Xanadu Security Management

Release: xanadu
ft:locale: English
ft:publication_title: Xanadu Security Management
ft:clusterId: security
bundleId: security
workflow: Technology

Security Operations
Exploring Security Operations
Now Assist for Security Incident Response
Exploring Now Assist for Security Incident Response
Supporting information for Now Assist for Security Incident Response
Configuring Now Assist for Security Incident Response
Configure and activate a skill for Now Assist for Security Incident Response
Customize a Now Assist for Security Incident Response skill
Inputs and triggers for Now Assist for Security Incident Response
Using Now Assist for Security Incident Response to close security incidents
Summarize a security incident with Now Assist for Security Incident Response
Generate closure notes for a security incident with Now Assist for Security Incident Response
Generate recommended actions for a security incident with Now Assist for Security Incident Response
Generate recommended actions in UI16 for a security incident with Now Assist for Security Incident Response
Generate a post-incident analysis for a security incident with Now Assist for Security Incident Response
Generate a post-incident analysis in UI16 for a security incident with Now Assist for Security Incident Response
Exploring correlation insights with Now Assist for Security Incident Response
Generate correlation insights from the Security Incident Response Workspace with Now Assist for Security Incident Response
Generate correlation insights with Now Assist for Security Incident Response
Request generative AI skills in the Now Assist panel for Now Assist for Security Incident Response
Using AI agentic workflows in Now Assist for Security Incident Response
Activate an agentic workflow for Now Assist for Security Incident Response
Security Incident Response AI agent collection close security incident use case
Close a security incident
Security Incident Response AI agent collection Resolve security incident agentic workflow
Resolve a security incident
Security Incident Response AI agent collection for the Analyze security operations metrics agentic workflow
Analyze security operations metrics agentic workflow
Now Assist for Vulnerability Response
Exploring Now Assist for Vulnerability Response
Supporting information for Now Assist for Vulnerability Response
Configuring Now Assist for Vulnerability Response
Activate an agentic workflow for Now Assist for Vulnerability Response
Using agentic workflows in Now Assist for Vulnerability Response
Vulnerability Response AI agent collection for the Assess vulnerability exposure agentic workflow
Assess vulnerability exposure agentic workflow
Vulnerability Response AI agent collection for the Analyze vulnerability remediation status agentic workflow
Analyze vulnerability remediation status agentic workflow
Unified Security Exposure Management
Explore
Security Exposure Management Workspace
Administration
Visualization library
Cloud Exposure view
Approvals view
Finding view
Remediation view
List view
Watch topics
Health Dashboard
Security Exposure Management workflow
Automating prioritization and triaging
Associating finding with a configuration item using lookup rules
Managing unmatched configuration items (CIs)
Managing unclassed hardware
Steps to help prevent duplicate or orphaned records after running lookup rules
Categorizing findings and discovered items using classification rules
Prioritizing vulnerabilities and other findings using roll-up calculators
Vulnerability Response Rollup Calculators
Assigning findings to remediation teams using assignment rules
Removing assignments from findings and remediation tasks
Defining your own service level agreements (SLAs) using remediation target rules
Deferring findings automatically without manual intervention using exception rules
Grouping multiple findings as remediation tasks for easy processing using remediation task rules
Closing stale detections and findings automatically using auto-close rules
Deleting stale findings automatically using auto-delete rules
Controlling the ingestion volume with automatic exclusion
Severity mapping for Unified Security Exposure Management
Implement
Migrate to USEM
Installing Security Exposure Management Workspace applications
Migration upgrade prerequisites
Install Unified Security Exposure Management
Download and activate applications
Security Exposure Management Workspace Roles
Access control lists (ACLs) for administration rules
Security Exposure Management Workspace personas and granular roles
Assign the Vulnerability Response persona roles using Setup Assistant
Manage persona and granular roles for Vulnerability Response
Configure rules to manage findings
Configuring lookup rules
Configuring classification rules
Configuring roll-up calculator rules
Configuring assignment rules
Configuring remediation target rules
Configuring an exception rule
Create an exception rule
Approve an exception rule request
Activating an exception rule
Reopen an exception rule
Update an approved exception rule
Delete an exception rule
Define fields and weights for the risk rule for Unified Security Exposure Management risk calculators
Configuring remediation task rules
Configuring auto-close rules
Configuring auto-delete rules
Configuring exclusion rules
Create or edit exclusion rules
Approve or reject an unassign request
Approval workflow configurations for unassign request
Configure Exception Management for Security Exposure Management
Request an exception using GRC: Policy and Compliance Management
Specify the duration of an exception requested for a remediation task
Configure email notifications in Unified Security Exposure Management
Configure email templates in Unified Security Exposure Management
Configure a severity map in the Security Exposure Management Workspace
Configure Visualization library
Create a custom widget
Update a widget
Localize widget titles
Integrate
Review Unified Security Exposure Management integrations
Use
Create a dashboard in the Findings view page
Reclassify unclassed hardware
Bulk edit in the Security Exposure Management Workspace
Using bulk edit in the Security Exposure Management Workspace
Update the state of records in bulk in the Security Exposure Management Workspace
Bulk edit host vulnerable items with patches and solutions
Assign records to an assignment group in bulk
Remove assignments for host vulnerable items in bulk
Request bulk exception in the Security Exposure Management Workspace
Bulk edit for false positive in the Security Exposure Management Workspace
Close records in bulk in the Security Exposure Management Workspace
Use the List view in the Security Exposure Management Workspace
Create a customized list of records
Create a remediation task manually in the Security Exposure Management Workspace
Enable or disable the import of test results for a Qualys test group
Modify the severity for a CVE or TPE
Use Remediation Effort records
Create a remediation effort in the Security Exposure Management Workspace
Create a remediation task on-demand from Remediation Effort in the Vulnerability Manager Workspace
Create a recurring remediation effort in the Security Exposure Management Workspace
Transfer records to remediation efforts in the Security Exposure Management Workspace
Approve or reject requests in the Security Exposure Management Workspace
Add a compensating control to the library
Associate compensating controls with CVEs or TPEs for risk reduction requests
Disable or enable risk reduction for a CVE or TPE
Examples for remediation task creation in the Security Exposure Management Workspace
Exception Management Overview
Approver roles required for Security Exposure Management Workspace
Questionnaire support in Exception Management via Smart Assessment
Questionnaire Configuration form fields
Configure an assessment template
Use case for False positive or Request Exception Questionnaire
Defer a Remediation task
Request an extension for a deferred remediation task
Request a false positive for a vulnerable item or remediate task
Unified Approvals View
Add an approver
Configure Approval List and Form View
Reviewing an Approval Request
Review questionnaire to approve or reject requets
Employee service center for Vulnerability Response
Managing Approvals via the Employee Service Center
Reference
Security Exposure Management Workspace Components
Security Exposure Management Workspace Roles
Security Exposure Management Workspace Tables
Security Exposure Management Workspace Scheduled Jobs
Security Exposure Management Knowledge Base articles
Security Exposure Management Workspace remediation task rule examples
Migration upgrade reference information
Security Exposure Management Workspace Roles
Visualization widget fields
Re-evaluating the exceptions for selected records in the Security Exposure Management Workspace
Vulnerability Response
Exploring the Vulnerability Response application
Migrating to USEM
USEM migration planning
Installation of Vulnerability Response and supported applications
Vulnerability Response personas and granular roles
Vulnerability Response assignment rules overview
Vulnerability Response remediation tasks and remediation task rules overview
Vulnerability Response remediation target rules
Vulnerability classification groups and rules
Machine Learning solutions for Vulnerability Response
CI lookup rules for identifying configuration items from Vulnerability Response third-party vulnerability integrations
Unclassed hardware
Unmatched CIs
Creating CIs for Vulnerability Response using the Identification and Reconciliation engine
Updating CI class for unmatched cloud assets
Discovered Items
CI changes for discovered items
Re-evaluating discovered items
Vulnerability Response remediation task and vulnerable item states
Vulnerable item age calculation and display
Removing assignments from vulnerable items and remediation tasks
Vulnerability Response calculators and vulnerability calculator rules
Vulnerability Response vulnerable item detections from third-party integrations
Vulnerability Solution Management
Understanding the Microsoft Security Response Center Solution Integration
Understanding the Red Hat Solution Integration
Rapid7 solution management
Generic framework to ingest data from any solution vendor
Patch orchestration with Vulnerability Response
Exception Management overview
Exception rules overview
Exclusion rules overview
False Positive overview
Questionnaire support in Exception Management via Smart Assessment
Configure Assessment template
Smart Assessment workflow
Questionnaire for False positive or Request Exception
Watchdog for Vulnerability Response
Change management for Vulnerability Response
Software exposure assessment using Software Asset Management (SAM Foundation)
Vulnerability Crisis Management
Domain separation and Vulnerability Response
Service Mapping in Vulnerability Response
Vulnerability Response implementation
Migrate to USEM
Install Vulnerability Response
Components installed with Vulnerability Response
Configuring Vulnerability Response using the Setup Assistant
Assign the Vulnerability Response persona roles using Setup Assistant
Manage persona and granular roles for Vulnerability Response
Install Vulnerability Response third-party applications using Setup Assistant
Importing data with the NVD and CWE integrations and managing third-party libraries
Install the Solution Management for Vulnerability Response application
Install and configure the Performance Analytics for Vulnerability Response [PA] application
Vulnerability Response applications and CSDM tables
Create or edit Vulnerability Response assignment rules
Create a Vulnerability Response assignment rule using ML
Create a Vulnerability Response assignment rule for service support
Create or edit Vulnerability Response remediation task rules
Define fields and weights for the risk rule for Vulnerability Response Risk Calculators
Vulnerability Response Rollup Calculators
Create or edit a Vulnerability Response remediation target rule
Recalculate RT date
Examples
Configure installed third-party integrations using the Setup Assistant
Configure installed solution integrations for Vulnerability Solution Management using Setup Assistant
Configure the MS TVM Vulnerability Integration using Setup Assistant
Configure the Qualys Vulnerability Integration using Setup Assistant
Configure the Tenable Vulnerability Integration using Setup Assistant
Setting up vulnerability solution providers
Prepare solution integration checklist
Preparing the Common Vulnerability Reporting Framework (CVRF) solution integration
Preparing the Common Security Advisory Framework (CSAF) solution integration
Configure vulnerability solution providers
Common Vulnerability Reporting Framework (CVRF)
Import Common Vulnerability Reporting Framework data through file import
Configure Connection and Credential aliases
Configure a Common Vulnerability Reporting Framework vendor other than Cisco
Import Common Vulnerability Reporting Framework data from advisories
Import Common Vulnerability Reporting Framework (CVRF) data through CVRF URL
Troubleshooting Common Vulnerability Reporting Framework data import
Common Security Advisory Framework (CSAF)
Import Common Security Advisory Framework data through file import
Configure Connection and Credential aliases for the Common Security Advisory Framework (CSAF)
Configure a Common Security Advisory Framework vendor other than Red Hat
Import Common Security Advisory Framework data from advisories
Import Common Security Advisory Framework (CSAF) data through CSAF URL
Troubleshooting Common Security Advisory Framework data import
Additional Vulnerability Response setup and configuration tasks
Quick start tests for Vulnerability Response
Run the Automated Test Framework (ATF) test suite for Vulnerability Response
Install Vulnerability Assignment Recommendations for Vulnerability Response
Configure Vulnerability Assignment Recommendations for Vulnerability Response
Create and train a solution definition for Vulnerability Response
Create a Vulnerability Response calculator
Disable the default vulnerability calculator if not used
Create, enable, or, modify Vulnerability Response auto delete rules
Add vulnerability significance charts to the Vulnerability Response homepage
Define Vulnerability Response email notifications
Define Vulnerability Response email templates
Create or edit remediation target notifications
Configure the Vulnerability Exposure Assessment
Configure Exception Management for Vulnerability Response
Add an exception approver
Configure approval rules for Exception Management
Create configurations for an approval rule
Create approval levels for Exception Management
Exception management workflow versus flow designer
Add a false positive approver
Configure questionnaire for risk reduction
View Vulnerability Response SLAs for remediation tasks
Configure watchdog
Configure maximum rows in related list
Advanced Vulnerability Response configuration tasks
Create domain-separated imports for an integration
Create and support multiple domains in the background jobs framework
Create a Vulnerability Response CI lookup rule
Ignore CI classes
Filter decommissioned CIs
Auto-promote CIs
Detection key configurations for Vulnerability Response
Run detection key configuration
Configure the vulnerable item key
Adding proof to Rapid7 vulnerable item keys
Delete all your vulnerable item records and related data in Vulnerability Response
Filtering within Vulnerability Response
Severity mapping for Vulnerability Response
Create a Vulnerability Response severity map
Define service classifications for Vulnerability Response reporting and related lists
Audit selected fields in the vulnerable items table
Vulnerability Response background job framework configuration
Define background job configurations in Vulnerability Response
Advanced parallel processing for background jobs in Vulnerability Response
Vulnerability Response integrations
Understanding the NVD integrations
Preparing for the NVD integrations
Configure and run the scheduled job for updating CWE records
Install the Vulnerability Response Integration with the NIST National Vulnerability Database
Optional NVD integration modification and activities
Perform a manual NVD integration import
View the (National Vulnerability Database) NVD integration import run status
Add CVEs to third-party entries
View Vulnerability Response vulnerability libraries
CISA Known Exploit Vulnerability (KEV) Integration
Preparing for the CISA integration
Install the ServiceNow Vulnerability Response Integration with CISA application
Understanding the Exploit Prediction Scoring System (EPSS) integration
Configure and run a scheduled job to update CVE records with EPSS data
Add EPSS Score condition in Risk calculator Business Rule
Understanding the Microsoft Threat and Vulnerability Management Vulnerability integration
Preparing for the Microsoft Threat and Vulnerability Management Vulnerability Integration
Set up Microsoft Azure for the MS TVM integration
Install and configure the Vulnerability Response Integration with the MS TVM application using Setup Assistant
Data retrieval settings for the Microsoft Threat and Vulnerability Management Integration
REST messages for the Microsoft Threat and Vulnerability Management Vulnerability Integration
Data transformation for the Microsoft Threat and Vulnerability Management Vulnerability Integration
Integration run status chart for the Microsoft Threat and Vulnerability Management Vulnerability Integration
Verify the Microsoft Threat and Vulnerability Management integration import run status
Split Microsoft TVM detections based on the vulnerability instance to split vulnerable items
Understanding the HCL BigFix patch orchestration integration with Vulnerability Response
Integrations and dependencies of the Vulnerability Response Patch Orchestration integration with HCL BigFix
Prepare for the Vulnerability Response Patch Orchestration integration with HCL BigFix
Install the Vulnerability Response Patch Orchestration with HCL BigFix application
Configure the Vulnerability Response patch orchestration integration with HCL BigFix
Viewing patch data for the Vulnerability Response patch orchestration integration with HCL BigFix
Schedule patches with the Vulnerability Response patch orchestration integration HCL BigFix
REST messages for the Vulnerability Response patch orchestration integration with HCL BigFix
Data transformation for the patch orchestration integration with HCL BigFix
Example workflow for the Vulnerability Response patch orchestration integration with HCL BigFix
Understanding the Vulnerability Response patch orchestration integration with Microsoft SCCM
Integrations and dependencies of the Vulnerability Response Patch Orchestration with the Microsoft SCCM application
Prepare for the Vulnerability Response patch orchestration integration with Microsoft SCCM
Install the Vulnerability Response Patch Orchestration with Microsoft SCCM application
Configure the Vulnerability Response Patch Orchestration with Microsoft SCCM integration
Viewing patch data and patch data rollup for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM
Schedule patches with the Microsoft SCCM integration with Vulnerability Response
REST messages for the Vulnerability Response Patch Orchestration with Microsoft SCCM
Data transformation for the Patch Orchestration with Microsoft SCCM Integration
Example workflow for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM
Understanding the Qualys Vulnerability Integration
Preparing for the Qualys Vulnerability Integration
Install the Qualys Vulnerability Integration
Activate the Qualys scanners
Installed components
Update configuration items with the network partition identifier for the Qualys Vulnerability Integration
Optional Qualys modifications
Advanced Qualys configurations and modifications
Qualys metadata for vulnerabilities
Import additional metadata from Qualys
Qualys metadata values for vulnerabilities
Set additional filter parameters for Qualys imports
Resolving Qualys Vulnerability Integration issues
Qualys Vulnerability Integration reporting
Qualys integration run status chart
Qualys data transformation
Dynamic Search List Import
Static Search List Import
Asset Group Import
Appliance Import
REST messages
Understanding the Rapid7 Vulnerability Integration
Preparing for the Rapid7 Vulnerability Integration
Set up for the Rapid7 data warehouse Integration
Set up for the Rapid7 InsightVM Integration
Install the Rapid7 Vulnerability Integration
Configure the Rapid7 Vulnerability Integration
Filtering by Rapid7 sites
Prepend SITE to your Rapid7 InsightVM site tags
Deduplicate Rapid7 Vulnerability Integration data warehouse records
Rapid7 Vulnerability Integration run status chart
View the Rapid7 Vulnerability Integration import runs status dashboard
Initiate rescan for the Rapid7 Vulnerability Integration
Set additional filter parameters for Rapid7 InsightVM imports
Understanding the Shodan Exploit Integration
Preparing for the Shodan Exploit Integration
Install and configure the Shodan Exploit Integration for Security Operations
Set Shodan Exploit Integration import time
Perform a manual Shodan exploit import
View the Shodan Exploit Integration import run status
Understanding the Tenable Vulnerability Integration
Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications
Tenable.sc integrations with the Vulnerability Response application
Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application
Preparing for the Tenable Vulnerability Integration
Install the Vulnerability Response Integration with Tenable application using Setup Assistant
Data retrieval settings for the Tenable Vulnerability Integration
REST messages for the Tenable Vulnerability Integration
Data transformation
Set additional filter parameters for Tenable.io imports
Tenable Vulnerability Integration reporting
Integration run status chart for the Tenable Vulnerability Integration
Initiate rescan for the Tenable.sc integration
Initiate rescan for the Tenable.io integration
Update configuration items with the network partition identifier for the Tenable Vulnerability Integration
Import modifications for the Tenable Vulnerability Integration
Split Tenable detections
Configure Test Result Granularity
Understanding the Atlassian Jira integration with Vulnerability Response
Preparing for the Jira Vulnerability Response integration
Install the Vulnerability Response Integration with Jira
Configure rules in the agile tool configuration
Create agile issue manually using list action
Create agile issue manually using form action
Manually synchronize the status of the Jira issue
Configure scheduler to create issues automatically
Configure scheduler to update issues automatically
Configure scheduler to synchronize the Jira status to ServiceNow automatically
Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application
Integration run status chart for Prisma Cloud Compute Integration
Wiz Vulnerability Response Integration
Install
Configure
Identify Wiz Resource types for import
Filter host vulnerabilities
Filter container vulnerabilities
Configure container vulnerable item keys
Filter test results
Filter issues
Filter host test results
Backfill integrations
Use
Field mapping
Manually create a vulnerability integration
Define a new vulnerability integration
Vulnerability integration script
Single call integrations
Multiple call integrations
Attachments as retrieveData() return values
Report processor strategies
Use the data source attachment report processor strategy
About custom report processor scripts
Integration factory script fields
Manually run a vulnerability integration
Manual ingestion of vulnerabilities
Ingest vulnerabilities manually
Verify manual integration run
Configure auto-close manual detections
Verify upload status
Template for manual ingestion of vulnerabilities
Vulnerability Response remediation overview
Verify successful completion of Vulnerability Response integration imports
View Vulnerability Response vulnerable item detection data
Verify Vulnerability Response vulnerable item detection data on integration run (VINTRUN) records
Viewing patch data and scheduling patches in Vulnerability Response
Patch data and state rollup for patch orchestration in Vulnerability Response
View patches without solutions in Vulnerability Response
Viewing patch orchestration data on the Vulnerability Response dashboards
View a solution
Create a vulnerability solution
Manually exclude solutions from third-party records or vice versa
Triage vulnerabilities automatically
Edit vulnerable items in bulk in Vulnerability Response
Ungrouped Vulnerability Response vulnerable items
View ungrouped Vulnerability Response vulnerable items
Manually add a vulnerable item to a remediation task
Remove assignments from vulnerable items and remediation tasks
Approve or reject an unassign request in Vulnerability Response
Automatic closing of vulnerable items and detections
Working with retired configuration items
Automatically close vulnerable items related to retired CIs
Closing stale detections in Vulnerability Response
Automatically close stale detections in Vulnerability Response
Create auto-close rules
Reclassify unclassed hardware
Manually create a remediation task in Vulnerability Response
Add users to the Vulnerability Response group
Manage individual vulnerable items manually
Create Vulnerability Response vulnerable items
Defer a vulnerable item
Request an extension for a deferred vulnerable item
Refresh Vulnerability Response vulnerable items
Identify and escalate security issues in third-party software
Identify and escalate security issues using NVD
Identify and escalate security issues using CWE
View the remediation target status of a Vulnerability Response vulnerable item
Working with unmatched CIs
View and reclassify unmatched configuration items
Reconcile unmatched discovered items
Reapply CI lookup rules on selected discovered items
Reapply CI Lookup Rules Enhancements
Steps to help prevent duplicate or orphaned records after running Vulnerability Response CI lookup rules
De-duplicating existing configuration items
Working with unmatched CIs
Resolve remediation tasks
Defer a Remediation task
Request an extension for a deferred remediation task
Close a remediation task
Identifying duplicate vulnerable items from multiple scanners
Automatically resolve duplicate vulnerabilities
Create and edit a classification group
Create and edit a classification rule
Apply a rule to an existing vulnerability
Deactivate or delete a classification rule
Create an exclusion rule
Change Management tasks for Vulnerability Response
Create a change request from a remediation task
Associate a remediation task to an existing change request
Split a remediation task
State synchronization between change requests and remediation tasks
Assess your exposure to vulnerable software
Viewing assignment recommendations
Request assignment group recommendations for a vulnerable item
Request assignment group recommendations for multiple vulnerable items
Request assignment group recommendations for a remediation task
Requesting and approving an exception
Request an exception for a vulnerable item
Request an exception for a remediation task
Request a bulk exception
Request an exception using GRC: Policy and Compliance Management
Request a bulk exception using GRC: Policy and Compliance Management
Approve or reject an exception request in Vulnerability Response
Working with an exception rule
Create an exception rule
Approve an exception rule request
Activating an exception rule
Request an extension for an exception rule
Reopen an exception rule
Update an approved exception rule
Delete an exception rule
Marking and approving a false positive
Mark as a false positive
Bulk edit for false positive
Approve or reject a false positive
Analytics and Reporting Solutions for Vulnerability Response
Using the default Vulnerability Response dashboards
Platform Analytics Solutions for Vulnerability Management
Vulnerability Management CISO dashboard
Configure the Scan Coverage reports
Configure the PA indicators for the CISO Dashboard
SecOps Vulnerability Response Health dashboard
Modifying the threshold values
Vulnerability Management (PA) dashboard
View Performance Analytics for Vulnerability Response [PA] reports in real-time
View the Performance Analytics indicators for Vulnerability Response [PA]
Aggregated reports framework
Configure an aggregation for source data
Run multiple aggregations simultaneously
Configure the number of aggregations that can run simultaneously
Create a report using an aggregation
Vulnerability Response reference information
Implementation checklist for the Vulnerability Response application
Vulnerability Response remediation task states
Detections, remediation tasks, and vulnerable item states
Remediation tasks and vulnerable item states
State roll-up and roll-down scenarios
Remediation task state for Vulnerable Items (VITs) in multiple groups
Additional settings for domain separation
Discovered Items form fields
Vulnerability Response vulnerability form fields
Remediation target rule fields
Remediation task form fields
Questionnaire Configuration form fields
Vulnerability Response vulnerable item form fields
Solution form fields
Approval workflow configurations for unassign request
Vulnerability Response remediation task rule examples
Risk score calculation example for Vulnerability Response
Error handling for detections
Mobile experience for Vulnerability Response
Set up checklist for the Vulnerability Response Mobile app
Log in to the Vulnerability Response Mobile app
View, assign, and edit remediation tasks with the Vulnerability Response Mobile app
View, reassign, and edit remediation tasks assigned to you with the Vulnerability Response Mobile app
Search for remediation tasks with the Vulnerability Response Mobile app
Filter records with the Vulnerability Response Mobile app
Vulnerability Response Orchestration
Scan vulnerability workflow
Scan vulnerability item workflow
Variables for Create Scan Record for Vulnerabilities activity
Application Vulnerability Response
Exploring Application Vulnerability Response
Configuring Application Vulnerability Response
Configure Application Vulnerability Response
Verify that the scheduled job for updating CWE records is running
Verify that the scheduled job for updating NVD records is running
Activate Application Vulnerability Response Integrations
Define Application Vulnerability Response email notifications
Create or edit remediation target notifications in Application Vulnerability Response
Exception Management in Application Vulnerability Response
Configure Exception Management for Application Vulnerability Response
Configure approval rules for Exception Management
Deferring remediation in Application Vulnerability Response
Add an exception approver for Application Vulnerability Response
Requesting and approving an exception in Application Vulnerability Response
Request an exception for an application vulnerable item
Request an exception for application vulnerabilities using GRC: Policy and Compliance Management
Request an exception for an application remediation task
Approve exception rules and exception rule extension requests in Application Vulnerability Response
Define policy reason mapping
Request an extension for an exception rule in Application Vulnerability Response
Request an extension for a deferred remediation task in Application Vulnerability Response
Request an extension for a deferred application vulnerable item in Application Vulnerability Response
Create, delete, and cancel an exception rule for Application Vulnerability Response
Application Vulnerability Response remediation tasks and task rules overview
Create, edit, and delete Application Vulnerability Response remediation task rules
Create an application remediation task manually in Application Vulnerability Response
Create auto-close rules
Configure penetration testing
Configure sprints for penetration testing
Configure assessment types for penetration testing
Integrating Application Vulnerability Response with other applications
Vulnerability Response Integration with Black Duck
Prepare pre-integration tasks for Vulnerability Response Integration with Black Duck
Install the ServiceNow Vulnerability Response Integration with Black Duck
Configure the Vulnerability Response Integration with Black Duck
View the Vulnerability Response Integration with Black Duck import run status
Data transformation for the Vulnerability Response Integration with Black Duck
Import the project information from the Black Duck integration instance
Import Vulnerability Response Integration with Black Duck project versions to the Discovered Applications table
Import the application vulnerable items from the Vulnerability Response Integration with Black Duck
Set the import times for the Vulnerability Response Integration with Black Duck
Include Closed Black Duck application vulnerable items
Fortify on Demand Vulnerability Integration
Preparing for the Fortify on Demand Vulnerability Integration
Install the ServiceNow Vulnerability Response Integration with Fortify on Demand
Configure the Fortify on Demand Vulnerability Integration
View the Fortify Vulnerability Integration import run status
Fortify on Demand Vulnerability modification and activities
Perform a manual Fortify application vulnerability import
Import data using the Fortify on Demand Vulnerability Integration
Include Closed Fortify on Demand application vulnerable items
GitHub Application Vulnerability Integration
Preparing for the GitHub Application Vulnerability Integration
Creating OAuth 2.0 credentials for GitHub Apps - JWT for the GitHub Application Vulnerability Integration
Install the ServiceNow GitHub Application Vulnerability Integration
Configure the GitHub Application Vulnerability Integration
View the GitHub Application Vulnerability Integration import run status and imported repository data
View GitHub Application Vulnerability Integration import sets
Invicti Vulnerability Integration
Prepare for the Invicti Vulnerability Integration
Install the ServiceNow Vulnerability Response Integration with Invicti
Configure the Invicti Vulnerability Integration
Viewing the Invicti Vulnerability Integration import run status and records
Invicti Vulnerability Integration state mapping
Veracode Vulnerability Integration
Preparing for the Veracode Vulnerability Integration
Install the ServiceNow Vulnerability Response Integration with Veracode
Configure the Veracode Vulnerability Integration
View the Veracode Application Vulnerability Integration import run status
View Veracode scan summaries
Data transformation for the Veracode Vulnerability Integration
Veracode Vulnerability Integration modifications and activities
Manual ingestion of vulnerabilities for Application Vulnerability Response
Upload application vulnerabilities using a template file
Verify integration run
Verify upload status
Tenable Web Application Scanning Vulnerability Response Integration
Configure Tenable Web Application Scanning Vulnerability Response Integration using Setup Assistant
Import Applications Data from Tenable Web Application Scanning Vulnerability Response Integration
Import Vulnerabilities Data from Tenable Web Application Scanning Vulnerability Response Integration
Remediating Application Vulnerability Response vulnerabilities
View vulnerability libraries
Application Vulnerability fields
Identify applications in Application Vulnerability Response automatically
Create a CI lookup rule
Reapplying CI Lookup rules in Application Vulnerability Response
Prevent duplicate or orphaned records after running Application Vulnerability Response CI lookup rules
Assign application vulnerable items in Application Vulnerability Response automatically
Create or edit Application Vulnerability Response assignment rules
Removing assignments from Application Vulnerability Response vulnerable items and remediation tasks
Calculate risk in Application Vulnerability Response automatically
Define fields and weights for the risk rule
Create an application vulnerability calculator
Map the severity of an application vulnerable item automatically
Filtering within Application Vulnerability Management
Automate remediation target tracking in Application Vulnerability Response
Create or edit application remediation target rules
View the remediation target status of an application vulnerable item
Close a remediation task
Change Management for Application Vulnerability Response
Create a change request for Application Remediation task
Associate a remediation task to an existing change request
Penetration testing
Create a penetration test assessment request from existing requests (v19.0)
Create a penetration test assessment request (prior to v19.0)
Replicate a penetration test request in closed state
Create penetration test findings based on assessment requests (prior to v19.0)
Create an application vulnerability entry
Penetration testing workspace
Create a new penetration testing assessment request
Create penetration test findings based on an assessment questionnaire
Publish the assessment questionnaire
Use an assessment questionnaire
Penetration Testing Dashboard
Penetration Dashboard components
Understanding compensating controls for risk reduction in Application Vulnerability Response
Platform Analytics Solutions for Application Vulnerability Response
Application Vulnerability Management (PA) dashboard
My Application Vulnerabilities dashboard
Aggregated reports framework for Application Vulnerability Response
Application Vulnerability Response references
Application Vulnerability Response user groups and roles
Components installed with Application Vulnerability Response
Application Vulnerable Item (AVI) states
Application Vulnerability Response remediation task rule examples
Scanned application fields
Application Vulnerable Item fields
Penetration testing states
Managing state mapping for deferrals and false positives in Application Vulnerability Response
Application Vulnerability Response references
Exception rule example for Application Vulnerability Response
Application Vulnerability Response product view
Container Vulnerability Response
Exploring Container Vulnerability Response
Container Vulnerability Response remediation task and container vulnerable item states
Configuring Container Vulnerability Response
Install Vulnerability Response and Configuration Compliance for Containers
Define Container Vulnerability Response email notifications
Create or edit remediation target notifications
Configure Exception Management for Container Vulnerability Response
Configure approval rules for Exception Management
Quick start tests for Container Vulnerability Response
Run the Automated Test Framework (ATF) test suite for Container Vulnerability Response
Integrating Container Vulnerability Response with other applications
Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration
Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute
Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application
Wiz Container Vulnerability Integration
Remediating container vulnerabilities
Container Vulnerability Response calculator rules
Container Vulnerability Response assignment rules
Container Vulnerability Response remediation target rules
Exception management in Container Vulnerability Response
Requesting and approving an exception in Container Vulnerability Response
Request an exception for a container vulnerable item
Request an exception for a container remediation task
Request an exception for container vulnerabilities using GRC: Policy and Compliance Management
Define a policy reason mapping
Approve an exception request in Container Vulnerability Response
Defer a container vulnerable item in Container Vulnerability Response
Request an extension for a deferred container vulnerable item
Working with an exception rule in Container Vulnerability Response
Create an exception rule in Container Vulnerability Response
Activating an exception rule in Container Vulnerability Response
Reopen an exception rule in Container Vulnerability Response
Update an approved exception rule in Container Vulnerability Response
Delete an exception rule in Container Vulnerability Response
Request an extension for a deferred remediation task in Container Vulnerability Response
Request an extension for an exception rule in Container Vulnerability Response
Marking and approving a false positive container vulnerability item
Mark as a false positive in Container Vulnerability Response
Approve a false positive
Container Vulnerability Response remediation tasks and task rules overview
Create, edit, and delete Container Vulnerability Response remediation task rules
Create auto-close rules for Container Vulnerability Response
Removing assignments from container vulnerable items and remediation tasks
Close a remediation task
IT Operations Management and pattern discovery
Analytics and Reporting Solutions for Container Vulnerability Response
Container Vulnerability Response dashboard
Aggregated reports framework for Container Vulnerability Response
Container Vulnerability Response reference
Components installed with Container Vulnerability Response
Container Vulnerability Response glossary
Container Vulnerable Item form fields
Prisma Cloud Compute Configuration form
Request Exception form
Exception Rule form
Domain separation and Container Vulnerability Response
Configuration Compliance
Exploring Configuration Compliance
Configuration Compliance imported data
Configuration Compliance discovery
Configuration Compliance correlation
Discovered Items for Configuration Compliance
CI changes for discovered items for Configuration Compliance
Reconcile unmatched discovered items for Configuration Compliance
Reapply CI lookup rules on selected discovered items for Configuration Compliance
The Tenable Vulnerability Integration with Configuration Compliance
CI Lookup Rules for identifying configuration items from Configuration Compliance third-party vulnerability integrations
Deduplicating existing configuration items for Configuration Compliance
Creating CIs for Configuration Compliance using the Identification and Reconciliation Engine
Configuration Compliance assignment rules overview
Removing assignments from Configuration Compliance remediation tasks
Configuration Compliance remediation tasks and remediation task rules overview
Configuring calculator groups and calculators for Configuration Compliance
Configuration Compliance Exception Management overview
Configuration Compliance change management
Setting up, installing, and configuring the Configuration Compliance application
Install Configuration Compliance
Components installed with Configuration Compliance
Create or edit Configuration Compliance assignment rules
Configuration Compliance remediation target rules
Configuration Compliance calculator groups
Create a Configuration Compliance calculator group
Configuration Compliance calculators and calculator rules
Define fields and weights for the risk rule
Edit risk rollup calculators for Configuration Compliance
Create, edit, and reapply risk calculators for Configuration Compliance
Examples for Configuration Compliance risk score calculation
Create or edit Configuration Compliance remediation task rules
Specify the duration of an exception requested for a remediation task
Configure Exception Management for Configuration Compliance
Add an exception approver for Configuration Compliance
Create a Configuration Compliance criticality map
Create email notifications
Configure approval rules for Exception Management in Configuration Compliance
Create configurations for an approval rule in Configuration Compliance
Create approval levels for Exception Management in Configuration Compliance
Exception management workflow versus flow designer in Configuration Compliance
Configuration Compliance integrations
Microsoft Defender for Cloud Integration for Security Operations
Install and configure Microsoft Defender for Cloud Integration for Security Operations
Configuration Compliance imported data for Microsoft Defender for Cloud Integration
Understanding the Vulnerability Response Integration with Palo Alto Prisma Cloud
Preparing for installing the Vulnerability Response Integration with Palo Alto Prisma Cloud
Install and configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application
Configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application
Verify the Vulnerability Response Integration with Palo Alto Prisma Cloud import run status
Data mapping
Prisma Cloud REST Messages
Qualys
Configure PCRS
Components installed with the Qualys Integration for Security Operations
Update configuration items with the network partition identifier for the Qualys Integration
Set Import Filters
Resolving Qualys Vulnerability Integration issues
Attachments not appearing after import
Modify transform maps
Check XML attachment property size
Data retrieval limitations
Qualys Knowledge Base Integration is failing
Qualys integration run status chart
REST messages
Understanding the Tenable Vulnerability Integration
Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications
Tenable.sc integrations with the Vulnerability Response application
Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application
Preparing for the Tenable Vulnerability Integration
Install the Vulnerability Response Integration with Tenable application using Setup Assistant
Data retrieval settings for the Tenable Vulnerability Integration
REST messages for the Tenable Vulnerability Integration
Data transformation
Set additional filter parameters for Tenable.io imports
Tenable Vulnerability Integration reporting
Integration run status chart for the Tenable Vulnerability Integration
Initiate rescan for the Tenable.sc integration
Initiate rescan for the Tenable.io integration
Update configuration items with the network partition identifier for the Tenable Vulnerability Integration
Import modifications for the Tenable Vulnerability Integration
Split Tenable detections
Configure Test Result Granularity
Explore Wiz Test Results and Issues
Configuration Compliance remediation
Manually create a Configuration Compliance remediation task
Manually create a Configuration Compliance remediation task from the Test Results list
Create a change request in Configuration Compliance
Associate a remediation task to an existing change request
Split a remediation task
Remove assignments from remediation tasks for you or your groups
Approve an unassign request in Configuration Compliance
Automatic closing of test results
Working with retired configuration items in Configuration Compliance
Automatically close test results related to retired CIs
Automatically closing stale test results in Configuration Compliance
Use Auto-Close Stale Test Results in Configuration Compliance
Close a remediation task
Requesting and approving an exception for a remediation task
Request an exception for a remediation task in Configuration Compliance
Request an extension for an exception rule in Configuration Compliance
Request an exception for remediation tasks using GRC: Policy and Compliance Management
Approve an exception request in Configuration Compliance
Define policy reason mappings
Analytics and reporting for Configuration Compliance
Reporting overview
Configuration Compliance dashboard
Activate Performance Analytics for Configuration Compliance
Viewing the Performance Analytics for Configuration Compliance dashboard
Aggregated reports framework for Configuration Compliance
Configuration Compliance reference information
View Configuration Compliance test groups
View Configuration Compliance authoritative sources
View Configuration Compliance technologies
View Configuration Compliance tests
View Configuration Compliance test results
View a remediation task
Test result and remediation task state transitions in the Configuration Compliance application
State synchronization
Domain separation and Configuration Compliance
Test Results fields
Configuration Compliance criticality maps
States, precedence, examples
Resolving Configuration Compliance import issues
Modify Qualys PC Results start date
CI lookup rules for Microsoft Defender for Cloud Integration for Security Operations and Palo Alto Prisma Cloud
Vulnerability Response Workspaces
Patch orchestration with the Vulnerability Response Workspaces
Vulnerability Response Workspaces and updates to remediation tasks and remediation task rules
Configure the Vulnerability Response Workspaces
Vulnerability Manager Workspace
Exploring the Vulnerability Manager Workspace
Home page in the Vulnerability Manager Workspace
Watch Topics page in the Vulnerability Manager Workspace
Related items list and visualizations in a watch topic
Remediation efforts in the Vulnerability Manager Workspace
Life cycles of remediation efforts, remediation tasks, and records in the Vulnerability Response Workspaces
Dashboards in the Vulnerability Manager Workspace
List page in the Vulnerability Manager Workspace
Bulk edit in the Vulnerability Manager Workspace
Understanding compensating controls for risk change
Analytics and reporting solutions for the Unified Vulnerability Response Dashboard
Unified Vulnerability Response Dashboard
Monitoring and managing vulnerable items and test results in the Vulnerability Manager Workspace
Open search results in Vulnerability Manager Workspace
Create and apply filters the summary of active records (VITs, AVITs, CVITs and CTRs)
Use watch topics in the Vulnerability Manager Workspace
Create a watch topic in the Vulnerability Manager Workspace
Edit or delete a watch topic in the Vulnerability Manager Workspace
Deactivate or activate a watch topic
Use Remediation Effort records
Create a remediation effort in the Vulnerability Manager Workspace
Create a remediation task on-demand in the Vulnerability Manager Workspace
Create a recurring remediation effort in the Vulnerability Manager Workspace
Transfer records to remediation efforts in the Vulnerability Manager Workspace
Add a compensating control to the library
Associate compensating controls with CVEs or TPEs for risk change requests
Disable or enable risk change for a CVE or TPE
Rescan records and remediation tasks in the Vulnerability Manager Workspace
Re-evaluate the remediation properties of the records in the Vulnerability Manager Workspace
Use the List view in the Vulnerability Manager Workspace
Create a customized list of records
Create a remediation task manually from the Vulnerability Manager Workspace
Enable or disable the import of test results for a Qualys test group
Modify the severity for a CVE or TPE
Approve or reject requests in the Vulnerability Manager Workspace
Set up email notifications in the Vulnerability Response Workspaces
Remediating vulnerable items and test results in the Vulnerability Manager Workspace
Using bulk edit in the Vulnerability Manager Workspace
Update the state of records in bulk in the Vulnerability Manager Workspace
Bulk edit host vulnerable items with patches and solutions
Assign records to an assignment group in bulk
Remove assignments for host vulnerable items in bulk
Request bulk exception in the Vulnerability Manager Workspace
Bulk edit for false positive in the Vulnerability Manager Workspace
Close records in bulk in the Vulnerability Manager Workspace
Request exceptions for remediation tasks and records from the Vulnerability Manager Workspace
Request an extension for a deferred vulnerable item in the Vulnerability Manager workspace
Vulnerability Manager Workspace reference information
Create Watch Topic form fields
GRC request exception form fields
Generate remediation digest form fields
Impact of the compensating controls on risk score and expiration date
Examples for remediation task creation in the Vulnerability Manager Workspace and IT Remediation Workspace
Re-evaluating the exceptions for selected records in the Vulnerability Manager Workspace
IT Remediation Workspace
Exploring the IT Remediation Workspace
View a workflow example in the IT Remediation Workspace
Home page in the IT Remediation Workspace
Dashboards in the IT Remediation Workspace
List page in the IT Remediation Workspace
Using the IT Remediation Workspace
Use the email digest in the Vulnerability Response Workspaces
Open search results in IT Remediation Workspace
Create a list in the IT Remediation Workspace
Use records in the IT Remediation Workspace
Use remediation task records in the IT Remediation Workspace
Assign a remediation task or record to yourself in the IT Remediation Workspace
View configuration items with vulnerabilities in the IT Remediation Workspace
Create a change request in the IT Remediation Workspace
Create a remediation task manually in the IT Remediation Workspace
Split a remediation task in the IT Remediation Workspace
Request a false positive in the IT Remediation Workspace
Request false positive for a set of test results
Request an exception in the IT Remediation Workspace
Request an exception using GRC: Policy and Compliance Management in the IT Remediation Workspace
Request risk change in the IT Remediation Workspace
Rescan vulnerable items and remediation tasks in the IT Remediation Workspace
Rescan Qualys vulnerable items from the Vulnerability Response workspaces
Rescan Rapid7 vulnerable items from the Vulnerability Response workspaces
Rescan Tenable.io and Tenable.sc vulnerable items from the Vulnerability Response workspaces
IT Remediation Workspace reference information
Create change request form fields
Request exception form fields for policy exceptions
Request exception form fields for risk reduction
Explore the Vulnerability Assessment workspace
Exploring exposure assessment
Exposure assessment by CVE
Add CVEs to assess exposure
Create VIs for CVEs for exposure assessment
Activate or deactivate CVEs for exposure assessment
Export impacted CIs for exposure assessment
Confidence score calculation example
View vulnerable software details
Confidence score reference tables for exposure assessment
Exposure assessment by software
Add software for exposure assessment
Create VIs for software for exposure assessment
Activate or deactivate software for exposure assessment
Export impacted CIs for software in the Vulnerability Assessment workspace
Exposure assessment by publisher software
Add software by a publisher for exposure assessment
Create VIs for software by a publisher for exposure assessment
Activate or deactivate software by a publisher for exposure assessment
Export impacted CIs for software by a publisher in the Vulnerability Assessment workspace
Exploring vulnerability assessment
Create a vulnerability assessment record
Update the vulnerability assessment auto-flush record
Modify the vulnerability assessment record
Perform an assessment
Assessment tab
Overview tab
Assign a priority and exposure level to the vulnerability assessment record
Add affected CIs to the assessment record
Create vulnerable items for the affected CI or affected software component
Link the vulnerability assessment record to major security incident in Major Security Incident Management
Software Bill of Materials
Exploring Software Bill of Materials
Exploring supported applications for Software Bill of Materials
Configuring Software Bill of Materials
Install the supported applications for Software Bill of Materials
Configuring the Deps.dev, OSV.dev, and PaCE integrations for Software Bill of Materials
Uploading and viewing your SBOM files in the SBOM Workspace
Uploading Software Bill of Materials files using a REST API
Upload Software Bill of Materials files manually
Uploading Software Bill of Materials for DevOps SBOM files
Classifying licenses and resolving component licenses in the Software Bill of Materials workspace
Classify imported licenses in the Software Bill of Materials Workspace
Resolve licenses to components in the Software Bill of Materials Workspace
Viewing reports and dashboards in the Software Bill of Materials workspace
Review the Home page in the Software Bill of Materials Workspace
Reviewing the Components module in the Software Bill of Materials Workspace
Creating rules for application vulnerable items in the Software Bill of Materials Workspace
View upload status for Software Bill of Materials files
Checking a Software Bill of Materials entity for vulnerabilities
Components installed with Software Bill of Materials applications
Create an application vulnerable item rule in the Software Bill of Materials Workspace
Enterprise security case management applications
Security Incident Response
Understanding Security Incident Response
Domain separation and Security Incident Response
Security Incident Response setup
Install and configure Security Incident Response
Download and install the Security Analyst Workspace
Components installed with Security Incident Response
Other additional Security Incident Response setup tasks
Setup Assistant reference
Configure the Security Analyst Workspace
Set up primary and secondary filters for Security Analyst Workspace
Security Analyst Workspace properties
Additional Security Analyst Workspace configuration
Landing page filter configuration
Enable UI Actions
Form UI actions
Related List configuration
Related List UI Actions
Form configuration system properties
Enable playbooks for analyst selection
Troubleshooting Security Incident Response
Security Incident Response Platform Analytics Solutions
CISO dashboard
Security Incident Management Premium dashboard
Security Incident Management dashboard
Security Incident Explorer dashboard
Security Operations Efficiency dashboard
Security Incident Response Workspace
Exploring SIR Workspace
SIR Workspace plugins
SIR Workspace features
SIR Workspace interface overview
Upcoming section
View upcoming tasks
Quick links section
Working with quick links
Shift Handover Records section
List view in SIR Workspace
Personalize a list
Assign Security Incidents
Close multiple security incidents
Assign Response Tasks
Report Phish Email
Working with quick filters
Add or modify quick filters
Export Security Incidents or Response Tasks
Manage Shift Handover records
Configuring SIR Workspace
Set up view of SIR Records
Configure SI design time investigation
Creating View for associated info tables
Adding an entry point list
Mapping View of the Associate Info to the entry point list
Configure each associated list from the view to handle run time data rendering
SIR Workspace Related Records
Define the new Risk Score Calculator Rules
Risk Score Calculator for Additional Related Tables
Configure Shift Handover
Configure Shift Handover Templates
Create shifts through Security Incident Response Workspace
Security Incident Response conference call integration
Manage Conference Call users and groups
Integrate SIR with third-party communication channels
Configure report templates in Security Incident Response
Create a Report Template in Security Incident Response
System properties for reports
Duplicate a report template in Security Incident Response
Edit a report template in Security Incident Response
On-Call scheduling in Security Incident Response
Category management in Security Incident Response
Create a category
Create a subcategory
Using SIR Workspace
Working with Security Incident Records
Security Incident Overview section
Security Incident Details section
Security incident Details tab
SIR Workspace Orchestration
SIR Workspace Investigation Canvas
Explore Investigation Canvas
Unified experience framework for integrations powered by Capability Framework
Unified experience capabilities and modal screens
Unified Experience example
Example 1: Run Threat Lookup
Select implementations
Example 2: Common Inputs: Sighting Search
Example 3: Add specific runtime details inputs to an implementation: Run Additional Actions
Security Incident Response Tasks
Create a Response Task
Security Incident Response Other Records
Security Incident Response Post Incident Review
Edit Related Records in list view
TISC integration within SIR Workspace
Send data from SIR Workspace to TISC
System properties to send data
Add security incident to TISC case
Add observables to TISC Case
Send Observables to TISC
Send Threat Lookup to TISC
Send Sighting Search to TISC
Send Observable Enrichment to TISC
View TISC Context in SIR Workspace
Working with TISC Context
Add observables to TISC Case
View related info from TISC
View Enrichment Results
Reports in Security Incident Response
Create a report
Edit a report
Delete a report
Collaborate using conference call or chat in Security Incident Response
Start a conference call in Security Incident Response
Add participants to active Conference Call
Start a Sidebar chat in Security Incident Response
Viewing incident details with a relationship graph
Customize a relationship graph
Create a relationship graph for an incident
MITRE attack and defend technique graph
Security Incident Playbook
Prerequisites for the Playbooks
Rebuilding existing playbooks in Workflow Studio
Activity Definitions
Example Activity Definition: Send email
Create an Activity Action
Submit to CSF X Sandbox
Sample Playbooks for SIR Workspace
Working with MSI Records
Propose as Major Security Incident
Promote to Major Security Incident
Link to Major Security Incident
Working with Form UI actions
Security Incident Closure workflow
Handle security incidents using AWA
Viewing SIR Workspace Dashboards
View Security Analyst Overview dashboard
View Security Incident Explorer dashboard
View Security Incident Management dashboard
View Security Operations Efficiency dashboard
View Security Incident Response Premium KPIs dashboard
View Context Sensitive Analytics - SI dashboard
View CISO dashboard
View CISO Reporting Overview dashboard
View Security Incident Manager Overview dashboard
View Security Incident Response Health dashboard
Security incident creation
Security incident manual creation
Create a security incident from the Security Incident list
Create a security incident from the Security Incident Catalog
Create a security incident from an Event Management alert
Security incident automatic creation
Security incidents created from events and alerts
Data imported into security alerts
Create security incidents from User Reported Phishing emails
Record creation from security incidents
Create a change, incident, or problem from a security incident
Create a Customer Service case from a security incident
Add a security incident to a security case
Create response tasks
Manage Predictive Intelligence for User Reported Phishing
Predictive Intelligence for User Reported Phishing
Required components and plugins
Final verdict generation for User Reported Phishing
Troubleshooting Predictive Intelligence for User Reported Phishing
Configure Predictive Intelligence for User Reported Phishing
Assigning security analysts
Process Mining Workspace for Security Incident Response
Create process mining project for security incidents
Process Mining use cases for security incidents
Managing security incidents and inbound requests
Create an inbound request
Manage observables
Show IoC information for a security incident
Create a security incident observable
Manage file observables
Edit a security incident observable list
Add multiple security incident observables
Automatic security incident observable log data enrichment
Publish observables to a third-party watchlist
Manage lookups and scans
Submit an IoC Lookup request from a security incident
Submit an IoC Lookup request from the Security Incident Catalog
Submit a vulnerability scan request from a security incident
Submit a vulnerability scan request from the Security Incident Response catalog
Manage on-demand orchestration
Perform on-demand orchestration from the Security Incident form
Perform on-demand orchestration from the Security Incident list
Define new on-demand orchestrations
Register new Security Operations applications for on-demand orchestration
Add information to a security incident
Add problems, changes, and incidents
Invoke a process dump for an enriched process in Windows
View information in a security incident
Parent and child security incident relationships
View affected items for a security incident
View related items for a security incident
View enrichment data for a security incident
View response task information for a security incident
View related events and alerts in security incidents
View security incident to customer service case mapping
View a Security Incident Response runbook
Identify all configuration items affected by a security incident
Calculate the severity of a security incident
Search for and delete phishing emails
Create a security incident knowledge article
Escalate a security incident
Manage post incident activities
Assign post incident review roles
Post incident review report
Manage Post Incident Review Report
Configure an assessment trigger condition
Assessment trigger conditions examples
Perform a questionnaire-based post incident review
Create post incident review questionnaire categories
Compose post incident review questions
Create PIR assignment rules
Close security incidents
Add closure information to a security incident
Restrict access to security incidents
Manage security threats using the Security Analyst Workspace
Resolve security threats with the playbook
Sightings searches on user-reported phishing and malware attacks
Playbook Resources
Activate a Security Incident Response flow
Security Incident Response playbooks
Process-based Playbooks
Playbook for Manual Phishing
Create playbooks for Manual Phishing in Workflow Studio
Add parallel activities
Using the Manual Phishing playbook
Workspace Playbook summary
Playbook for Automated Phishing
Create processes for Automated Phishing in PAD
Using the Automated Phishing playbook
Playbook for Manual Malware
Create processes for Manual Malware in PAD
Using the Manual Malware playbook
Playbook for Automated Malware
Create processes Automated Malware in PAD
Using the Automated Malware playbook
Playbook for Failed Login Manual
Create processes for Failed Login Manual in PAD
Using the Failed Login Manual playbook
Flow-based Playbooks
Playbook for Automated Phishing
Run the automated phishing response playbook flow
View automated phishing response playbook flow action designer
View the automated phishing response playbook subflow designer
Playbook for Automated Malware
Run the automated malware playbook flow
Playbook for Failed Login Manual
Playbook for Child Security Incident Automation
Playbook for Office 365 - Malicious File Detected
Set up the Office Malicous File Detected playbook
Use the Office 365 Malicious File Detected playbook
Playbook for Repeat Detection
Set up the Repeat Detection playbook
Use the Repeat Detection playbook
Playbook for Spoofed Emails (using the same Display name)
Set up the Spoofed Emails playbook
Use the Spoofed Emails (using the same Display name) playbook
Playbook for Endpoint Detection
Set up the Endpoint Detection playbook
Use the Endpoint Detection playbook
Playbook for Possible Password Spray
Set up the Possible Password Spray playbook
Use the Possible Password Spray playbook
Playbook for T1003 - Detect Credential Dumping Tools
Set up the T1003 - Detect Credential Dumping Tools playbook
Use the T1003 - Detect Credential Dumping Tools playbook
Playbook for Email Domain Spoofing Detection
Set up the Email Spoof Detection playbook
Use the Email Domain Spoofing Detection playbook
Playbook for Typo Squatted Domain
Set up the Typo Squatted Domain playbook
Use the Typo Squatted Domain playbook
Playbook for Credential Sniffing
Set up the Credential Sniffing playbook
Use the Credential Sniffing playbook
Playbook for T1070 - Windows Events Logs Cleared
Set up the T1070 - Windows Events Logs Cleared playbook
Use the T1070 - Windows Events Logs Cleared playbook
Playbook for OSquery of External Address in /etc/hosts file
Set up the OSquery of External Address in the /etc/hosts file playbook
Use the OSquery of External Address in the /etc/hosts file playbook
Playbook for User Deleting Bash History - Cloud
Set up the User Deleting Bash History playbook
Use the User Deleting Bash History playbook
Playbook for Successful VPN Attempts from the Service Accounts - Corp/Cloud
Set up the Successful VPN Attempts from the Service Accounts playbook
Use the Successful VPN Attempts from the Service Accounts playbook
Playbook for Attempted Access to Deactivated Accounts
Set up the Attempted Access Deactivated Account playbook
Use the Attempted Access to Deactivated Accounts playbook
Playbook for T1003 - Defense Evasion - Mimikatz DCShadow
Set up the T1003 - Defense Evasion - Mimikatz DCShadow playbook
Use the T1003 - Defense Evasion - Mimikatz DCShadow playbook
Playbook for T1003 - Credential Dumping - Mimikatz DCSync
Set up the T1003 - Credential Dumping - Mimikatz DCsync playbook
Use the T1003 - Credential Dumping - Mimikatz DCsync playbook
Playbook for Okta User Login Failures from Multiple IPs
Set up the Okta User Login Failures from Multiple IPs playbook
Use the Okta User Login Failures from Multiple IPs playbook
Playbook for ModSec Brute force by IP Burst
Set up the ModSec Brute force by IP Burst playbook
Use the ModSec Brute force by IP Burst playbook
Security Incident Response playbook actions
Visual representation of Security Incident Response reporting
Security Incident Response Overview dashboard
Access Security Incident Response Explorer
Security incident map
Add map to Security Incident Response overview
Modify security incident map
Security incident treemaps
Add treemaps to the Security Incident Response overview
Create or update a treemap category
Create or update a treemap indicator
Add vulnerability significance charts to an overview
Major Security Incident Management
Exploring Major Security Incident Management
Major Security Incident Management
Get started with MSIM
Checklist for MSIM setup
Major Security Incident Management roles
Integrating Major Security Incident Management
Integrate Major Security Incident Management with Microsoft SharePoint
Register a new application at Azure portal for SharePoint connections
Use certificates for authentication
Configure Microsoft SharePoint with Major Security Incident Management
Integrate Major Security Incident Management with Microsoft Teams
Register a new application at Azure portal for Microsoft Teams connections
Configure Microsoft Teams connection with Major Security Incident Management
Establish MS Teams Graph connection on ServiceNow AI Platform
Using Certificates for authentication
Attach a Java Key Store certificate for MS Teams
Configure the JWT signing key for MS Teams
Configure the JWT provider for MS Teams
Establish a connection using certificates
Using Client Secret value
Establish a connection using client secret
Activate MS Teams chat connector for MS Teams Graph Spoke user
Major Security Incident Management Conference Call Integration
Start a conference call
Add participants to a conference call
Mute participants in a conference call
View conference call details
Integrate MSIM Conference Calls with Microsoft Teams
Use the MSIM Conference Call Microsoft Teams integration
Integrate MSIM Conference Calls with Zoom
Use the MSIM Conference Call Zoom integration
Integrate MSIM Conference Calls with Cisco Webex
Use the Conference Calls Cisco Webex integration
Configuring Major Security Incident Management
Configure File Explorer Component
Get Started with File Explorer
Configure File Explorer Repository Drive
Configure Folder and File Action Settings
Create Folder Templates
File Explorer Activity Stream in Workspace
File Explorer troubleshooting
Configure Microsoft Teams
Get started with Microsoft Teams
Activate MS Teams as a chat provider
Create a chat channel template
View Chat Message Activity
MS Teams Chat Connector Troubleshooting for MSIM
Configure Slack chat connector for major security incidents
Get started with Slack chat connector configuration
Create a chat channel template for Slack
Activate Slack as a channel provider
View chat message activities in Slack
Major Security Incident Management administration
Major Security Incident Management workspace
Using Major Security Incident Management
Propose, promote, and link incident records
Propose as a Major Security Incident
Promote to a Major Security Incident
Link to Major Security Incident
Using MSI List view in the MSIM workspace
View Major Security Incident impact metrics
View Major Security Incident trend charts
Update Major Security Incident details
Restrict access to certain major security incidents
Link additional records to Major Security Incident
Unlink records from Major Security Incident
Manage tasks in a Major Security Incident
Manage tasks using the Visual Task Board
Manage tasks using the List view
Track collaboration activity via MSIM workspace
Create and distribute MSIM Status Reports
Managing MSIM status reports
Configure Major Security Incident status reports
Create a Report Template
Add Branding to your Report Templates
Use Visualizations in Report Templates
Use Reports Lists in Report Templates
Use Template Scripts in your Report Templates
Preview the Report Template
Create a Report Section Template
Create a Report Subsection Template
Create Report Subsection Element template
Create a Free Form Type Element
Create a Visualization Type Element
Create a List Type Element
Create a Custom Type Element
Add system properties
Major Security Incident Management Playbooks
Create processes for MSIM playbook
Using the MSIM playbook
Playbook for zero-day vulnerability
Using the Zero-day Vulnerability Playbook
Playbook for Legal Request
Rollup Framework for MSIM
Configure Linked Records in Major Security Incident Management
Configure Rollup Records in Major Security Incident Management
Configure List Layout in Major Security Incident Management
Rollup example use case implementation for a Security Case
Step 1. Create linked record configuration for a Security Case
Step 2. Create a view for modal window for a Security Case
Step 3. Create UI actions for the Source Table for a Security Case
Step 4. Create a view for a new Linked Record Tab for a Security Case
Step 5. Add Access Control Lists (ACLs) for Major Security Incident Management workspace users
Step 6. Create business rules for a Security Case
Step 7. Create rollup record configurations
Perform on demand atomic rollup
Security Incident Response integrations
ArcSight ESM Event Ingestion for Security Operations integration
Set up your ServiceNow AI Platform instance for the ArcSight ESM event ingestion integration
Set up the ArcSight ESM Query Viewer
Install and configure the ServiceNow application for the ArcSight ESM Event Ingestion integration
Create a profile for ArcSight ESM correlation event ingestion integration
Create and name the profile for ArcSight ESM event ingestion integration
Select correlation events for ArcSight ESM event ingestion integration
Mapping correlation event fields for the ArcSight ESM event ingestion integration
Create mappings for ArcSight ESM event ingestion integration
Preview the security incident for the ArcSight ESM event ingestion Integration
Create a schedule for ArcSight ESM event ingestion ingestion
Additional options: Automate correlated event updates and closure based on SIR incident status
ArcSight ESM Integration Settings for event ingestion integration
Troubleshooting ArcSight ESM event ingestion integration
Copy ArcSight ESM profile for event ingestion integration
Use the script editor to format correlation event values for ArcSight ESM integration
Flow Designer usage with ArcSight ESM event ingestion integration
Amazon Web Services (AWS) Security Hub integration
Get started with AWS Security Hub integration
Register and configure the AWS Security Hub portal
Install and configure the AWS Security Hub integration
Create a profile for AWS Security Hub finding integration
Map the AWS Security Hub finding fields
Define filter and aggregation criteria for AWS Security Hub findings ingestion
Schedule the AWS Security Hub finding retrieval
Automate the AWS Security Hub finding updates and closures by the SIR incident status
SIR form after an AWS Security Hub finding ingestion
Carbon Black - Incident Enrichment integration
Get started with the Carbon Black - Incident Enrichment integration
Carbon Black integration
Get started with the Carbon Black integration
Check Point Anti-bot - Email Parser integration
Check Point Next Generation Threat Prevention integration
Check Point NGTP setup
Create an API account for the Check Point NGTP integration
Set up the Check Point NGTP integration
Activate the Check Point NGTP integration
Working with block lists
Create a block list for the Check Point NGTP integration
Activate a block list for the Check Point NGTP integration
Configure a block list as a Custom Intelligence Feed on the Check Point NGTP integration
Submit block list entries from a security incident for the Check Point NGTP integration
Submit block list entries directly from the Block List Entry Table
Approve block list entries for the Check Point NGTP integration
Block list entry exceptions for the Check Point NGTP integration
Edit the security tag name for the Check Point NGTP integration
Uninstall the Check Point NGTP integration
CrowdStrike Falcon Host integration
Get started with the CrowdStrike Falcon Host integration
Security Operations CrowdStrike Falcon Host - Publish to Watchlist Flow
CrowdStrike Falcon Insight for Security Operations integration
Getting started with the CrowdStrike Falcon Insight integration
Create CrowdStrike API client and generate keys
Install and configure CrowdStrike Falcon Insight
Create an approval group
Create a capability profile for the CrowdStrike Falcon Insight integration
Configure profiles and security incidents for the CrowdStrike Falcon Insight integration
How trigger conditions work with a configuration item for a profile
Verify CrowdStrike Falcon Insight profile trigger conditions
Trigger a CrowdStrike Falcon Insight profile manually from a security incident
Create and configure a profile for the sighting search
Configure and trigger additional actions in CrowdStrike Falcon Insight
Using CrowdStrike Falcon Insight integration in Analyst Workspace
CrowdStrike Next-Gen SIEM integration for Security Operations
Get started with CrowdStrike Next-Gen SIEM integration
Install and configure CrowdStrike Next-Gen SIEM integration
Create a detection profile for CrowdStrike Next-Gen SIEM
Set correlation rules for CrowdStrike Next-Gen SIEM integration
Map the CrowdStrike Next-Gen detection fields
Defining filter and aggregation criteria
Set the filtering conditions for security incidents
Define aggregation conditions
Schedule the CrowdStrike Next-Gen SIEM detection retrieval
Automate detection updates and closures
CrowdStrike Falcon X Sandbox for Security Operations integration
Get started with the CrowdStrike Falcon X Sandbox integration
Set up submission configurations
Manually submit files or URLs to Sandbox
Automate CrowdStrike Falcon Sandbox submissions using Flow Designer
Monitor submission results
Tag security incidents with the Sandbox submission status
Review the sandbox global settings
Elasticsearch Incident Enrichment integration
Get started with the Elasticsearch - Incident Enrichment integration
FireEye Endpoint Security integration
Set up your NowPlatform instance for FireEye integration
Configuring Timestamp Settings for Triage Acquisition
Install the application and configure a source for the integration
FireEye Default Settings
Create a new capability profile for the FireEye Endpoint integration
Understand how trigger conditions work with a configuration item
Configure profiles and security incidents for the FireEye HX integration
Verify the Trigger Condition Filters
Trigger a FireEye capability profile from Related Links
Trigger a FireEye Capability profile from Configuration Item related list
FireEye Get File Capability
FireEye Additional Actions on Endpoint
Create and configure a profile for sightings search with the FireEye Integration
Invoke Sighting Search from a Security Incident
Have I been pwned? integration
Security Operations Have I been pwned? integration setup
Threat Lookup - Have I been pwned? flow
Activate the Security Operations Have I been pwned? integration
Update your X.509 certificate
HPE Security ArcSight ESM - Email Parser integration
HPE ArcSight Logger - Incident Enrichment integration
Get started with the HPE ArcSight Logger - Incident Enrichment integration
Hybrid Analysis integration
Install and configure Hybrid Analysis
Verify expected results for Hybrid Analysis
(Optional) Manually attach an observable for Hybrid Analysis
IBM QRadar Offense Ingestion Integration
Install and configure the ServiceNow application for the IBM QRadar offense ingestion integration
Set up your ServiceNow AI Platform instance for the IBM QRadar offense ingestion integration
Create a profile for IBM QRadar offense ingestion integration
Create profiles for ingesting IBM QRadar offenses
Select IBM QRadar rules
Mapping of offense fields for the IBM QRadar integration
Ingesting the sample IBM QRadar offenses
Mapping IBM QRadar offense fields to security incident response fields
Preview the security incident for the IBM QRadar integration
Define schedule for the IBM QRadar integration
Automate offense updates
Configuration settings
Optional: Copy a IBM QRadar profile
Domain separation and IBM QRadar Offense Ingestion
Security Incident Response form after offense ingestion
Flow Designer and Integration Hub usage with IBM QRadar offense ingestion integration
Troubleshooting IBM QRadar offense ingestion integration
IBM QRadar - Incident Enrichment Integration
Get started with the IBM QRadar - Incident Enrichment integration
LogRhythm Overview
Set up the REST API for LogRhythm
Install the plugin and configure LogRhythm
Creating an alarm profile for LogRhythm
Mapping LogRhythm alarms to the security incident
Map LogRhythm alarm fields to security incident fields
Filter alarms for LogRhythm
Previewing the security incident with mapped LogRhythm alarm values
Schedule and retrieve LogRhythm alarms
Additional options for LogRhythm alarms
Additional configurations for the LogRhythm integration
Use the script editor to format LogRhythm values
Copy an alarm profile for LogRhythm
Disable automated alarm closure for LogRhythm
View LogRhythm drilldown events
Troubleshooting the LogRhythm integration
Verify connectivity for LogRhythm
Script execution and system log for LogRhythm
McAfee ePO integration
Integration architecture for McAfee ePO
Checklist for the McAfee ePO integration
Set up your ServiceNow AI Platform instance for the McAfee ePO integration
Set up your McAfee ePO console to integrate with Security Incident Response (SIR)
Install the application and configure a server for the McAfee ePO integration
Edit security tags in the ServiceNow AI Platform for the McAfee ePO integration
Create an approval group
McAfee ePO integration capability profiles
Create a capability profile for the McAfee ePO integration
Defining triggering conditions with a Configuration item (CI) field for a McAfee ePO profile
Configuring profiles for the McAfee ePO integration
Configure profiles and security incidents for system enrichment queries for the McAfee ePO integration
Trigger McAfee ePO profile manually from a security incident
Trigger additional actions in McAfee ePO integration
Using McAfee ePO integration in Analyst Workspace
McAfee ESM - Email Parser integration
Configure McAfee ESM - Email Parser integration
McAfee ESM - Incident Enrichment Integration
Get started with the McAfee ESM - Incident Enrichment integration
Microsoft Azure Sentinel integration
Get started with Microsoft Azure Sentinel integration
Register and configure the Microsoft Azure portal
Install and configure the Microsoft Azure Sentinel integration
Create a profile for Microsoft Azure Sentinel
Map the Microsoft Azure Sentinel incident fields
Defining filter and aggregation criteria
Schedule the Microsoft Azure Sentinel incident retrieval
Automate the incident updates and closures by the SIR incident status
Copy a Microsoft Azure Sentinel profile
SIR form after an incident ingestion
Review the Microsoft Azure Sentinel integration settings
Domain separation
Comparing Microsoft Azure Sentinel and Microsoft Graph Security API integrations with SIR
Microsoft Defender for Endpoint integration
Register and configure the Microsoft Defender for Endpoint in the Microsoft Azure portal
Get started with the Microsoft Defender for Endpoint integration
Install the application and configure a source for the integration
Microsoft Defender for Endpoint Default Settings
Map the Microsoft Defender for Endpoint indicator types
Create a capability profile for the Microsoft Defender for Endpoint integration
Trigger conditions in a configuration item
Configure profiles and security incidents for the Microsoft Defender for Endpoint integration
Verify the Trigger Condition Filters
Trigger the Microsoft Defender for Endpoint capabilities from Related Links
Trigger the Microsoft Defender for Endpoint from Configuration Item related list
Additional Configurations in Microsoft Defender for Endpoint
Configure Isolate Host capability in Microsoft Defender for Endpoint
Configure Remove Host Isolation capability in Microsoft Defender for Endpoint
Configure Run Antivirus Scan capability in Microsoft Defender for Endpoint
Configure Restrict App Execution capability in Microsoft Defender for Endpoint
Configure Remove App Restriction capability in Microsoft Defender for Endpoint
Configure Get Related Machines from Defender Capability in Microsoft Defender for Endpoint
Configure Stop and Quarantine File capability in Microsoft Defender for Endpoint
Create and configure a profile for sightings search with the Microsoft Defender for Endpoint integration
Perform a manual sighting search in Microsoft Defender for Endpoint
Perform an automatic observable enrichment in Microsoft Defender for Endpoint
Perform a manual observable enrichment in Microsoft Defender for Endpoint
Create indicators in Microsoft Defender for Endpoint
Update indicators in Microsoft Defender for Endpoint
Domain separation in Microsoft Defender for Endpoint integration
Rate limit configuration in Microsoft Defender for Endpoint integration
Microsoft Exchange Online integration
Set up account
Install
Configure
Define search criteria
Request delete email approval
Approve delete email requests
Recover deleted emails
Edit security tags
Microsoft Exchange On-Premises integration
Configure
Microsoft Exchange - Perform Email Search and Deletion flow
Microsoft Graph Security API alert ingestion integration
Set up your ServiceNow AI Platform instance for the Microsoft Graph Security API integration
Configure the Microsoft Azure portal
Install and configure the Servicenow application for Microsoft Graph Security API alert ingestion integration
Create a profile for the Microsoft Graph Security API alert ingestion integration
Identify the source for the profile
Mapping of alert fields for Microsoft Graph Security API alert ingestion integration
Ingest sample Microsoft Graph Security API alerts
Mapping alerts to security incident response fields
Preview the security incident for the Microsoft Graph Security API integration
Define schedule for Microsoft Graph Security API integration
Automate alert updates and closure based on SIR incident status
Microsoft Graph Security API integration configuration settings
Security Incident Response form after alert ingestion
Optional: Copy a Microsoft Graph Security API profile
Domain separation and Microsoft Graph Security API alert ingestion
Flow Designer and Integration Hub usage in Microsoft Graph Security API integration
Troubleshooting Microsoft Graph Security API integration
Palo Alto Networks - AutoFocus integration
Activate and configure Palo Alto Networks - AutoFocus integration
Get AutoFocus Session Info Enrichment Flow
Palo Alto Networks - Firewall integration
Set up SSH credentials to the MID Server
Activate and configure the Palo Alto Networks Firewall Integration
Security Operations Integration Palo Alto Networks Firewall Launcher workflow
Security Operations Palo Alto Networks - Check and Block Value workflow
Get Log Data Flow
Palo Alto Networks - WildFire integration
Activate Security Operations Palo Alto Networks - WildFire
Get WildFire Data Enrichment Flow
Palo Alto Networks Next-Generation Firewall integration
Create a certificate profile for the Palo Alto Networks Next-Generation Firewall
Set up and install Palo Alto Networks Next-Generation Firewall
Create the API account role for Palo Alto Networks Next-Generation Firewall
Supported External Dynamic Lists for Palo Alto Networks Next-Generation Firewall
Create an EDL for Palo Alto Networks Next-Generation Firewall
Activate an EDL for Palo Alto Networks Next-Generation Firewall
Activate an EDL manually for Palo Alto Networks Next-Generation Firewall
Configure an EDL in Palo Alto Networks Next-Generation Firewall
Activate an EDL for Palo Alto Networks Next-Generation Firewall with a change request
Submit EDL entries from a security incident record for Palo Alto Networks Next-Generation Firewall
Submit EDL entries from the blocklist for Palo Alto Networks Next-Generation Firewall
Approve EDL entries for Palo Alto Networks Next-Generation Firewall
EDL entry exceptions for Palo Alto Networks Next-Generation Firewall
(Optional) Edit the security tag name for Palo Alto Networks Next-Generation Firewall
Uninstall Palo Alto Networks Next-Generation Firewall
PhishTank integration
Install and configure PhishTank
Verify expected results for PhishTank
(Optional) Manually attach an observable for PhishTank
Proofpoint Integration for Security Operations
Exploring the Proofpoint Integration for Security Operations
Configuring the Proofpoint Integration for Security Operations
Install and configure the Proofpoint Integration for Security Operations
Create an event profile for the Proofpoint Integration for Security Operations
Review Proofpoint integration settings
View Proofpoint Analytics Dashboard
Reverse Whois integration
Install and configure Reverse Whois
(Optional) Install and configure Whois
Initiate the lookup for Reverse Whois
Verify expected results for Reverse Whois
(Optional) Run enrichment lookup and verify expected results for Whois
RISKIQ and WHOISIQ integration
Supported observables for RISKIQ and RISKIQ WHOISIQ
Install and configure RISKIQ and WHOISIQ
Verify expected results for RISKIQ SSL certificate lookups
RISKIQ SSL certificate lookups that return an exact match
RISKIQ SSL certificate lookups that return multiple certificates or no certificates
Verify expected results for WHOISIQ URL lookups
Create an observable for manual WHOISIQ lookups
Verify expected results for manual WHOISIQ lookups
Shodan integration
Install and configure Shodan
Verify expected results for Shodan
(Optional) Manually attach an observable for Shodan
Secureworks CTP Ticket Ingestion Integration
Set up your ServiceNow AI Platform instance for the Secureworks CTP ticket ingestion integration
Install and configure the ServiceNow application for the Secureworks CTP ticket ingestion integration
Create a profile for Secureworks CTP ticket ingestion integration
Identify the source of the profile
Mapping of ticket fields for the SecureWorks CTP integration
Ingesting the sample Secureworks tickets
Mapping Secureworks ticket fields to security incident response fields
Preview the mapped values in the security incident
Define schedule for the Secureworks CTP Ticket ingestion
Automate ticket updates and closure based on SIR incident status
Optional: Copy a Secureworks CTP profile
Security Incident Response form changes after ticket ingestion
View the Secureworks tickets and the corresponding security incidents
Secureworks CTP Master Ticket Closure Notice
Secureworks CTP integration configuration settings
Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks
Install and Configure
Create an incident profile
Set Alert Sources
Map incident fields
Define filter and aggregation criteria
Schedule incident retrieval
Automate incident updates and closures
Security Incident Response integration with Zscaler
Getting started with Security Incident Response integration with Zscaler
Configure access to APIs
Configure integration
Add Zscaler Internet Access URL category lists
Submit observables from a security incident record to a URL category list
Approve observables to URL category lists
Submit the security incident to the Zscaler URL category list
Run a threat lookup by using the Zscaler global threat library
Submit to Zscaler Sandbox analysis
Set up email alerts for Patient 0 events
ServiceNow Security Operations add-on for Splunk overview
Splunk integration setup
Download addon
Install addon
Setup Splunk environment
Configure Application Registry on the ServiceNow instance
Using Splunk add-on
Manual search commands
Splunk event actions
Single-record Splunk alerts
Multiple-record, custom field Splunk alerts
Create a multi-record, custom field Splunk alert
Multi-record, custom field Splunk alert examples
Splunk error reporting
Splunk Enterprise Event Ingestion integration for Security Operations by ServiceNow
Set up your ServiceNow AI Platform instance for the Splunk Enterprise Event Ingestion integration
Install and configure the ServiceNow application for the Splunk Enterprise Event Ingestion integration
Configure settings
Create and name an event profile for the Splunk Enterprise Event Ingestion integration
Select scheduled alerts for the Splunk Enterprise Event Ingestion integration
Mapping alerts and events for the Splunk Enterprise Event Ingestion integration
Map alerts for the Splunk Enterprise Event Ingestion integration
Preview the security incident for the Splunk Enterprise Event Ingestion integration
Schedule and retrieve alerts for the Splunk Enterprise Event Ingestion integration
Integration architecture and external systems connection for the Splunk Enterprise Event Ingestion integration
Copy Splunk profiles
Copy an event profile
Set up Splunk environment
Use Splunk add-on
Save searches in console
Format alert values
Checklist
Splunk Enterprise Security event ingestion integration
Glossary
Set up your ServiceNow AI Platform instance for the Splunk Enterprise Security integration
Install and configure
Configure Splunk Enterprise Security settings
Authentication errors
Create and name an event profile for the Splunk Enterprise Security event ingestion integration
Set up Splunk environment
Forward events on-demand
Copy an event profile for the Splunk Enterprise Security Event Ingestion integration
Use the script editor to format alert values for the Splunk Enterprise Security Event Ingestion integration
Copy Splunk Enterprise Security profiles from one instance to another using export/import functionality
Checklist for the Splunk Enterprise Security Notable Event Ingestion integration
Splunk - Incident Enrichment integration
Get started with the Splunk Search integration for Security Operations
Mobile Experience for Security Incident Response
Set up checklist for the Security Incident Response Mobile app
Log in to the Security Incident Response Mobile app
View, edit, and assign open security incidents with the Security Incident Response Mobile app
View, edit, and reassign security incidents assigned to you with the Security Incident Response Mobile app
View, edit and assign unassigned security incidents with the Security Incident Response Mobile app
View, edit, and assign high priority incidents with the Security Incident Response Mobile app
View, edit, and assign security incidents with a risk score greater than 60 with the Security Incident Response Mobile app
Search for security incidents with the Security Incident Response Mobile app
View, edit, and assign open response tasks with the Security Incident Response Mobile app
View, edit, and reassign your response tasks with the Security Incident Response Mobile app
Filter records with the Security Incident Response Mobile app
Security Incident Response Orchestration
Set up Security Incident Response Orchestration
Understand Security Incident Response Orchestration workflows and workflow templates
Security Incident Response Orchestration flows and actions
Create Lookup Request for IoC Changes Flow
Create IoC Lookup Request Flow Action
Security Incident Response- Get Network Statistics Flow
Security Incident Response - Get Running Services Flow
Determine Shell Script by OS Flow Action
Get Running Services - WMI Enrichment
Run procdump flow
Execute procdump action
Security Incident - Evaluate response task outcome workflow
Threat Intelligence
Understanding Threat Intelligence
Domain separation and Threat Intelligence
Set up Threat Intelligence
IoC Repository
Attack modes and methods
Define an attack mode/method
Add an IoC to an attack mode/method
Add a related attack mode method
Add associated task to an attack mode/method
Indicators of compromise
View an IoC
Add a related observable to an IoC
Add a related attack mode/method to an IoC
Identify associated indicator types
Identify indicator sources
Add associated tasks to an IoC
Observables
Define an observable
Add a related IoC to an observable
Add associated tasks to an observable
Add a related observable
Load more IoC data
Identify observable sources
Perform lookups on observables
Perform threat enrichment on observables
Attack patterns
Define an attack pattern
Campaigns
Define a campaign
Course of actions
Define a course of action
Identities
Define identities
Infrastructure
Define infrastructure
Intrusion set
Define an intrusion set
Locations
Define Location
Malware
Define a Malware
Malware analysis
Define malware analysis
Observed data
Define observed data
Threat actors
Define threat actors
Threat groupings
Define threat groupings
Marking definitions
Define marking definitions
Threat notes
Define threat notes
Threat opinions
Define threat opinions
Threat reports
Define threat reports
Sightings
Define indicator sightings
Define object sightings
Tools
Define tools
Vulnerabilities
Define vulnerabilities
Relationships
Define object-object relationships
Define object-indicator relationships
Define object-observable relationships
STIX Visualizer
MITRE-ATT&CK framework overview
MITRE-ATT&CK administration
Get started with MITRE-ATT&CK framework
Understand the MITRE to STIX data model
Domain separation and MITRE-ATT&CK
Set up the MITRE-ATT&CK framework
Manage matrices
Manage techniques
Manage mitigations
Manage groups
Manage malware
Manage tools
Manage MITRE relationships
Manage CVE and technique mapping
Extend the MITRE-ATT&CK data
Define the data source and detection tool mapping
Define the data source and data component mapping
Define the technique detection coverage
MITRE-ATT&CK Scoring definition
Map your technique detection coverage to a technique
Define the mitigation coverage
Technique mitigation coverage definitions
Map your mitigation coverage to a technique
Overall technique mitigation coverage calculator
Create and map detection rules
Auto-extract technique rules for importing MITRE-ATT&CK information
Review threat group and MITRE-ATT&CK techniques mapping
Threat group to technique heatmap definition
Review the MITRE-ATT&CK system properties
Using MITRE-ATT&CK to detect and analyze threats
Associate MITRE-ATT&CK information with security incidents
Associate MITRE-ATT&CK information with observables
Associate MITRE-ATT&CK information with security case
Rollup MITRE-ATT&CK information using Threat Lookup results
Rollup MITRE-ATT&CK information from detection rules
Rollup MITRE-ATT&CK information from child security incidents
Perform link analysis and threat hunting using MITRE-ATT&CK specific filters
MITRE-ATT&CK heat map and navigator
Using the MITRE-ATT&CK dashboard
MITRE DEFEND Framework
Ingest MITRE DEFEND data
MITRE DEFEND tables
Threat Intelligence administration
Threat Lookup Finding Calculators
Using Threat Lookup Finding Calculators
Threat Intelligence integrations
CrowdStrike Falcon Intelligence integration
CrowdStrike Falcon Intelligence integration overview
Have I been pwned? integration
Security Operations Have I been pwned? integration setup
Threat Lookup - Have I been pwned? flow
Activate the Security Operations Have I been pwned? integration
Update your X.509 certificate
MISP integration for Security Operations
MISP administration
Getting started with MISP integration for Security Operations
MISP user roles and permissions
Install and configure the MISP integration for Security Operations
Review the MISP integration settings
Configure MISP sighting searches
Configure how an automatic event is created
MISP event data
Associated MISP events
MISP user information
Domain separation and MISP
Troubleshooting MISP integration
Using MISP to investigate and analyze threats
Sighting searches in MISP
Observable enrichment in MISP
Managing events in MISP
Roll up MITRE-ATT&CK information using MISP enrichment results
OPSWAT Metadefender Integration
OPSWAT Metadefender integration overview
VirusTotal integration
VirusTotal integration setup
Activate and configure the VirusTotal integration
Threat Lookup - VirusTotal workflow
WhoisXML API integration
WhoisXML API integration setup
Activate and configure the Security Operations Whois integration
Update your X.509 certificate
Enrich Observable WhoIs workflow
Threat Intelligence Orchestration
Set up Threat Intelligence Orchestration
Threat Intelligence Orchestration workflows and activities
Security Case Management
Create cases in Security Case Management
Add artifacts to a case
Associate MITRE-ATT&CK information with security case
Case creation from security artifacts
IoCs and observables in cases
Create a case from IoCs or observables
Add IoCs and observables to an existing case
Create an observable from a case
Run a sightings search on observables in a case
Security incidents in cases
Create a case from security incidents
Add security incidents to an existing case
Configuration items in cases
Create a case from CIs
Add CIs to existing cases
Affected users in cases
Create a case from affected users
Add affected users to existing cases
Security artifact analysis
Related details for case artifacts
View related details for a security incident artifact
View related details for a configuration item artifact
View related details for an IoC artifact
View related details for an affected user artifact
View related details for an observable artifact
Security artifact exclusion and inclusion
Exclude security artifacts from a case
Return excluded security artifacts to a case
Annotate security artifacts
Search for security artifacts
Security Posture Control
Explore
Install supported applications
Supported Service Graph Connectors
Policies
Included policies
Creating your own policies
Insights
Use the workspace
Activate a policy
Create and activate custom policies
Edit an activated policy in Security Posture Control
Clone and create child policies
Create and activate a configured insight
Create an asset profile
Delete a profile
View findings for Security Posture Control
Test result and remediation task state transitions
Creating your own API connector
Enter connector metadata
Enter credentials
Select a template
Provide input values
Map API response to SPC attributes
Validate connector
Create an instance and set the import schedule
Create an asset search
Resolving duplicate configuration items
Resolve duplicate configuration items
Use mitigation controls
Mitigation controls policies
Policies for Exploit Protection (EDR)
Install CrowdStrike integrations
Install Microsoft integrations
Create multiple instances
Install SentinelOne integrations
Exploit protection (WAF)
Configure F5 BIG-IP integrations
Configure the AWS WAF integration
Create a policy for AWS WAF
View detected mitigations
Mapping mitigations
Reference
Assets without endpoint protection
Assets missed by vulnerability assessment
Unmanaged assets
Assets missing endpoint management
Assets with vulnerabilities
Cloud assets and high-risk combinations
Hardware Service Graph Connectors
Software Service Graph Connectors
Policy examples
Create a base policy for Security Posture Control (example)
Create a child policy from a base policy for Security Posture Control (example)
Clone a policy for Security Posture Control (example)
Cybersecurity Executive Dashboard
Opt-in for benchmark scores
Set targets
Security Simulation and Training Integration for Security Operations
Configure Knowbe4 integration
Configure Microsoft Defender for Office 365 integration
Risk and compliance dashboard for GRC: Metrics
Risk and Compliance Dashboard reports and solutions
Threat Intelligence Security Center
Exploring Threat Intelligence Security Center
TISC Key terminology
View Threat Intelligence Security Center Homepage
Configure
Download TISC application from ServiceNow Store
Set up Threat Intelligence Security Center
Integrating Threat Intelligence Security Center
Threat Intelligence Security Center Catalog
Threat Intelligence Feeds
Configure a new threat intelligence feed
Configure Custom Field Mapping
View Threat Intel Feeds
View STIX TAXII Feeds
View STIX HTTPs Feeds
View MISP Feeds
View Text Feeds
View CSV Feeds
View JSON Feeds
View RSS Feeds
View Custom Feed
Configure custom CrowdStrike feed
System Properties for CrowdStrike
Configure custom MISP feed
Understanding STIX TAXII
Configure a new TAXII Feed
Duplicate threat intelligence feeds
TISC Enrichment Integrations
Configure Observable Enrichment
Configure Sighting Search
Define queries for Sighting Search
Using Sighting Search Parameters
Configure Threat Lookup
View Threat Lookup Reputation Calculators
TISC API References
TISC Integrations
Observable Enrichment
Whois integration
Configure and enable Whois integration
Shodan integration
Configure and enable Shodan integration
Sighting Search
Get started with Elasticsearch integration
Configure and enable Elasticsearch integration
Get started with Splunk Search integration
Configure and enable Splunk integration
Threat Lookup
TISC VirusTotal integration
Configure and Enable VirusTotal Integration
TISC CrowdStrike Falcon Intelligence integration
Configure and Enable CrowdStrike Falcon Intelligence integration
TISC Security Tools - EDR
CrowdStrike Falcon EDR integration
Configure Crowdstrike Falcon EDR integration
Send observables to EDR
Microsoft Defender for EDR Integration
Register and configure the Microsoft Defender in the Microsoft Azure portal
Install and configure Microsoft Defender for EDR Integration
System properties for Microsoft Defender EDR
Send observables to EDR
TISC Security Tools - Firewall
Palo Alto Networks integration
Create new EDL for Palo Alto Networks
Palo Alto EDL Approval Rules
Add Observables to EDL
Remove Observables from EDL
Approve EDL entries for Palo Alto Networks
TISC add-on for Splunk overview
TISC integration with Splunk
Creating users in ServiceNow TISC instance
Configuring TISC add-on in Splunk
Data storage in Splunk
TISC - Azure Sentinel integration
TISC playbook templates
Administration
Defining Data Imports Approval Rules
Defining Expiration Rules
Expiration rules for source records
Create Inbound Data Exclusion Rules
Custom Threat Score Calculator in TISC
Define Threat Score Calculator
MITRE ATT&CK Technique Extraction Rules
MITRE ATT&CK Technique Extraction method
Defining Security Control Lists
Creating Taxonomies
Bulk import Taxonomies
Managing the Threat Lookup Reputation Calculator
Manage email Notifications
Email Notifications
Email logs
Report Templates
Create a new Report Template
System properties for Reports
Edit a Published Report Template
Duplicate a Report Template
Working with Webhooks
System properties for Webhooks
Configure webhooks
Subscribe Triggers
View webhook error logs
View webhook batches
Webhook Triggers
Configure tooltips for nodemaps
Working with automated flows
Automated IOC Enrichment
Analyze, assess, and disseminate observables
Analyze and assess threat IoC’s
Vulnerability Management Support
Zero-day vulnerability tracking
Automated flows tables
Reference
Domain separation and Threat Intelligence Security Center
Components installed with Threat Intelligence Security Center
Use
TISC integration with SIR Workspace
Configuring Threat Intelligence External Sharing
Exploring Outbound Intel Sharing
Configuring Outbound Intel Sharing Controls
Configuring Outbound Intel Data Exclusion Rule
Configuring Outbound Intel Sharing Profiles
Configuring Outbound Intel Sharing Groups
Defining Approval Rule for Outbound Intel
Configuring Outbound Intel Sharing Templates
Working on the Redaction Library
Bulk Import of Redaction Categories and Values
Exploring Inbound Intel Sharing
Configuring Inbound Intel Sharing Profiles
Configuring Inbound Intel Sharing Groups
Defining Approval Rule for Inbound Intel
Exploring TAXII Outbound Server
Create TAXII Collection
Automated Sharing of TAXII Collections
Viewing TAXII Collection Records
Viewing Threat Intelligence External Sharing
Viewing Outbound Intelligence
Viewing Inbound Intelligence
Viewing TAXII Collections
Viewing Redaction Imports
View all Redaction Imports
View my Redaction Imports
Sharing of Outbound Intelligence Records from GUI
Threat Intelligence Sharing Approval Workflow
Automated Sharing of Outbound Intelligence Records
Working with Data Imports
Viewing all imports
Viewing my imports
Viewing my approvals
Import Threat Intelligence
Import data using structured file
Import data using standard format
Import data using raw text
Import data using unstructured file format
Threat Analyst Workbench
Workbench Overview
Creating cases using Threat Analyst Workbench
Enforced Restrictions for case(s)
Access controls for a case
External user access for case tasks
Associate MITRE Techniques to a Case
Roll up of MITRE technique associations
Create case task using Threat Analyst Workbench
Working with Investigation Canvases
Understanding investigation canvas actions
Linking an existing case from Investigation Canvas
Creating a Case and Linking from Investigation Canvas
Linking Canvas from a Case
Create an investigation canvas
Adding a new node to the canvas
Investigation canvas and MITRE ATT&CK
Investigation Canvas MITRE Filters
Add artifacts to case(s) or case task(s)
Roll up of MITRE Techniques from Artifacts to Case
Show MITRE ATT&CK Framework for a Case(s)
Run Enrichment Actions within a case
View Case Reports
Create a security incident from a TISC case
Upload Secure File Attachments
Threat Intelligence Security Center Library
Understanding the Data Model
TISC Library Objects form view
TISC Library Repository
Observables
Define an Observable
Observables source records
Link Threat Intel Related Records
Fetch Observables Data
View details in Relationship Graph
Link node actions in Relationship Graph
Working with Internal Intelligence Records
View Internal Intelligence Records
Run Enrichment Actions from Observable
Add to Case
Run Enrichment operations in TISC
Run Threat Lookup
Run Sighting Search
Run Observable Enrichment
View Enrichment Results
Indicators
Define an Indicator
Attack Patterns
Define an attack pattern
Campaign
Define Campaign
Courses of Action
Define Courses of Action
Identity
Define identities
Infrastructure
Define infrastructure
Intrusion Set
Define Intrusion Set
Location
Define Location
Malware
Define Malware
Malware Analysis
Define Malware Analysis
Object Sighting
Define Object Sighting
Observed Data
Define Observed Data
Threat Actor
Define Threat Actor
Threat Event
Define Threat Event
Threat Grouping
Define Threat Grouping
Threat Note
Define Threat Note
Threat Opinion
Define Threat Opinion
Threat Report
Define Threat Report
Tool
Define Tools
Vulnerability
Define Vulnerability
Fetch Vulnerability Data
Marking Definition
Define Marking Definition
Data Component
Define Data Component
Data Sources
Define Data Sources
Define RSS Feeds
Relationships Objects
Define observable-observable relationships
Define object-object relationships
Define object-observable relationships
Define object-indicator relationships
Define indicator-indicator relationships
Define indicator-observable relationships
Potential Relationships
Confirm observable-observable potential relationship
Confirm object-object potential relationships
Confirm indicator-indicator potential relationships
Export intelligence data
Confirm Potential Relationships from Related Records
Automated Correlation
Working with Data Exports
View all exports
View my exports
Export intelligence system properties
MITRE-ATT&CK Repository
Manage Matrices
Manage Techniques
Manage Mitigations
Manage Groups
Manage Malware
Manage Tools
Manage MITRE Relationships
Data migration in TISC
Data migration from SIR TI to TISC
TISC Data Processing Functional Flow
TISC Data Archival
TISC Data Archival
Archive TISC related records
Destroy Rules in TISC
Delete intelligence records
Data Loss Prevention Incident Response
Explore
DLP Incident Response overview
Get started with DLP Incident Response
Configure
Install and configure the DLP Incident Response application
Domain separation and DLP Incident Response
Administer
DLP default configuration settings
Create end user lookup rules
Create assignment rules
Create incident consolidation rules
Create response due date rules
Add multiple users to access DLP incidents
Create Approval Rules
Create user instructions templates
Configure DLP UI user instructions
Create email templates
Create a Data Loss Prevention Incident Response SLA trigger
Create a Data Loss Prevention Incident Response SLA definition
Create assessments
Configure response option for your DLP incidents
Create incident response option rules
Create age chart configurations
Create user delegate configurations
Create repeat offender identification rules
Create Additional Incident Data Fields
DLP SLA Definition form
Configure advanced settings
Monitor DLP Integration Run process
DLP Incident Access Restrictions
Create field level restrictions
Create record level restrictions
DLP Incidents Archival
Archive DLP related records
Manage incidents
Data Loss Prevention Incident Response User Workspace
Report or respond to DLP incidents
Working with my approvals module
Data Loss Prevention Incident Response Analyst Workspace
Data Loss Prevention Incident Response Dashboard
Inbound integration
DLP integrations
Symantec Integration for Data Loss Prevention Incident Response
Getting started with Symantec DLP integration for Data Loss Prevention
Install and configure the Symantec DLP integration for Data Loss Prevention
Create a profile for Symantec DLP integration
Define filters to apply for the Incident creation
Configure evidence file storage
Schedule the Symantec DLP Incident Retrieval
Mapping Symantec DLP incident statuses with ServiceNow incident Status
Severity mapping between Symantec DLP incidents with ServiceNow incidents
Configure Smart Response Rules
Execute Smart Response Rules
Download evidence files on Symantec
Preview evidence files
Configure the Symantec DLP  integration settings
Domain Separation in the Symantec DLP integration
Data Loss Prevention Incident Response Integration with Proofpoint
Getting started with Proofpoint integration for Data Loss Prevention
Install and configure the Proofpoint integration for Data Loss Prevention
Create an Application in Proofpoint and Obtain Client Credentials
Configure the Webhook on the Proofpoint DLP tenant for alert notifications to ServiceNow
Create a Profile for Proofpoint DLP integration
Define filters to apply for the Incident creation
Configure evidence file storage
Download DLP incidents evidence files on Proofpoint
Preview evidence files
Email remediation actions
Map Proofpoint DLP incidents status with ServiceNow incident status
Configure Proofpoint DLP integration settings
Domain Separation in Proofpoint DLP integration
Data Loss Prevention Incident Response Integration with Netskope
Getting started with Netskope DLP integration for Data Loss Prevention
Install and configure the Netskope DLP integration for Data Loss Prevention
Create a Profile for Netskope DLP integration
Define Filters to apply for the Incident creation
Schedule the Netskope DLP incidents retrieval
Mapping DLP incident status with Netskope
Configure Netskope DLP integration settings
Download evidence files
Preview evidence files
Notifications for users on retry mechanism
Email notifications on credential expiration
Domain Separation in Netskope DLP integration
Internet Content Adaption Protocol (ICAP) integration for DLP IR
Getting started with ICAP DLP integration for Data Loss Prevention
Install and configure the ICAP DLP integration
Create a profile for ICAP DLP integration
Define filters to apply for the Incident creation
Schedule the ICAP DLP incidents retrieval
View sensitive information for DLP alerts
Download evidence files for DLP alerts
Preview evidence files for ICAP
Review the ICAP DLP integration settings
Data Loss Prevention Incident Response with Microsoft
Getting started with Microsoft DLP IR integration for data loss prevention
Install and configure the Microsoft DLP integration
Create a new incident profile for Microsoft DLP integration
Microsoft purview endpoint storage configuration
Define filters to apply for the Incident creation
Configure the match content for the incident
Schedule the DLP IR Microsoft incident retrieval
Configure Microsoft DLP IR integration settings
Configure evidence file storage for Microsoft
Request release email from quarantine
Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
Download files approval flow
Preview Evidence files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
Domain separation in Microsoft DLP integration
Security Operations common functionality
Create and define filter groups in Security Operations
Shared data transformation
Create duplication rules in Security Operations
Security Operations email processing
Security Operations email properties
Create Security Operations email properties
Security Operations email parsing
Create email parsers in Security Operations
Edit email records in Security Operations
Unmatched Security Operations email events
View and reprocess unmatched Security Operations emails
Security Operations field mapping
Map tables to tables with Security Operations field mapping
Security Operations field value transforms
Create Security Operations field value transforms
Security Operations enrichment data mapping
Create a Security Operations enrichment data map
Security Operations user-defined escalation
Create a Security Operations user-defined escalation group
Create domain-separated property overrides
Create an operating system group
Set up security tag groups and tags
Create security tag rules
Import security tag rules
Security annotations
Create security annotations for CIs
Create security annotations for observables
Create security annotations for users
View security annotations reports
Components installed with Security Support Common
View components installed with Security Support Common
Search Security Operations
Security Operations Integration Reference
ServiceNow Security Operations integration development guidelines
Types of ServiceNow integrations provided
Security Operations Integration Configurations
Activate and configure third-party integrations
Create an integration
Tips for writing integrations
Integration troubleshooting
Replace an untrusted or expired third-party SSL certificate
Integrations Capabilities framework 2.0
REST APIs for third-party integration with Security Operations
Integration capabilities
Security Operations Integration- Block Request capability
Run Block Request
Security Operations Integration - Block Request Flow
Security Operations Integration- Email Search and Delete capability
Security Operations Integration - Email Search and Delete flow
Execution Tracking Begin (Mail Search) activity
Security Operations Integration- Enrich CI capability
Security Operations Integration - CI Enrichment flow
Security Operations Integration- Enrich Observable capability
Security Operations Integration - Enrich Observable workflow
Security Operations Integration- Get Network Statistics capability
Security Operations Integrations - Get Network Statistics workflow
Execution Tracking - Begin (CIs) Flow Action
Security Incident Response- Get Network Statistics Flow
Security Operations Integration- Get Running Processes capability
Security Operations - Get Running Processes Flow
Security Operations Carbon Black Integration - Get Running Processes Flow
Collect Carbon Black Configurations Flow Action
Check MID Server Status
Get Sensor ID Flow Action
Create Session Flow Action
Check Session Status Flow Action
Create Command Process Flow Action
Check Command Status and Get Process Flow Action
Map Processes Data Flow Action
Close Session Flow Action
Security Operations System Command Integration- Get Running Processes flow
Combine results activity
Execute Shell Script activity
Extract Shell Script from MID Script activity
Get Running Processes via PowerShell activity
Security Operations Integration- Isolate Host capability
Security Operations - Isolate Host Flow
Run Isolate Host
Security Operations Carbon Black Integration - Isolate Host Flow
Get Sensor ID Flow Action
Set Network Isolation Enabled Flow Action
Update Sensor Flow Action
Security Operations Carbon Black Integration- Remove Host Isolation Flow
Security Operations Integration- Publish to Watchlist capability
Security Operations Integration - Publish to Watchlist Flow
Security Operations Integration- Sightings Search capability
Create sightings search configuration records
Run a Sightings Search
Security Operations Integration - Sightings Search Flow
Security Operations - QRadar Sightings Search Flow
Security Operations - McAfee ESM Sightings Search Flow
Security Operations - Arcsight Logger Sightings Search Flow
Security Operations - Elasticsearch Sightings Search Flow
Security Operations Integration - Splunk Sightings Search Flow
View Sightings Search Results
Share Sightings Search results
Share observables from a security incident
View Sightings Search Details
View Sightings Search Data
Security Operations Integration - Threat Lookup capability
Security Operations Integration - Threat Lookup workflow
Change the order of workflow execution
Common Security Operations integration flows and orchestration Flow Actions
Execution Tracking - Begin Flow Action
Capability Execution Tracking - Complete Flow Action
Capability Execution Tracking- Failure Flow Action
Capability - Determine CIs activity
Create Enrichment Data records Flow Action
Get Configuration Item FQDN Flow Action
Determine Observables activity
Get Supported Security Capabilities activity
Capability Execution Tracking- No Impls activity
Create Compliance Search Action
Get IP from CI activity
Get Network Statistics via netstat Flow Action
Get running processes via WMI activity
Check Compliance Search Status Action
Update Task Worknotes activity
Roll up lookup info to security incident activity
Update security incident with lookup results workflow
Filter Allowlisted Observables activity
Write content to record as attachment activity
Get IP from CI Flow Action
Security Operations workflow triggers
Create Security Operations workflow triggers
Security Operations Orchestration
Security Operations and the ServiceNow Store
Download an application from the ServiceNow Store for the first time
Get entitlement for a Security Operations product or application
Activate a ServiceNow Store application
Install a Security Operations integration
Update an application previously downloaded from the ServiceNow Store
Upgrade your instance to the next family release

Back to home page