Playbook for Child Security Incident Automation
Summarize
Summary of Playbook for Child Security Incident Automation
The Child Security Incident Automation playbook in ServiceNow Security Operations streamlines the management of duplicate security incidents, categorized as child security incidents that roll up into a parent security incident. This automation reduces investigation and closure times by consolidating key incident artifacts such as observables, affected users, and configuration items (CIs) from child incidents into their respective parent incidents.
Show less
Key Features
- Automatically moves child security incidents to the Analysis stage to ensure timely processing.
- Identifies and eliminates duplicate affected users and CIs before rolling them up to the parent security incident.
- Transfers observables from child incidents to the parent incident to maintain a comprehensive view of the security event.
- Automatically closes or cancels child security incidents when the parent incident is resolved, maintaining incident lifecycle integrity.
- Includes automated worknotes on both parent and child incidents documenting the rollup of users, CIs, and observables to support audit and collaboration.
Implementation and Usage
- Requires the snsi.admin role and installation of the Security Operations Spoke (snsecspoke) in Flow Designer.
- Accessible through Flow Designer where users can optionally copy and customize the playbook to fit specific organizational needs.
- The playbook triggers when a child incident has a non-empty parent field and the parent is in Draft, Analysis, Contain, or Eradicate states.
- It progresses through sequential steps retrieving affected users, CIs, and observables from the child incident, ensuring only unique items are rolled up to the parent.
Benefits for ServiceNow Customers
- Improves efficiency in handling duplicate security incidents by automating artifact consolidation.
- Ensures accurate and comprehensive data aggregation in parent incidents, enhancing threat analysis and response.
- Reduces manual effort and potential errors in managing incident relationships and lifecycle stages.
- Supports security analysts with clear, automated documentation of incident rollups, fostering transparency and collaboration.
- Allows flexibility to tailor the playbook through Flow Designer to align with organizational workflows and policies.
Duplicate security incidents are categorized as child security incidents and are rolled up to the parent security incidents.
The Child Security Incident Automation playbook helps reduce the time required to investigate and close duplicate security incidents. This playbook automatically rolls up specific unique artifacts of the child security incident (observables, affected users, CIs) to the parent security incident.
Prerequisites
- sn_si.admin
- flow_designer
Spoke: Install Security Operations Spoke (sn_sec_spoke)
Key capabilities
The Child Automation playbook covers the following capabilities:
- Moves the security incident to the Analysis stage.
- Eliminates duplicates and adds (rolls up) the affected users and CIs to the parent security incident.
- Adds observables from the child incident to the parent security incident.
- Closes or cancels the child security incident when the parent security incident is closed.
Capabilities required
For more information, see the ServiceNow store.
Security analyst experience
To understand how to resolve security threats in a step-by-step manner, see Resolve security threats with the playbook.
Deeper understanding of the Child Security Incident Automation playbook with Flow Designer capabilities
- Login as a user with sn_si.user and flow_designer roles.
- Navigate to and select the Failed Login playbook.
- Make a copy of the Child Security Incident Automation playbook and make the necessary modifications. (This is an optional step. Follow this step only if you plan to customize or make specific changes to the flow).
- Make the necessary modifications according to your requirement. (This is an optional step. Follow this step only if you plan to customize or make specific changes to the flow).
- Activate the playbook.
- Activate the main flow to use the playbook available with the base system.
- Activate the copied flow after making any modifications according to your requirements.
- The parent security incident field isn’t empty.
- The parent security incident is in Draft, Analysis, Contain, or Eradicate state.
The following steps walk you through the actions and tasks that are available in the Child Security Incident Automation playbook.
- When the playbook starts executing, in Step 1, if the security incident is in a Draft state, it’s updated and set to the Analysis state.
- In steps 2 and 3, affected users for the security incident are retrieved and rolled up to the parent security incident. Any duplicate users are eliminated.
- In steps 4 and 5, configuration items associated with the child security incident are retrieved and unique CIs are rolled up to the parent security incident.
- In steps 6 and 7, observables associated with the child security incident are retrieved and unique observables are rolled up to the parent security incident
- In steps 8 and 9, automated worknotes are posted to the parent and child security incidents indicating that the affected users, configuration items, and observables have been rolled up from the child to the parent security incident.