Security incidents created from events and alerts
Summarize
Summary of Security incidents created from events and alerts
In the Zurich release, ServiceNow enables automatic and manual creation of security incidents from events and alerts processed by Event Management. Events are first imported from alert monitoring tools, grouped into alerts, and then converted into security incidents based on configurable alert rules or through manual selection by Security Admin users.
Show less
Key features
- Automated security incident creation: The provided sample alert rule, "Create security incidents from critical alerts," automatically generates security incidents for critical security-related events from both ServiceNow and third-party tools.
- Alert rule customization: You can modify alert rules and their task templates to adjust the initial values of created security incidents or define multiple rules for different incident types.
- Manual incident creation: Security Admin users can manually create security incidents from suspicious alerts via a dedicated button.
- Event data requirements: Incoming events must include key information such as the node (name, IP, or CI sysid), event classification set to Security, event description, and optionally additional details in JSON format for populating security incident fields.
- Field population logic: Fields in the security incident are set only if they are empty, preserving existing data. All event details are logged as work notes unless the incident remains unchanged.
- Support for custom fields: Any fields, including custom ones added to the security incident table, can be populated from event data.
What this enables ServiceNow customers to do
ServiceNow customers can efficiently transform security-related events from multiple monitoring sources into actionable security incidents. This capability streamlines incident creation through automation with customizable alert rules and supports manual intervention when needed. By ensuring proper event data formatting and leveraging customizable task templates, customers can maintain accurate and comprehensive security incident records, facilitating timely investigation and response.
As events are imported from alert monitoring tools, they are first processed by Event Management and grouped into alerts. These alerts can be used to create security incidents based on customizable alert rules, or manually reviewed to select those alerts to be investigated as a security incident.
You can find a sample alert rule called Create security incidents from critical alerts in the Alert Rules module of the Event Management application. This alert rule automatically creates security incidents when critical security-related events are received from within ServiceNow or from third-party monitoring applications. After the security incident has been created, it will be updated as new events are received. You can modify the task template in the alert rule to change the initial values for the security incident created by this alert rule. To handle each distinct variety of security incident that you would like to create, you can define other alert rules with different conditions.
Alternatively, if you are a user with the Security Admin role, you can manually create a security incident by clicking the Create Security Incident button from any suspicious alert.
- The node set to the name, IP address, or sys_id of the CI that becomes the affected resource.
- The event classification is set to Security to distinguish them from other IT events.
- The event description, which populates the description of the security incident.
- The additional information can include any extra information that does not fit into the previously listed fields or other event fields, such as the category, attack vectors, return URL, or correlation ID. The format is a
string that lists field names along with their values, using the following JSON format:
{ "fieldName" : "fieldValue", "fieldName" : "fieldValue" }