Security Operations common functionality

Release version: Xanadu

Updated August 1, 2024

2 minutes to read

Summarize

Summarized using AI

Summary of Security Operations common functionality

The Security Support Common plugin activates automatically when any main Security Operations applications—Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance—are enabled. This plugin delivers shared modules and features that provide foundational and common capabilities across all Security Operations applications. Only users with thesnseccmn.adminrole, typically inherited via administrative roles in Security Operations apps, can access these modules.

Show full answer Show less

Key Features

Integration Management: Includes prebuilt integrations for Security Incident Response, Threat Intelligence, and Vulnerability Response. Provides instructions for activating plugins, configuring integrations with ServiceNow and third-party systems, and guidance for developing custom integrations.
Email Processing: Supports ingestion of information from external detection systems, with features to handle unmatched emails, prevent duplication, and enable fine-grained processing of security records.
Filter Groups: Enables creation and use of filter groups to locate and organize records across any instance table, such as grouping computers by manufacturer or filtering configuration items by vulnerability or subnet.
Escalations: Allows creation of escalation paths for security incidents that require specialized attention. Escalation groups enable quick escalation via buttons on related incidents.
Security Tags and Tag Groups: Facilitates tagging of incidents, tasks, observables, and other security records to assign metadata and control access to security content by security groups.
Workflows and Workflow Triggers: Provides numerous built-in workflows plus the ability to create custom workflows from templates. Workflow triggers automate workflow execution based on specific table conditions.
Enrichment Data Mapping: Transforms data from XML, JSON, or Properties files into ServiceNow records. Used extensively in workflows to enrich security incidents with external data.
Field Value Transforms and Field Mapping: Translates customer-specific field values into standardized formats recognized by Security Operations, supporting choice fields and references. Enables mapping between Security Operations tables and other system tables, linking incidents to cases or problems.
On-Demand Orchestration: Empowers security analysts to trigger workflow-driven tasks on demand during incident analysis, such as running process dumps on configuration items.
CMDB CI Identifier Rules: Defines rules to identify configuration items in the CMDB by matching data from third-party integrations with prioritized evaluation order.
Domain Separation Support: Allows creation of domain-specific overrides for Security Operations properties, enabling customized application behavior per domain.
Operating System Groups: Maps operating systems to process types and scripts used in Security Incident Response workflows, with support for adding new OS groups as needed.
Security Annotations: Enables adding notes or comments on configuration items, observables, or incidents for additional context.
Search Capabilities: Uses the Zing text indexing engine to provide fast, comprehensive search across Security Operations applications.
Security Operations Orchestration: Integrates with Windows and UNIX environments using activity packs and workflows to interact with external systems.

Practical Benefits for ServiceNow Customers

Activating Security Support Common ensures consistent, shared capabilities across all Security Operations applications, streamlining setup, integration, and day-to-day security workflows. Customers benefit from improved data enrichment, standardized data handling, role-based access control, and automation opportunities that enhance incident response efficiency and accuracy. The plugin supports scalable and customizable security operations, enabling tailored escalation paths, domain-specific configurations, and integration with external detection and orchestration systems. Overall, it simplifies managing complex security workflows within the ServiceNow platform.

Whenever any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated, the Security Support Common plugin is activated. This plugin loads various modules that provide functionality that is common across all Security Operations applications.

Note:

Only users with the [sn_sec_cmn.admin] can view and use the Security Operations module. This role is inherited when you are assigned an administrative role in any of the Security Operations applications.

Security Operations Modules


Feature	Description
Security Operations Integration Reference, Threat Intelligence integrations, Vulnerability Response integrations	Several integrations are included with the Security Operations applications (Security Incident Response, Threat Intelligence, and Vulnerability Response). This section provides instructions for activating the plugins and configuring both ServiceNow and third-party integrations. Also included are some basic guidelines for developing your own integrations, as well as details on specific integrations included in the base system.
Security Operations email processing	You can set up the integration of information from external detection systems, provide granularity in processing security operations records, handle unmatched emails, and prevent duplication of records using Email Processing.
Groups	Filter Groups Create and use filter groups to locate records from any table on your instance. For example, you can create a group of all computers by the same manufacturer. You can also filter configuration items (CIs) that have similar vulnerabilities or that fall within a particular subnet IP address range. Escalations You can create an escalation path for security incidents for issues requiring more attention or expertise. Once an escalation group exists, a button appears on any security incident in that group.
Security Tags	Tags: Security tag rules provide filtering for security tag access.
Workflows	View Security Workflows You can view the many workflows included with the Security Operations applications. You can create workflows from templates and in the Workflow Editor. Workflow Triggers Security Operations workflow triggers contain a condition on a table. All workflows attached to the workflow trigger record run when the condition is met.
Utilities	Enrichment Data Mapping Enrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records. Security Operations workflows use enrichment data maps and provide output data to security incidents. Field Value Transforms Transforms unique customer field values into field values recognized by Security Operations email parsing, data enrichment or tables using field maps. Supports choice fields, references, and aligns external data into the standard terminology and format for your new record. Field Mapping Security Operations tables can be mapped to and from other tables, linking a security incident to a customer service case or a problem to other parts of the Security Operations system. For example, you can integrate a plugin to a Security Incident Response task. On-Demand Orchestration During Security Incident Response analysis, a security analyst may want to perform a task that is driven by a security incident workflow. For example, run a process dump on a particular CI. This can be accomplished with on-demand orchestration. Operating Systems Groups NA. SecOps Application Registry NA.
CMDB	CI Identifier Rules: CI identifiers are rules used to lookup a configuration item (CI) in the CMDB that contains matching information from a third-party integration. These rules define the fields that contain matching data and the order of precedence by which they are evaluated. The lowest Order value is evaluated first.