Service Graph Connector for Trellix
Summarize
Summary of Service Graph Connector for Trellix
The Service Graph Connector for Trellix allows you to import device, server, and network data from Trellix into your ServiceNow instance. This integration enhances incident response and asset management capabilities within your organization.
Show less
Key Features
- Supported Versions: Compatible with ServiceNow versions Washington DC, Xanadu, and Yokohama.
- Security Operations Management: Helps identify cybersecurity risks, assess configuration item dependencies, and manage incidents effectively.
- Connection Configuration: Use the SGC Central view in the CMDB Workspace for connection setup, as the guided setup method is being deprecated.
- Integration Dashboard: The CMDB Integrations dashboard provides visibility into the status and metrics of all integrations.
- Data Mapping: Trellix data is transformed into ServiceNow CMDB CI class definitions and inserted using the Identification and Reconciliation Engine (IRE).
- System Property: The pagination size for records fetched from the Trellix API can be configured using the system property sntrellixinteg.getdevicescount.
Key Outcomes
By utilizing the Service Graph Connector for Trellix, you can expect improved visibility into your cybersecurity environment, more efficient asset management, and streamlined incident response processes. The integration enhances your ability to manage data quality and reconcile inconsistencies across configuration items.
Use the Service Graph Connector for Trellix to bring in device, server, and network data from a Trellix environment into your ServiceNow instance to streamline your incident response and asset management use cases.
Request apps on the Store
Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
Supported versions
Supported ServiceNow versions:- Washington DC
- Xanadu
- Yokohama
Use cases
The following examples describe how you can use the Service Graph Connector for Trellix for security operations management:
- Identify cybersecurity risks in the environment.
- Assess dependencies between configuration items (CI).
- Enable effective security incident response and endpoint management systems.
- Identify data quality issues, reconcile inconsistencies, and manage incidents and changes on discovered CIs.
Configuring a connection for the connector
CMDB integrations dashboard
The Integration Commons for CMDB store app provides a dashboard with a central view of the status, processing results, and processing errors of all installed integrations. You can see metrics for all integration runs. You can filter the view to a specific CMDB integration, a specific time duration, or a specific integration run. For more details about monitoring Tanium integrations in the CMDB Integrations Dashboard, see Using the CMDB Integrations Dashboard.
Data mapping
Data from the Trellix data sources is mapped and transformed into the ServiceNow CMDB Configuration Item (CI) class definitions using the Robust Transform Engine (RTE). Data is inserted into the ServiceNow CMDB using the Identification and Reconciliation Engine (IRE).
- SG-Trellix-Devices
- Imports data from devices and loads the imported data in the SGC Trellix Device Import [sn_trellix_integ_sgc_trellix_device_import] staging table.
- File System [cmdb_ci_file_system]
- IP Address [cmdb_ci_ip_address]
- Network Adapter [cmdb_ci_network_adapter]
- Server [cmdb_ci_server]
- Software Installation [cmdb_sam_sw_install] (if the Software Asset Management (SAM) application is installed)
- Software [cmdb_ci_spkg] (if the SAM application isn't installed)
- Software Instance [cmdb_software_instance] (if the SAM application isn't installed)
- Storage Disk [cmdb_ci_storage_disk]
You can use the IntegrationHub ETL app to view the data maps. See IntegrationHub ETL for more information.
System property
sn_trellix_integ.getdevices_count. This property sets the pagination size for the records that are fetched from the
Trellix API.- Type: integer
- Default value:
100
sys_properties.list in the navigation filter.