ESM Event Ingestion integration
  • Create a profile for ArcSight ESM correlation event ingestion integration
  • Create and name the profile for ArcSight ESM event ingestion integration
  • Select correlation events for ArcSight ESM event ingestion integration
  • Mapping correlation event fields for the ArcSight ESM event ingestion integration
  • Create mappings for ArcSight ESM event ingestion integration
  • Preview the security incident for the ArcSight ESM event ingestion Integration
  • Create a schedule for ArcSight ESM event ingestion ingestion
  • Additional options: Automate correlated event updates and closure based on SIR incident status
  • ArcSight ESM Integration Settings for event ingestion integration
  • Troubleshooting ArcSight ESM event ingestion integration
  • Copy ArcSight ESM profile for event ingestion integration
  • Use the script editor to format correlation event values for ArcSight ESM integration
  • Flow Designer usage with ArcSight ESM event ingestion integration
  • Amazon Web Services (AWS) Security Hub integration
  • Get started with AWS Security Hub integration
  • Register and configure the AWS Security Hub portal
  • Install and configure the AWS Security Hub integration
  • Create a profile for AWS Security Hub finding integration
  • Map the AWS Security Hub finding fields
  • Define filter and aggregation criteria for AWS Security Hub findings ingestion
  • Schedule the AWS Security Hub finding retrieval
  • Automate the AWS Security Hub finding updates and closures by the SIR incident status
  • SIR form after an AWS Security Hub finding ingestion
  • Carbon Black - Incident Enrichment integration
  • Get started with the Carbon Black - Incident Enrichment integration
  • Carbon Black integration
  • Get started with the Carbon Black integration
  • Check Point Anti-bot - Email Parser integration
  • Check Point Next Generation Threat Prevention integration
  • Check Point NGTP setup
  • Create an API account for the Check Point NGTP integration
  • Set up the Check Point NGTP integration
  • Activate the Check Point NGTP integration
  • Working with block lists
  • Create a block list for the Check Point NGTP integration
  • Activate a block list for the Check Point NGTP integration
  • Configure a block list as a Custom Intelligence Feed on the Check Point NGTP integration
  • Submit block list entries from a security incident for the Check Point NGTP integration
  • Submit block list entries directly from the Block List Entry Table
  • Approve block list entries for the Check Point NGTP integration
  • Block list entry exceptions for the Check Point NGTP integration
  • Edit the security tag name for the Check Point NGTP integration
  • Uninstall the Check Point NGTP integration
  • CrowdStrike Falcon Host integration
  • Get started with the CrowdStrike Falcon Host integration
  • Security Operations CrowdStrike Falcon Host - Publish to Watchlist Flow
  • CrowdStrike Falcon Insight for Security Operations integration
  • Getting started with the CrowdStrike Falcon Insight integration
  • Create CrowdStrike API client and generate keys
  • Install and configure CrowdStrike Falcon Insight
  • Create an approval group
  • Create a capability profile for the CrowdStrike Falcon Insight integration
  • Configure profiles and security incidents for the CrowdStrike Falcon Insight integration
  • How trigger conditions work with a configuration item for a profile
  • Verify CrowdStrike Falcon Insight profile trigger conditions
  • Trigger a CrowdStrike Falcon Insight profile manually from a security incident
  • Create and configure a profile for the sighting search
  • Configure and trigger additional actions in CrowdStrike Falcon Insight
  • Using CrowdStrike Falcon Insight integration in Analyst Workspace
  • CrowdStrike Next-Gen SIEM integration for Security Operations
  • Get started with CrowdStrike Next-Gen SIEM integration
  • Install and configure CrowdStrike Next-Gen SIEM integration
  • Create a detection profile for CrowdStrike Next-Gen SIEM
  • Set correlation rules for CrowdStrike Next-Gen SIEM integration
  • Map the CrowdStrike Next-Gen detection fields
  • Defining filter and aggregation criteria
  • Set the filtering conditions for security incidents
  • Define aggregation conditions
  • Schedule the CrowdStrike Next-Gen SIEM detection retrieval
  • Automate detection updates and closures
  • CrowdStrike Falcon X Sandbox for Security Operations integration
  • Get started with the CrowdStrike Falcon X Sandbox integration
  • Set up submission configurations
  • Manually submit files or URLs to Sandbox
  • Automate CrowdStrike Falcon Sandbox submissions using Flow Designer
  • Monitor submission results
  • Tag security incidents with the Sandbox submission status
  • Review the sandbox global settings
  • Elasticsearch Incident Enrichment integration
  • Get started with the Elasticsearch - Incident Enrichment integration
  • FireEye Endpoint Security integration
  • Set up your NowPlatform instance for FireEye integration
  • Configuring Timestamp Settings for Triage Acquisition
  • Install the application and configure a source for the integration
  • FireEye Default Settings
  • Create a new capability profile for the FireEye Endpoint integration
  • Understand how trigger conditions work with a configuration item
  • Configure profiles and security incidents for the FireEye HX integration
  • Verify the Trigger Condition Filters
  • Trigger a FireEye capability profile from Related Links
  • Trigger a FireEye Capability profile from Configuration Item related list
  • FireEye Get File Capability
  • FireEye Additional Actions on Endpoint
  • Create and configure a profile for sightings search with the FireEye Integration
  • Invoke Sighting Search from a Security Incident
  • Have I been pwned? integration
  • Security Operations Have I been pwned? integration setup
  • Threat Lookup - Have I been pwned? flow
  • Activate the Security Operations Have I been pwned? integration
  • Update your X.509 certificate
  • HPE Security ArcSight ESM - Email Parser integration
  • HPE ArcSight Logger - Incident Enrichment integration
  • Get started with the HPE ArcSight Logger - Incident Enrichment integration
  • Hybrid Analysis integration
  • Install and configure Hybrid Analysis
  • Verify expected results for Hybrid Analysis
  • (Optional) Manually attach an observable for Hybrid Analysis
  • IBM QRadar Offense Ingestion Integration
  • Install and configure the ServiceNow application for the IBM QRadar offense ingestion integration
  • Set up your ServiceNow AI Platform instance for the IBM QRadar offense ingestion integration
  • Create a profile for IBM QRadar offense ingestion integration
  • Create profiles for ingesting IBM QRadar offenses
  • Select IBM QRadar rules
  • Mapping of offense fields for the IBM QRadar integration
  • Ingesting the sample IBM QRadar offenses
  • Mapping IBM QRadar offense fields to security incident response fields
  • Preview the security incident for the IBM QRadar integration
  • Define schedule for the IBM QRadar integration
  • Automate offense updates
  • Configuration settings
  • Optional: Copy a IBM QRadar profile
  • Domain separation and IBM QRadar Offense Ingestion
  • Security Incident Response form after offense ingestion
  • Flow Designer and Integration Hub usage with IBM QRadar offense ingestion integration
  • Troubleshooting IBM QRadar offense ingestion integration
  • IBM QRadar - Incident Enrichment Integration
  • Get started with the IBM QRadar - Incident Enrichment integration
  • LogRhythm Overview
  • Set up the REST API for LogRhythm
  • Install the plugin and configure LogRhythm
  • Creating an alarm profile for LogRhythm
  • Mapping LogRhythm alarms to the security incident
  • Map LogRhythm alarm fields to security incident fields
  • Filter alarms for LogRhythm
  • Previewing the security incident with mapped LogRhythm alarm values
  • Schedule and retrieve LogRhythm alarms
  • Additional options for LogRhythm alarms
  • Additional configurations for the LogRhythm integration
  • Use the script editor to format LogRhythm values
  • Copy an alarm profile for LogRhythm
  • Disable automated alarm closure for LogRhythm
  • View LogRhythm drilldown events
  • Troubleshooting the LogRhythm integration
  • Verify connectivity for LogRhythm
  • Script execution and system log for LogRhythm
  • McAfee ePO integration
  • Integration architecture for McAfee ePO
  • Checklist for the McAfee ePO integration
  • Set up your ServiceNow AI Platform instance for the McAfee ePO integration
  • Set up your McAfee ePO console to integrate with Security Incident Response (SIR)
  • Install the application and configure a server for the McAfee ePO integration
  • Edit security tags in the ServiceNow AI Platform for the McAfee ePO integration
  • Create an approval group
  • McAfee ePO integration capability profiles
  • Create a capability profile for the McAfee ePO integration
  • Defining triggering conditions with a Configuration item (CI) field for a McAfee ePO profile
  • Configuring profiles for the McAfee ePO integration
  • Configure profiles and security incidents for system enrichment queries for the McAfee ePO integration
  • Trigger McAfee ePO profile manually from a security incident
  • Trigger additional actions in McAfee ePO integration
  • Using McAfee ePO integration in Analyst Workspace
  • McAfee ESM - Email Parser integration
  • Configure McAfee ESM - Email Parser integration
  • McAfee ESM - Incident Enrichment Integration
  • Get started with the McAfee ESM - Incident Enrichment integration
  • Microsoft Azure Sentinel integration
  • Get started with Microsoft Azure Sentinel integration
  • Register and configure the Microsoft Azure portal
  • Install and configure the Microsoft Azure Sentinel integration
  • Create a profile for Microsoft Azure Sentinel
  • Map the Microsoft Azure Sentinel incident fields
  • Defining filter and aggregation criteria
  • Schedule the Microsoft Azure Sentinel incident retrieval
  • Automate the incident updates and closures by the SIR incident status
  • Copy a Microsoft Azure Sentinel profile
  • SIR form after an incident ingestion
  • Review the Microsoft Azure Sentinel integration settings
  • Domain separation
  • Comparing Microsoft Azure Sentinel and Microsoft Graph Security API integrations with SIR
  • Microsoft Defender for Endpoint integration
  • Register and configure the Microsoft Defender for Endpoint in the Microsoft Azure portal
  • Get started with the Microsoft Defender for Endpoint integration
  • Install the application and configure a source for the integration
  • Microsoft Defender for Endpoint Default Settings
  • Map the Microsoft Defender for Endpoint indicator types
  • Create a capability profile for the Microsoft Defender for Endpoint integration
  • Trigger conditions in a configuration item
  • Configure profiles and security incidents for the Microsoft Defender for Endpoint integration
  • Verify the Trigger Condition Filters
  • Trigger the Microsoft Defender for Endpoint capabilities from Related Links
  • Trigger the Microsoft Defender for Endpoint from Configuration Item related list
  • Additional Configurations in Microsoft Defender for Endpoint
  • Configure Isolate Host capability in Microsoft Defender for Endpoint
  • Configure Remove Host Isolation capability in Microsoft Defender for Endpoint
  • Configure Run Antivirus Scan capability in Microsoft Defender for Endpoint
  • Configure Restrict App Execution capability in Microsoft Defender for Endpoint
  • Configure Remove App Restriction capability in Microsoft Defender for Endpoint
  • Configure Get Related Machines from Defender Capability in Microsoft Defender for Endpoint
  • Configure Stop and Quarantine File capability in Microsoft Defender for Endpoint
  • Create and configure a profile for sightings search with the Microsoft Defender for Endpoint integration
  • Perform a manual sighting search in Microsoft Defender for Endpoint
  • Perform an automatic observable enrichment in Microsoft Defender for Endpoint
  • Perform a manual observable enrichment in Microsoft Defender for Endpoint
  • Create indicators in Microsoft Defender for Endpoint
  • Update indicators in Microsoft Defender for Endpoint
  • Domain separation in Microsoft Defender for Endpoint integration
  • Rate limit configuration in Microsoft Defender for Endpoint integration
  • Microsoft Exchange Online integration
  • Set up account
  • Install
  • Configure
  • Define search criteria
  • Request delete email approval
  • Approve delete email requests
  • Recover deleted emails
  • Edit security tags
  • Microsoft Exchange On-Premises integration
  • Configure
  • Microsoft Exchange - Perform Email Search and Deletion flow
  • Microsoft Graph Security API alert ingestion integration
  • Set up your ServiceNow AI Platform instance for the Microsoft Graph Security API integration
  • Configure the Microsoft Azure portal
  • Install and configure the Servicenow application for Microsoft Graph Security API alert ingestion integration
  • Create a profile for the Microsoft Graph Security API alert ingestion integration
  • Identify the source for the profile
  • Mapping of alert fields for Microsoft Graph Security API alert ingestion integration
  • Ingest sample Microsoft Graph Security API alerts
  • Mapping alerts to security incident response fields
  • Preview the security incident for the Microsoft Graph Security API integration
  • Define schedule for Microsoft Graph Security API integration
  • Automate alert updates and closure based on SIR incident status
  • Microsoft Graph Security API integration configuration settings
  • Security Incident Response form after alert ingestion
  • Optional: Copy a Microsoft Graph Security API profile
  • Domain separation and Microsoft Graph Security API alert ingestion
  • Flow Designer and Integration Hub usage in Microsoft Graph Security API integration
  • Troubleshooting Microsoft Graph Security API integration
  • Palo Alto Networks - AutoFocus integration
  • Activate and configure Palo Alto Networks - AutoFocus integration
  • Get AutoFocus Session Info Enrichment Flow
  • Palo Alto Networks - Firewall integration
  • Set up SSH credentials to the MID Server
  • Activate and configure the Palo Alto Networks Firewall Integration
  • Security Operations Integration Palo Alto Networks Firewall Launcher workflow
  • Security Operations Palo Alto Networks - Check and Block Value workflow
  • Get Log Data Flow
  • Palo Alto Networks - WildFire integration
  • Activate Security Operations Palo Alto Networks - WildFire
  • Get WildFire Data Enrichment Flow
  • Palo Alto Networks Next-Generation Firewall integration
  • Create a certificate profile for the Palo Alto Networks Next-Generation Firewall
  • Set up and install Palo Alto Networks Next-Generation Firewall
  • Create the API account role for Palo Alto Networks Next-Generation Firewall
  • Supported External Dynamic Lists for Palo Alto Networks Next-Generation Firewall
  • Create an EDL for Palo Alto Networks Next-Generation Firewall
  • Activate an EDL for Palo Alto Networks Next-Generation Firewall
  • Activate an EDL manually for Palo Alto Networks Next-Generation Firewall
  • Configure an EDL in Palo Alto Networks Next-Generation Firewall
  • Activate an EDL for Palo Alto Networks Next-Generation Firewall with a change request
  • Submit EDL entries from a security incident record for Palo Alto Networks Next-Generation Firewall
  • Submit EDL entries from the blocklist for Palo Alto Networks Next-Generation Firewall
  • Approve EDL entries for Palo Alto Networks Next-Generation Firewall
  • EDL entry exceptions for Palo Alto Networks Next-Generation Firewall
  • (Optional) Edit the security tag name for Palo Alto Networks Next-Generation Firewall
  • Uninstall Palo Alto Networks Next-Generation Firewall
  • PhishTank integration
  • Install and configure PhishTank
  • Verify expected results for PhishTank
  • (Optional) Manually attach an observable for PhishTank
  • Proofpoint Integration for Security Operations
  • Exploring the Proofpoint Integration for Security Operations
  • Configuring the Proofpoint Integration for Security Operations
  • Install and configure the Proofpoint Integration for Security Operations
  • Create an event profile for the Proofpoint Integration for Security Operations
  • Review Proofpoint integration settings
  • View Proofpoint Analytics Dashboard
  • Reverse Whois integration
  • Install and configure Reverse Whois
  • (Optional) Install and configure Whois
  • Initiate the lookup for Reverse Whois
  • Verify expected results for Reverse Whois
  • (Optional) Run enrichment lookup and verify expected results for Whois
  • RISKIQ and WHOISIQ integration
  • Supported observables for RISKIQ and RISKIQ WHOISIQ
  • Install and configure RISKIQ and WHOISIQ
  • Verify expected results for RISKIQ SSL certificate lookups
  • RISKIQ SSL certificate lookups that return an exact match
  • RISKIQ SSL certificate lookups that return multiple certificates or no certificates
  • Verify expected results for WHOISIQ URL lookups
  • Create an observable for manual WHOISIQ lookups
  • Verify expected results for manual WHOISIQ lookups
  • Shodan integration
  • Install and configure Shodan
  • Verify expected results for Shodan
  • (Optional) Manually attach an observable for Shodan
  • Secureworks CTP Ticket Ingestion Integration
  • Set up your ServiceNow AI Platform instance for the Secureworks CTP ticket ingestion integration
  • Install and configure the ServiceNow application for the Secureworks CTP ticket ingestion integration
  • Create a profile for Secureworks CTP ticket ingestion integration
  • Identify the source of the profile
  • Mapping of ticket fields for the SecureWorks CTP integration
  • Ingesting the sample Secureworks tickets
  • Mapping Secureworks ticket fields to security incident response fields
  • Preview the mapped values in the security incident
  • Define schedule for the Secureworks CTP Ticket ingestion
  • Automate ticket updates and closure based on SIR incident status
  • Optional: Copy a Secureworks CTP profile
  • Security Incident Response form changes after ticket ingestion
  • View the Secureworks tickets and the corresponding security incidents
  • Secureworks CTP Master Ticket Closure Notice
  • Secureworks CTP integration configuration settings
  • Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks
  • Install and Configure
  • Create an incident profile
  • Set Alert Sources
  • Map incident fields
  • Define filter and aggregation criteria
  • Schedule incident retrieval
  • Automate incident updates and closures
  • Security Incident Response integration with Zscaler
  • Getting started with Security Incident Response integration with Zscaler
  • Configure access to APIs
  • Configure integration
  • Add Zscaler Internet Access URL category lists
  • Submit observables from a security incident record to a URL category list
  • Approve observables to URL category lists
  • Submit the security incident to the Zscaler URL category list
  • Run a threat lookup by using the Zscaler global threat library
  • Submit to Zscaler Sandbox analysis
  • Set up email alerts for Patient 0 events
  • ServiceNow Security Operations add-on for Splunk overview
  • Splunk integration setup
  • Download addon
  • Install addon
  • Setup Splunk environment
  • Configure Application Registry on the ServiceNow instance
  • Using Splunk add-on
  • Manual search commands
  • Splunk event actions
  • Single-record Splunk alerts
  • Multiple-record, custom field Splunk alerts
  • Create a multi-record, custom field Splunk alert
  • Multi-record, custom field Splunk alert examples
  • Splunk error reporting
  • Splunk Enterprise Event Ingestion integration for Security Operations by ServiceNow
  • Set up your ServiceNow AI Platform instance for the Splunk Enterprise Event Ingestion integration
  • Install and configure the ServiceNow application for the Splunk Enterprise Event Ingestion integration
  • Configure settings
  • Create and name an event profile for the Splunk Enterprise Event Ingestion integration
  • Select scheduled alerts for the Splunk Enterprise Event Ingestion integration
  • Mapping alerts and events for the Splunk Enterprise Event Ingestion integration
  • Map alerts for the Splunk Enterprise Event Ingestion integration
  • Preview the security incident for the Splunk Enterprise Event Ingestion integration
  • Schedule and retrieve alerts for the Splunk Enterprise Event Ingestion integration
  • Integration architecture and external systems connection for the Splunk Enterprise Event Ingestion integration
  • Copy Splunk profiles
  • Copy an event profile
  • Set up Splunk environment
  • Use Splunk add-on
  • Save searches in console
  • Format alert values
  • Checklist
  • Splunk Enterprise Security event ingestion integration
  • Glossary
  • Set up your ServiceNow AI Platform instance for the Splunk Enterprise Security integration
  • Install and configure
  • Configure Splunk Enterprise Security settings
  • Authentication errors
  • Create and name an event profile for the Splunk Enterprise Security event ingestion integration
  • Set up Splunk environment
  • Forward events on-demand
  • Copy an event profile for the Splunk Enterprise Security Event Ingestion integration
  • Use the script editor to format alert values for the Splunk Enterprise Security Event Ingestion integration
  • Copy Splunk Enterprise Security profiles from one instance to another using export/import functionality
  • Checklist for the Splunk Enterprise Security Notable Event Ingestion integration
  • Splunk - Incident Enrichment integration
  • Get started with the Splunk Search integration for Security Operations
  • Mobile Experience for Security Incident Response
  • Set up checklist for the Security Incident Response Mobile app
  • Log in to the Security Incident Response Mobile app
  • View, edit, and assign open security incidents with the Security Incident Response Mobile app
  • View, edit, and reassign security incidents assigned to you with the Security Incident Response Mobile app
  • View, edit and assign unassigned security incidents with the Security Incident Response Mobile app
  • View, edit, and assign high priority incidents with the Security Incident Response Mobile app
  • View, edit, and assign security incidents with a risk score greater than 60 with the Security Incident Response Mobile app
  • Search for security incidents with the Security Incident Response Mobile app
  • View, edit, and assign open response tasks with the Security Incident Response Mobile app
  • View, edit, and reassign your response tasks with the Security Incident Response Mobile app
  • Filter records with the Security Incident Response Mobile app
  • Security Incident Response Orchestration
  • Set up Security Incident Response Orchestration
  • Understand Security Incident Response Orchestration workflows and workflow templates
  • Security Incident Response Orchestration flows and actions
  • Create Lookup Request for IoC Changes Flow
  • Create IoC Lookup Request Flow Action
  • Security Incident Response- Get Network Statistics Flow
  • Security Incident Response - Get Running Services Flow
  • Determine Shell Script by OS Flow Action
  • Get Running Services - WMI Enrichment
  • Run procdump flow
  • Execute procdump action
  • Security Incident - Evaluate response task outcome workflow
  • Threat Intelligence
  • Understanding Threat Intelligence
  • Domain separation and Threat Intelligence
  • Set up Threat Intelligence
  • IoC Repository
  • Attack modes and methods
  • Define an attack mode/method
  • Add an IoC to an attack mode/method
  • Add a related attack mode method
  • Add associated task to an attack mode/method
  • Indicators of compromise
  • View an IoC
  • Add a related observable to an IoC
  • Add a related attack mode/method to an IoC
  • Identify associated indicator types
  • Identify indicator sources
  • Add associated tasks to an IoC
  • Observables
  • Define an observable
  • Add a related IoC to an observable
  • Add associated tasks to an observable
  • Add a related observable
  • Load more IoC data
  • Identify observable sources
  • Perform lookups on observables
  • Perform threat enrichment on observables
  • Attack patterns
  • Define an attack pattern
  • Campaigns
  • Define a campaign
  • Course of actions
  • Define a course of action
  • Identities
  • Define identities
  • Infrastructure
  • Define infrastructure
  • Intrusion set
  • Define an intrusion set
  • Locations
  • Define Location
  • Malware
  • Define a Malware
  • Malware analysis
  • Define malware analysis
  • Observed data
  • Define observed data
  • Threat actors
  • Define threat actors
  • Threat groupings
  • Define threat groupings
  • Marking definitions
  • Define marking definitions
  • Threat notes
  • Define threat notes
  • Threat opinions
  • Define threat opinions
  • Threat reports
  • Define threat reports
  • Sightings
  • Define indicator sightings
  • Define object sightings
  • Tools
  • Define tools
  • Vulnerabilities
  • Define vulnerabilities
  • Relationships
  • Define object-object relationships
  • Define object-indicator relationships
  • Define object-observable relationships
  • STIX Visualizer
  • MITRE-ATT&CK framework overview
  • MITRE-ATT&CK administration
  • Get started with MITRE-ATT&CK framework
  • Understand the MITRE to STIX data model
  • Domain separation and MITRE-ATT&CK
  • Set up the MITRE-ATT&CK framework
  • Manage matrices
  • Manage techniques
  • Manage mitigations
  • Manage groups
  • Manage malware
  • Manage tools
  • Manage MITRE relationships
  • Manage CVE and technique mapping
  • Extend the MITRE-ATT&CK data
  • Define the data source and detection tool mapping
  • Define the data source and data component mapping
  • Define the technique detection coverage
  • MITRE-ATT&CK Scoring definition
  • Map your technique detection coverage to a technique
  • Define the mitigation coverage
  • Technique mitigation coverage definitions
  • Map your mitigation coverage to a technique
  • Overall technique mitigation coverage calculator
  • Create and map detection rules
  • Auto-extract technique rules for importing MITRE-ATT&CK information
  • Review threat group and MITRE-ATT&CK techniques mapping
  • Threat group to technique heatmap definition
  • Review the MITRE-ATT&CK system properties
  • Using MITRE-ATT&CK to detect and analyze threats
  • Associate MITRE-ATT&CK information with security incidents
  • Associate MITRE-ATT&CK information with observables
  • Associate MITRE-ATT&CK information with security case
  • Rollup MITRE-ATT&CK information using Threat Lookup results
  • Rollup MITRE-ATT&CK information from detection rules
  • Rollup MITRE-ATT&CK information from child security incidents
  • Perform link analysis and threat hunting using MITRE-ATT&CK specific filters
  • MITRE-ATT&CK heat map and navigator
  • Using the MITRE-ATT&CK dashboard
  • MITRE DEFEND Framework
  • Ingest MITRE DEFEND data
  • MITRE DEFEND tables
  • Threat Intelligence administration
  • Threat Lookup Finding Calculators
  • Using Threat Lookup Finding Calculators
  • Threat Intelligence integrations
  • CrowdStrike Falcon Intelligence integration
  • CrowdStrike Falcon Intelligence integration overview
  • Have I been pwned? integration
  • Security Operations Have I been pwned? integration setup
  • Threat Lookup - Have I been pwned? flow
  • Activate the Security Operations Have I been pwned? integration
  • Update your X.509 certificate
  • MISP integration for Security Operations
  • MISP administration
  • Getting started with MISP integration for Security Operations
  • MISP user roles and permissions
  • Install and configure the MISP integration for Security Operations
  • Review the MISP integration settings
  • Configure MISP sighting searches
  • Configure how an automatic event is created
  • MISP event data
  • Associated MISP events
  • MISP user information
  • Domain separation and MISP
  • Troubleshooting MISP integration
  • Using MISP to investigate and analyze threats
  • Sighting searches in MISP
  • Observable enrichment in MISP
  • Managing events in MISP
  • Roll up MITRE-ATT&CK information using MISP enrichment results
  • OPSWAT Metadefender Integration
  • OPSWAT Metadefender integration overview
  • VirusTotal integration
  • VirusTotal integration setup
  • Activate and configure the VirusTotal integration
  • Threat Lookup - VirusTotal workflow
  • WhoisXML API integration
  • WhoisXML API integration setup
  • Activate and configure the Security Operations Whois integration
  • Update your X.509 certificate
  • Enrich Observable WhoIs workflow
  • Threat Intelligence Orchestration
  • Set up Threat Intelligence Orchestration
  • Threat Intelligence Orchestration workflows and activities
  • Security Case Management
  • Create cases in Security Case Management
  • Add artifacts to a case
  • Associate MITRE-ATT&CK information with security case
  • Case creation from security artifacts
  • IoCs and observables in cases
  • Create a case from IoCs or observables
  • Add IoCs and observables to an existing case
  • Create an observable from a case
  • Run a sightings search on observables in a case
  • Security incidents in cases
  • Create a case from security incidents
  • Add security incidents to an existing case
  • Configuration items in cases
  • Create a case from CIs
  • Add CIs to existing cases
  • Affected users in cases
  • Create a case from affected users
  • Add affected users to existing cases
  • Security artifact analysis
  • Related details for case artifacts
  • View related details for a security incident artifact
  • View related details for a configuration item artifact
  • View related details for an IoC artifact
  • View related details for an affected user artifact
  • View related details for an observable artifact
  • Security artifact exclusion and inclusion
  • Exclude security artifacts from a case
  • Return excluded security artifacts to a case
  • Annotate security artifacts
  • Search for security artifacts
  • Security Posture Control
  • Explore
  • Install supported applications
  • Supported Service Graph Connectors
  • Policies
  • Included policies
  • Creating your own policies
  • Insights
  • Use the workspace
  • Activate a policy
  • Create and activate custom policies
  • Edit an activated policy in Security Posture Control
  • Clone and create child policies
  • Create and activate a configured insight
  • Create an asset profile
  • Delete a profile
  • View findings for Security Posture Control
  • Test result and remediation task state transitions
  • Creating your own API connector
  • Enter connector metadata
  • Enter credentials
  • Select a template
  • Provide input values
  • Map API response to SPC attributes
  • Validate connector
  • Create an instance and set the import schedule
  • Create an asset search
  • Resolving duplicate configuration items
  • Resolve duplicate configuration items
  • Use mitigation controls
  • Mitigation controls policies
  • Policies for Exploit Protection (EDR)
  • Install CrowdStrike integrations
  • Install Microsoft integrations
  • Create multiple instances
  • Install SentinelOne integrations
  • Exploit protection (WAF)
  • Configure F5 BIG-IP integrations
  • Configure the AWS WAF integration
  • Create a policy for AWS WAF
  • View detected mitigations
  • Mapping mitigations
  • Reference
  • Assets without endpoint protection
  • Assets missed by vulnerability assessment
  • Unmanaged assets
  • Assets missing endpoint management
  • Assets with vulnerabilities
  • Cloud assets and high-risk combinations
  • Hardware Service Graph Connectors
  • Software Service Graph Connectors
  • Policy examples
  • Create a base policy for Security Posture Control (example)
  • Create a child policy from a base policy for Security Posture Control (example)
  • Clone a policy for Security Posture Control (example)
  • Cybersecurity Executive Dashboard
  • Opt-in for benchmark scores
  • Set targets
  • Security Simulation and Training Integration for Security Operations
  • Configure Knowbe4 integration
  • Configure Microsoft Defender for Office 365 integration
  • Risk and compliance dashboard for GRC: Metrics
  • Risk and Compliance Dashboard reports and solutions
  • Threat Intelligence Security Center
  • Explore
  • TISC Key terminology
  • Home page in TISC Workspace
  • Configure
  • Download TISC application from ServiceNow Store
  • Set up Threat Intelligence Security Center
  • Integrate
  • Threat Intelligence Security Center Catalog
  • Threat Intelligence Feeds
  • Configure a new threat intelligence feed
  • Configure Custom Field Mapping
  • View Threat Intel Feeds
  • View STIX TAXII Feeds
  • View STIX HTTPs Feeds
  • View MISP Feeds
  • View Text Feeds
  • View CSV Feeds
  • View JSON Feeds
  • View RSS Feeds
  • View Custom Feed
  • Configure custom CrowdStrike feed
  • System Properties for CrowdStrike
  • Configure custom MISP feed
  • Understanding STIX TAXII
  • Configure a new TAXII Feed
  • Duplicate threat intelligence feeds
  • TISC Integrations
  • TISC Enrichment Integrations
  • Configure Observable Enrichment
  • Have I Been Pwned integration
  • Configure and enable Have I Been Pwned integration
  • Whois integration
  • Configure and enable Whois integration
  • Shodan integration
  • Configure and enable Shodan integration
  • Sighting Search
  • Configure Sighting Search
  • Define queries for Sighting Search
  • Using Sighting Search Parameters
  • Get started with Elasticsearch integration
  • Configure and enable Elasticsearch integration
  • Get started with Splunk Search integration
  • Configure and enable Splunk integration
  • TISC add-on for Splunk overview
  • TISC integration with Splunk
  • Creating users in ServiceNow TISC instance
  • Configuring TISC add-on in Splunk
  • Data storage in Splunk
  • Configure Threat Lookup
  • View Threat Lookup Reputation Calculators
  • Threat Lookup
  • TISC VirusTotal integration
  • Configure and Enable VirusTotal Integration
  • TISC CrowdStrike Falcon Intelligence integration
  • Configure and Enable CrowdStrike Falcon Intelligence integration
  • TISC Security Tools integrations
  • CrowdStrike Falcon EDR integration
  • Configure Crowdstrike Falcon EDR integration
  • Send observables to EDR
  • Microsoft Defender for EDR Integration
  • Register and configure the Microsoft Defender in the Microsoft Azure portal
  • Install and configure Microsoft Defender for EDR Integration
  • System properties for Microsoft Defender EDR
  • Send observables to EDR
  • TISC Security Tools - Firewall
  • Palo Alto Networks integration
  • Create new EDL for Palo Alto Networks
  • Palo Alto EDL Approval Rules
  • Add Observables to EDL
  • Remove Observables from EDL
  • Approve EDL entries for Palo Alto Networks
  • TISC - Azure Sentinel integration
  • TISC playbook templates
  • Administer
  • About Rules Engine in TISC
  • Defining Data Imports Approval Rules
  • Defining Expiration Rules
  • Expiration rules for source records
  • Create Inbound Data Exclusion Rules
  • Custom Threat Score Calculator in TISC
  • Define Threat Score Calculator
  • MITRE ATT&CK Technique Extraction Rules
  • MITRE ATT&CK Technique Extraction method
  • Configure Tagging Rules in TISC
  • Automated creation of zero day vulnerability
  • About Security Control Lists in TISC
  • Defining Security Control Lists
  • Creating Taxonomies
  • Bulk import Taxonomies
  • Managing the Threat Lookup Reputation Calculator
  • Manage email Notifications
  • Email Notifications
  • Email logs
  • Report Templates
  • Create a new Report Template
  • Edit a Published Report Template
  • Duplicate a Report Template
  • System properties for Reports
  • Working with Webhooks
  • System properties for Webhooks
  • Configure webhooks
  • Subscribe Triggers
  • View webhook error logs
  • View webhook batches
  • Webhook Triggers
  • Configure tooltips for nodemaps
  • Working with automated flows
  • Automated IOC Enrichment
  • Analyze, assess, and disseminate observables
  • Analyze and assess threat IoC’s
  • Vulnerability Management Support
  • Zero-day vulnerability tracking
  • Automated flows tables
  • Share Threat Intelligence data between TISC instances
  • Manual and Automated Sharing using flows
  • Template Configuration for Intelligence Sharing
  • Sharing intelligence using TAXII Server
  • Add to TAXII Collections from Library List View
  • Reference
  • Domain separation and Threat Intelligence Security Center
  • Components installed with Threat Intelligence Security Center
  • Threat Intelligence Security Center Knowledge Base articles
  • TISC API References
  • Use
  • TISC integration with SIR Workspace
  • Working with Data Imports
  • Viewing all imports
  • Viewing my imports
  • Viewing my approvals
  • Import Threat Intelligence
  • Import data using structured file
  • Import data using standard format
  • Import data using raw text
  • Import data using unstructured file format
  • Threat Analyst Workbench
  • Workbench Overview
  • Creating cases using Threat Analyst Workbench
  • Enforced Restrictions for case(s)
  • Access controls for a case
  • External user access for case tasks
  • Associate MITRE Techniques to a Case
  • Roll up of MITRE technique associations
  • Create case task using Threat Analyst Workbench
  • Working with Investigation Canvases
  • Understanding investigation canvas actions
  • Linking an existing case from Investigation Canvas
  • Creating a Case and Linking from Investigation Canvas
  • Linking Canvas from a Case
  • Create an investigation canvas
  • Adding a new node to the canvas
  • Investigation canvas and MITRE ATT&CK
  • Investigation Canvas MITRE Filters
  • Add artifacts to case(s) or case task(s)
  • Roll up of MITRE Techniques from Artifacts to Case
  • Show MITRE ATT&CK Framework for a Case(s)
  • Run Enrichment Actions within a case
  • View Case Reports
  • Create a security incident from a TISC case
  • Upload Secure File Attachments
  • Threat Intelligence Security Center Library
  • Understanding the Data Model
  • TISC Library Objects form view
  • TISC Library Repository
  • Observables
  • Define an Observable
  • Observables source records
  • Link Threat Intel Related Records
  • Fetch Observables Data
  • View details in Relationship Graph
  • Link node actions in Relationship Graph
  • Working with Internal Intelligence Records
  • View Internal Intelligence Records
  • Run Enrichment Actions from Observable
  • Add to Case
  • Run Enrichment operations in TISC
  • Observable Enrichment
  • Run Have I Been Pwned enrichment integration
  • Whois integration
  • Configure and enable Whois integration
  • Shodan integration
  • Configure and enable Shodan integration
  • Run Threat Lookup
  • Run Sighting Search
  • Run Observable Enrichment
  • View Enrichment Results
  • Indicators
  • Define an Indicator
  • Threat Entities
  • Attack Patterns
  • Define an attack pattern
  • Campaign
  • Define Campaign
  • Courses of Action
  • Define Courses of Action
  • Identity
  • Define identities
  • Infrastructure
  • Define infrastructure
  • Intrusion Set
  • Define Intrusion Set
  • Location
  • Define Location
  • Malware
  • Define Malware
  • Malware Analysis
  • Define Malware Analysis
  • Marking Definition
  • Define Marking Definition
  • Object Sighting
  • Define Object Sighting
  • Observed Data
  • Define Observed Data
  • Threat Actor
  • Define Threat Actor
  • Threat Event
  • Define Threat Event
  • Threat Grouping
  • Define Threat Grouping
  • Threat Note
  • Define Threat Note
  • Threat Opinion
  • Define Threat Opinion
  • Threat Report
  • Define Threat Report
  • Tool
  • Define Tools
  • Other Objects
  • Data Component
  • Define Data Component
  • Data Sources
  • Define Data Sources
  • Vulnerability
  • Define Vulnerability
  • Create a CWE record
  • Create a Product
  • Create a Vendor to a Vulnerability
  • Create Remediations
  • Access the Vulnerability Entities
  • Fetch Vulnerability Data
  • Define RSS Feeds
  • Working with Reports in TISC
  • View All Reports
  • View Case Reports
  • View Intelligence Reports
  • View my reports
  • MITRE-ATT&CK Repository
  • Manage Matrices
  • Manage Techniques
  • Manage Mitigations
  • Manage Groups
  • Manage Malware
  • Manage Tools
  • Manage MITRE Relationships
  • Relationships Objects
  • Define observable-observable relationships
  • Define object-object relationships
  • Define object-observable relationships
  • Define object-indicator relationships
  • Define indicator-indicator relationships
  • Define indicator-observable relationships
  • Potential Relationships
  • Confirm observable-observable potential relationship
  • Confirm object-object potential relationships
  • Confirm indicator-indicator potential relationships
  • Vulnerability relationship mapping
  • Access Vulnerability Downstream actions
  • Create Vulnerability Assessment from a Vulnerability
  • Create Security Incident from a Vulnerability Record
  • Deleting threat intelligence library records
  • Export intelligence data
  • Confirm Potential Relationships from Related Records
  • Automated Correlation
  • Working with Data Exports
  • View all exports
  • View my exports
  • Export intelligence system properties
  • Data migration in TISC
  • Data migration from SIR TI to TISC
  • TISC Data Processing Functional Flow
  • TISC Data Archival
  • TISC Data Archival
  • Archive TISC related records
  • Destroy Rules in TISC
  • Delete intelligence records
  • Automated cleanup of duplicate records from same source
  • Data Loss Prevention Incident Response
  • Explore
  • DLP Incident Response overview
  • Get started with DLP Incident Response
  • Configure
  • Install and configure the DLP Incident Response application
  • Domain separation and DLP Incident Response
  • Administer
  • DLP default configuration settings
  • Create end user lookup rules
  • Create assignment rules
  • Create incident consolidation rules
  • Create response due date rules
  • Add multiple users to access DLP incidents
  • Create Approval Rules
  • Create user instructions templates
  • Configure DLP UI user instructions
  • Create email templates
  • Create a Data Loss Prevention Incident Response SLA trigger
  • Create a Data Loss Prevention Incident Response SLA definition
  • Create assessments
  • Configure response option for your DLP incidents
  • Create incident response option rules
  • Create age chart configurations
  • Create user delegate configurations
  • Create repeat offender identification rules
  • Create Additional Incident Data Fields
  • DLP SLA Definition form
  • Configure advanced settings
  • Monitor DLP Integration Run process
  • DLP Incident Access Restrictions
  • Create field level restrictions
  • Create record level restrictions
  • DLP Incidents Archival
  • Archive DLP related records
  • Manage incidents
  • Data Loss Prevention Incident Response User Workspace
  • Report or respond to DLP incidents
  • Working with my approvals module
  • Data Loss Prevention Incident Response Analyst Workspace
  • Data Loss Prevention Incident Response Dashboard
  • Inbound integration
  • DLP integrations
  • Symantec Integration for Data Loss Prevention Incident Response
  • Getting started with Symantec DLP integration for Data Loss Prevention
  • Install and configure the Symantec DLP integration for Data Loss Prevention
  • Create a profile for Symantec DLP integration
  • Define filters to apply for the Incident creation
  • Configure evidence file storage
  • Schedule the Symantec DLP Incident Retrieval
  • Mapping Symantec DLP incident statuses with ServiceNow incident Status
  • Severity mapping between Symantec DLP incidents with ServiceNow incidents
  • Configure Smart Response Rules
  • Execute Smart Response Rules
  • Download evidence files on Symantec
  • Preview evidence files
  • Configure the Symantec DLP  integration settings
  • Domain Separation in the Symantec DLP integration
  • Data Loss Prevention Incident Response Integration with Proofpoint
  • Getting started with Proofpoint integration for Data Loss Prevention
  • Install and configure the Proofpoint integration for Data Loss Prevention
  • Create an Application in Proofpoint and Obtain Client Credentials
  • Configure the Webhook on the Proofpoint DLP tenant for alert notifications to ServiceNow
  • Create a Profile for Proofpoint DLP integration
  • Define filters to apply for the Incident creation
  • Configure evidence file storage
  • Download DLP incidents evidence files on Proofpoint
  • Preview evidence files
  • Email remediation actions
  • Map Proofpoint DLP incidents status with ServiceNow incident status
  • Configure Proofpoint DLP integration settings
  • Domain Separation in Proofpoint DLP integration
  • Data Loss Prevention Incident Response Integration with Netskope
  • Getting started with Netskope DLP integration for Data Loss Prevention
  • Install and configure the Netskope DLP integration for Data Loss Prevention
  • Create a Profile for Netskope DLP integration
  • Define Filters to apply for the Incident creation
  • Schedule the Netskope DLP incidents retrieval
  • Mapping DLP incident status with Netskope
  • Configure Netskope DLP integration settings
  • Download evidence files
  • Preview evidence files
  • Notifications for users on retry mechanism
  • Email notifications on credential expiration
  • Domain Separation in Netskope DLP integration
  • Internet Content Adaption Protocol (ICAP) integration for DLP IR
  • Getting started with ICAP DLP integration for Data Loss Prevention
  • Install and configure the ICAP DLP integration
  • Create a profile for ICAP DLP integration
  • Define filters to apply for the Incident creation
  • Schedule the ICAP DLP incidents retrieval
  • View sensitive information for DLP alerts
  • Download evidence files for DLP alerts
  • Preview evidence files for ICAP
  • Review the ICAP DLP integration settings
  • Data Loss Prevention Incident Response with Microsoft
  • Getting started with Microsoft DLP IR integration for data loss prevention
  • Install and configure the Microsoft DLP integration
  • Create a new incident profile for Microsoft DLP integration
  • Microsoft purview endpoint storage configuration
  • Define filters to apply for the Incident creation
  • Configure the match content for the incident
  • Schedule the DLP IR Microsoft incident retrieval
  • Configure Microsoft DLP IR integration settings
  • Configure evidence file storage for Microsoft
  • Request release email from quarantine
  • Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
  • Download files approval flow
  • Preview Evidence files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
  • Domain separation in Microsoft DLP integration
  • Security Operations common functionality
  • Create and define filter groups in Security Operations
  • Shared data transformation
  • Create duplication rules in Security Operations
  • Security Operations email processing
  • Security Operations email properties
  • Create Security Operations email properties
  • Security Operations email parsing
  • Create email parsers in Security Operations
  • Edit email records in Security Operations
  • Unmatched Security Operations email events
  • View and reprocess unmatched Security Operations emails
  • Security Operations field mapping
  • Map tables to tables with Security Operations field mapping
  • Security Operations field value transforms
  • Create Security Operations field value transforms
  • Security Operations enrichment data mapping
  • Create a Security Operations enrichment data map
  • Security Operations user-defined escalation
  • Create a Security Operations user-defined escalation group
  • Create domain-separated property overrides
  • Create an operating system group
  • Set up security tag groups and tags
  • Create security tag rules
  • Import security tag rules
  • Security annotations
  • Create security annotations for CIs
  • Create security annotations for observables
  • Create security annotations for users
  • View security annotations reports
  • Components installed with Security Support Common
  • View components installed with Security Support Common
  • Search Security Operations
  • Security Operations Integration Reference
  • ServiceNow Security Operations integration development guidelines
  • Types of ServiceNow integrations provided
  • Security Operations Integration Configurations
  • Activate and configure third-party integrations
  • Create an integration
  • Tips for writing integrations
  • Integration troubleshooting
  • Replace an untrusted or expired third-party SSL certificate
  • Integrations Capabilities framework 2.0
  • REST APIs for third-party integration with Security Operations
  • Integration capabilities
  • Security Operations Integration- Block Request capability
  • Run Block Request
  • Security Operations Integration - Block Request Flow
  • Security Operations Integration- Email Search and Delete capability
  • Security Operations Integration - Email Search and Delete flow
  • Execution Tracking Begin (Mail Search) activity
  • Security Operations Integration- Enrich CI capability
  • Security Operations Integration - CI Enrichment flow
  • Security Operations Integration- Enrich Observable capability
  • Security Operations Integration - Enrich Observable workflow
  • Security Operations Integration- Get Network Statistics capability
  • Security Operations Integrations - Get Network Statistics workflow
  • Execution Tracking - Begin (CIs) Flow Action
  • Security Incident Response- Get Network Statistics Flow
  • Security Operations Integration- Get Running Processes capability
  • Security Operations - Get Running Processes Flow
  • Security Operations Carbon Black Integration - Get Running Processes Flow
  • Collect Carbon Black Configurations Flow Action
  • Check MID Server Status
  • Get Sensor ID Flow Action
  • Create Session Flow Action
  • Check Session Status Flow Action
  • Create Command Process Flow Action
  • Check Command Status and Get Process Flow Action
  • Map Processes Data Flow Action
  • Close Session Flow Action
  • Security Operations System Command Integration- Get Running Processes flow
  • Combine results activity
  • Execute Shell Script activity
  • Extract Shell Script from MID Script activity
  • Get Running Processes via PowerShell activity
  • Security Operations Integration- Isolate Host capability
  • Security Operations - Isolate Host Flow
  • Run Isolate Host
  • Security Operations Carbon Black Integration - Isolate Host Flow
  • Get Sensor ID Flow Action
  • Set Network Isolation Enabled Flow Action
  • Update Sensor Flow Action
  • Security Operations Carbon Black Integration- Remove Host Isolation Flow
  • Security Operations Integration- Publish to Watchlist capability
  • Security Operations Integration - Publish to Watchlist Flow
  • Security Operations Integration- Sightings Search capability
  • Create sightings search configuration records
  • Run a Sightings Search
  • Security Operations Integration - Sightings Search Flow
  • Security Operations - QRadar Sightings Search Flow
  • Security Operations - McAfee ESM Sightings Search Flow
  • Security Operations - Arcsight Logger Sightings Search Flow
  • Security Operations - Elasticsearch Sightings Search Flow
  • Security Operations Integration - Splunk Sightings Search Flow
  • View Sightings Search Results
  • Share Sightings Search results
  • Share observables from a security incident
  • View Sightings Search Details
  • View Sightings Search Data
  • Security Operations Integration - Threat Lookup capability
  • Security Operations Integration - Threat Lookup workflow
  • Change the order of workflow execution
  • Common Security Operations integration flows and orchestration Flow Actions
  • Execution Tracking - Begin Flow Action
  • Capability Execution Tracking - Complete Flow Action
  • Capability Execution Tracking- Failure Flow Action
  • Capability - Determine CIs activity
  • Create Enrichment Data records Flow Action
  • Get Configuration Item FQDN Flow Action
  • Determine Observables activity
  • Get Supported Security Capabilities activity
  • Capability Execution Tracking- No Impls activity
  • Create Compliance Search Action
  • Get IP from CI activity
  • Get Network Statistics via netstat Flow Action
  • Get running processes via WMI activity
  • Check Compliance Search Status Action
  • Update Task Worknotes activity
  • Roll up lookup info to security incident activity
  • Update security incident with lookup results workflow
  • Filter Allowlisted Observables activity
  • Write content to record as attachment activity
  • Get IP from CI Flow Action
  • Security Operations workflow triggers
  • Create Security Operations workflow triggers
  • Security Operations Orchestration
  • Security Operations and the ServiceNow Store
  • Download an application from the ServiceNow Store for the first time
  • Get entitlement for a Security Operations product or application
  • Activate a ServiceNow Store application
  • Install a Security Operations integration
  • Update an application previously downloaded from the ServiceNow Store
  • Upgrade your instance to the next family release

Quick links section

  • Release version: Xanadu
  • Updated August 1, 2024
  • 1 minute to read

    • Quick links work like bookmark links. You can add external URLs and quickly access them from within the workspace.

    • Working with quick links
      Add quick links for easy reference.
    Related concepts
    • SIR Workspace features
    • SIR Workspace interface overview
    • Upcoming section
    • Shift Handover Records section
    • List view in SIR Workspace
    Related reference
    • SIR Workspace plugins
    Back to home page