Security Case Management
Summarize
Summary of Security Case Management
Security Case Management in ServiceNow Zurich release enables security analysts engaged in threat hunting to collect and analyze information on suspicious activities within their environment. It integrates various security-related records such as incidents, observables, configuration items (CIs), and affected users into a unified case framework to support comprehensive threat analysis.
Show less
Key Features
- Case Creation and Integration: Cases can be created from multiple sources including Security Case Management, Security Incident Response, Threat Intelligence, Configuration Items, and Users tables. Existing cases can be enriched with additional data from these sources to enhance investigation depth.
- Structured Case Layout: Each security case consists of three main sections:
- Case Header: Displays basic identification and classification information, including a unique case number prefixed with "SECC".
- Additional Case Details: Contains analysis-specific information such as case state, work notes, and recorded activities.
- Case Artifacts: Contains multiple tabs with related records to support investigation. Analysts can search within tabs, exclude irrelevant records (which are hidden but not deleted), and restore them if necessary.
- Interactive Exploration: Analysts can pivot through related data by using the Additional Details icon to view connected information, such as incidents or vulnerabilities tied to a specific Configuration Item.
- Annotations: Analysts can add personal notes to case artifacts to document insights or observations, supporting collaborative and detailed analysis.
- Advanced Tools: Includes capabilities like running sightings searches on observables and searching for security artifacts directly within cases, facilitating efficient and thorough examinations.
Practical Benefits for ServiceNow Customers
By leveraging Security Case Management, your security teams can:
- Centralize and correlate diverse security data for holistic threat analysis.
- Quickly assess the nature and scope of threats such as targeted campaigns or advanced persistent threats through comprehensive case views.
- Maintain a clear audit trail of investigative activities and findings within each case to support accountability and collaboration.
- Efficiently manage large volumes of security information by filtering out safe or irrelevant data without losing historical records.
- Enhance investigative workflows with integrated search and annotation tools designed for security analysts.
Overall, Security Case Management empowers your security analysts to conduct more effective, organized, and insightful threat investigations using ServiceNow’s unified platform.
Security Case Management provides a means for security analysts who are engaged in threat hunting to gather information on suspicious activity in their environment. Case-related records, such as security incidents, observables, CIs, and affected users can be added to cases to accommodate broad and specific analysis.
With the ability to easily pivot through the records and related information, analysts can assess whether they are facing a targeted campaign, advanced persistent threat, and so forth.
Security cases can be created from various sources on your instance, including Security Case Management, Security Incident Response, and Threat Intelligence. You can also create cases from configuration items and affected users in the Configuration Items [cmdb.ci] and Users [sys.user] tables, respectively. After cases have been created, each of these sources can be also used to add valuable analysis resources to existing cases.
Each security case consists of three main sections, a header section, a section with additional case details, and a case artifacts section containing a collection of records that aid in building an argument for identifying and dealing with particular threats.
Case header
The case header provides basic information used to identify and classify the security case. The case number uses the SECC prefix.
Additional case details
The Additional Case Details section provides information specific to the analysis that has already been performed on the case, including its current state, and work notes and activities recorded for the case.
Case artifacts
The Case Artifacts section provides a series of tabs of information contained in the security case.
You can perform searches within the contents of each tab. You can also exclude specific records you have already evaluated as being safe or which are of no value in your investigation. The excluded records are not deleted, but are hidden from view. If needed, you can view excluded records and add them back.