--- sourceDocument: Australia Security Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Types of ServiceNow integrations provided # Types of ServiceNow integrations provided {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Types of ServiceNow Integrations Provided The Security Operations applications in ServiceNow can enhance their functionality through various integrations with other ServiceNow applications. Key integrations include Security Incident Response, Threat Intelligence, and Vulnerability Response, which streamline workflows and improve security incident management. Show full answer Show less ## Key Features * **Security Incident Response -- Event Management Integration:** This integration allows for the automatic parsing of events in Event Management to populate fields in security incidents, facilitating the creation of security events from SIEM tools. * **Security Incident Response - Import Set API:** Directly create security incidents without going through Event Management, using a REST endpoint. This is ideal when Event Management is not available. * **Threat Intelligence - Lookup Source Integration:** Enables querying external lookup sources to check for malicious data such as IP addresses or URLs, with built-in rate limiting and automatic creation of IoC observable entries. * **Threat Intelligence - Threat Source Integration:** Imports data from external threat intelligence repositories into IoC tables, supporting TAXII collections and blocklists for streamlined data retrieval. * **Vulnerability Response - Scanner Invocation Integration:** Allows for asynchronous scheduling of scans with third-party vulnerability scanners for configuration items or IP addresses. * **Vulnerability Response - Data Integration:** Retrieves vulnerability data from third-party systems and synchronizes it within ServiceNow, enabling effective tracking and management of vulnerabilities. ## Key Outcomes By utilizing these integrations, ServiceNow customers can expect improved efficiency in managing security incidents and vulnerabilities, enhanced data accuracy through automated processes, and better overall coordination between security operations and IT management. These capabilities ensure that organizations can effectively respond to security threats while maintaining robust vulnerability management practices. The Security Operations applications (Security Incident Response, Threat Intelligence, and Vulnerability Response) can be seamlessly integrated with other ServiceNow applications to enhance their functionality. The following integrations are provided in the Security Operations base system. ## Security Incident Response -- Event Management integration The capabilities of the Event Management application have been expanded to support Security Incident Response. The Security Incident Response Event Management support plugin automatically parses the contents of events in Event Management to populate fields in security incidents. Use case covered: Creation of security events in the Event Management system from Security Information and Event Management (SIEM) tools Useful capabilities provided: * Event management functionality -- event correlation, event rules, and alert rules * Automatic mapping of additional_information values to resulting security incident {#c_TypesOfIntegrationsProv__ul_xcy_m15_sv} Resources: [Security Incident event management support documentation](https://servicenow-prod.fluidtopics.net/pKdV0k93wOcBCVS~AERWvA "As events are imported from alert monitoring tools, they are first processed by Event Management and grouped into alerts. These alerts can be used to create security incidents based on customizable alert rules, or manually reviewed to select those alerts to be investigated as a security incident.") [Event Management documentation](https://www.servicenow.com/docs/access?context=c_EM&version=australia&pubname=australia-it-operations-management&ft:locale=en-US) ## Security Incident Response - Import Set API integration In addition to using Event Management to push security-related events, the Security Incident Response application provides an Import Set API that allows direct creation of security incidents. The REST endpoint for the Security Incident Import Set is http://localhost:8080/api/now/import/sn_si_incident_import. This integration technique is useful when a) Event Management is not installed, or b) it is desired to simply create Security Incidents without going through the event \> alert \> Security Incident flow that is required when using Event Management. Use case covered: Creation of security incidents directly from SIEM tools. Useful capabilities provided: Automatic CI matching on Security Incident creation based on IP, NetBIOS, or fully qualified domain name. Resources: [Platform Import Set API documentation](https://www.servicenow.com/docs/access?context=c_ImportSetAPI&version=australia&pubname=australia-api-reference&ft:locale=en-US) [Security Incident Web Service Import Set documentation](https://servicenow-prod.fluidtopics.net/hkkD~dw3ErhmWZTz9XIqWg "Third-party monitoring tools, such as Splunk, can be integrated with Security Incident Response so that security events imported from those tools automatically generate security incidents. You can also import data from third-party tools into security alerts.") ## Threat Intelligence - lookup source integration Lookup sources provide the ability to send data to external lookup sources to determine if that data is malicious. Generally, that data is an IP address, URL, file, or file hash. Use case covered: Lookup an IP address, URL, file, or hash with an external lookup service. Useful capabilities provided: * Consistent way to request lookups from catalog items and security incidents. * Rate limiting and throttling capabilities provided with little/no coding. * Automatic creation of Indicators of Compromise (IoC) observable entries for any issues found by lookup sources. {#c_TypesOfIntegrationsProv__ul_z4l_w15_sv} ## Threat Intelligence - threat source integration Threat Sources provide the ability to pull in data from external threat intelligence repositories. This data is then imported into the various Indicators of Compromise tables that exist within the system. TAXII collections and simple blocklists are supported natively. To add new TAXII collections (or profiles based on a discovery or collection management service), it is as simple as adding an entry. Similarly, adding a new simple, single column blocklist is a matter of entering a new record and providing the URL of the blocklist. For more complicated sets of data, a custom integration can be provided to make a call to a URL and parse the response. Use case covered: Retrieve data from a threat intelligence source to load into IoC tables. Useful capabilities provided: * Support for simple blocklists and TAXII collections with no coding. * Simple mechanism for executing REST messages for retrieving data. * Decoupled data retrieval/processing for integration component reusability. * Native support for processing passing data returned to data sources (and import sets/transform maps). * Supports multiple data requests per integration (for paginated calls) with the ability to pass context to subsequent calls {#c_TypesOfIntegrationsProv__ul_ybx_z15_sv} Resources: [Define a threat source](https://servicenow-prod.fluidtopics.net/bf5wVW2WDwbfY01wsvCdPA#t_DefineThreatSource "You can maintain a list of Threat Intelligence threat sources. Each source includes the ability to define how often a source is queried. You can also execute a threat source on demand to import the needed Structured Threat Information eXpression (STIX) data.") ## Vulnerability Response - scanner invocation integration Vulnerability Scanner Invocation is a lightweight integration entry point that supports invoking vulnerability scans from the instance. A third-party vulnerability scanner is called asynchronously to schedule a scan for configuration items or IP addresses. Use case covered: Make request to third-party scanner to scan a CI (using host information derived from CI) or IP address/IP addresses. Useful capabilities provided: * Simple framework for defining scanner implementations. * Consistent way to request scans from catalog items, security incidents, and vulnerable items. * Automatic updating of tasks with result of scan invocation. {#c_TypesOfIntegrationsProv__ul_ogw_2b5_sv} ## Vulnerability Response - data integration Vulnerability data integrations are intended to retrieve vulnerability data from third-party vulnerability systems. The expected outputs from these integrations are vulnerability entries and vulnerable items. This integration allows third-party vulnerability scanners to function independently, with the expectation that vulnerabilities can be worked and tracked within the instance. Use cases covered: * Retrieve vulnerability libraries * Retrieve vulnerability/CI pairings * Synchronize CIs with vulnerability management system {#c_TypesOfIntegrationsProv__ul_kxq_3b5_sv} Useful capabilities provided: * Decoupled data retrieval/processing for integration component reusability. * Native support for processing passing data returned to data sources (and import sets/transform maps). * Supports multiple data requests per integration (for paginated calls) with the ability to pass context to subsequent calls. {#c_TypesOfIntegrationsProv__ul_lxq_3b5_sv} Resources: [Vulnerability data integration documentation](https://servicenow-prod.fluidtopics.net/N~R2nD9HvzuqZOO8dB1KFg "Vulnerability integrations provide the ability for customers and vendors to enrich the vulnerability data on their instance by retrieving data from external systems and vendors. This ability can simplify the vulnerability remediation life cycle by keeping the instance synchronized with other vulnerability management systems.") **Related concepts** * [Security Operations Integration Configurations](https://servicenow-prod.fluidtopics.net/48ahETlC~NF99wXMCUsCKA "Many of the integrations included in the base system require little or no setup, and operate in the same way. Certain integrations, such as the Qualys Cloud Platform, however, require separate steps for setting up the integration. Others support different sets of scan and lookup types and different rate limits.") * [Tips for writing integrations](https://servicenow-prod.fluidtopics.net/WrftS4_aOuJx7CfDqNBj1g "Avoid some of the pitfalls you can encounter when writing your own integrations by following these guidelines.") * [Integration troubleshooting](https://servicenow-prod.fluidtopics.net/_DwvxRbS3tQogK5A_dB8UQ "These troubleshooting suggestions can help you resolve common issues you can encounter when setting up or running integrations.")