Security Operations common functionality

Release version: Yokohama

Updated January 30, 2025

2 minutes to read

Summarize

Summarized using AI

Summary of Security Operations Common Functionality

The Security Support Common plugin activates automatically when any Security Operations application (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) is enabled. This plugin provides shared modules and functionalities that support all Security Operations applications. Access to the Security Operations module requires thesnseccmn.adminrole, typically inherited with administrative roles in these applications.

Show full answer Show less

Key Features

Integrations: Includes multiple out-of-the-box integrations for Security Incident Response, Threat Intelligence, and Vulnerability Response, with guidance for activation, configuration, and custom development.
Email Processing: Supports integration with external detection systems, fine-grained processing of security records, unmatched email handling, and duplication prevention.
Filter Groups: Enables creation of groups to filter and locate records across tables, such as grouping computers by manufacturer or filtering configuration items by vulnerabilities or IP ranges.
Escalations: Allows creation of escalation paths for security incidents, enhancing management of issues requiring specialized attention. Escalation buttons appear on relevant incidents.
Security Tags and Tag Groups: Provides metadata tagging for incidents, tasks, vulnerable items, and indicators of compromise (IoCs) to control access and organize security content.
Workflows and Workflow Triggers: Offers predefined workflows and triggers based on table conditions, enabling automation and customized response processes within Security Operations.
Enrichment Data Mapping: Transforms external data formats (XML, JSON, Properties files) into ServiceNow records for use in workflows and data enrichment.
Field Value Transforms and Field Mapping: Standardizes and maps unique customer field values for consistent parsing, enrichment, and integration with other tables like customer service cases or problems.
On-Demand Orchestration: Enables security analysts to execute specific tasks (e.g., process dumps) during incident analysis directly from workflows.
CMDB CI Identifier Rules: Defines rules to identify configuration items by matching data from third-party integrations, prioritizing evaluation order for accurate CI lookups.
Operating System Groups: Associates operating systems with process types and scripts to support retrieval of running processes in incident response workflows, with flexibility to add new OS groups.
Domain-Separated Property Overrides: Allows customization of Security Operations properties per domain when domain separation is enabled, to tailor application behavior in multi-domain environments.
Security Annotations: Facilitates adding explanatory notes to configuration items, observables, or incidents to enhance context and documentation in investigations.
Search Capability: Utilizes the Zing text indexing engine to enable fast, comprehensive text searches across all Security Operations applications.
Security Operations Orchestration: Supports interaction with Windows and UNIX systems through activity packs and workflows, expanding automation and data retrieval capabilities.

Practical Benefits for ServiceNow Customers

Streamlines security response across multiple applications by centralizing shared functions and integrations.
Enhances data consistency and operational efficiency through automated workflows, enriched data mapping, and standardized field transformations.
Improves incident management with escalation paths, tagging for access control, and annotations for contextual insights.
Supports robust integration with external security tools and detection systems, maintaining data integrity and reducing duplication.
Enables customization to fit organizational needs, including domain-specific property overrides and flexible filter groups.
Facilitates complex operational tasks and system interactions directly from incident workflows, increasing analyst productivity.

Whenever any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated, the Security Support Common plugin is activated. This plugin loads various modules that provide functionality that is common across all Security Operations applications.

Note:

Only users with the [sn_sec_cmn.admin] can view and use the Security Operations module. This role is inherited when you are assigned an administrative role in any of the Security Operations applications.

Security Operations Modules


Feature	Description
Security Operations Integration Reference, Threat Intelligence integrations, Vulnerability Response integrations	Several integrations are included with the Security Operations applications (Security Incident Response, Threat Intelligence, and Vulnerability Response). This section provides instructions for activating the plugins and configuring both ServiceNow and third-party integrations. Also included are some basic guidelines for developing your own integrations, as well as details on specific integrations included in the base system.
Security Operations email processing	You can set up the integration of information from external detection systems, provide granularity in processing security operations records, handle unmatched emails, and prevent duplication of records using Email Processing.
Groups	Filter Groups Create and use filter groups to locate records from any table on your instance. For example, you can create a group of all computers by the same manufacturer. You can also filter configuration items (CIs) that have similar vulnerabilities or that fall within a particular subnet IP address range. Escalations You can create an escalation path for security incidents for issues requiring more attention or expertise. Once an escalation group exists, a button appears on any security incident in that group.
Security Tags	Tags: Security tag rules provide filtering for security tag access.
Workflows	View Security Workflows You can view the many workflows included with the Security Operations applications. You can create workflows from templates and in the Workflow Editor. Workflow Triggers Security Operations workflow triggers contain a condition on a table. All workflows attached to the workflow trigger record run when the condition is met.
Utilities	Enrichment Data Mapping Enrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records. Security Operations workflows use enrichment data maps and provide output data to security incidents. Field Value Transforms Transforms unique customer field values into field values recognized by Security Operations email parsing, data enrichment or tables using field maps. Supports choice fields, references, and aligns external data into the standard terminology and format for your new record. Field Mapping Security Operations tables can be mapped to and from other tables, linking a security incident to a customer service case or a problem to other parts of the Security Operations system. For example, you can integrate a plugin to a Security Incident Response task. On-Demand Orchestration During Security Incident Response analysis, a security analyst may want to perform a task that is driven by a security incident workflow. For example, run a process dump on a particular CI. This can be accomplished with on-demand orchestration. Operating Systems Groups NA. SecOps Application Registry NA.
CMDB	CI Identifier Rules: CI identifiers are rules used to lookup a configuration item (CI) in the CMDB that contains matching information from a third-party integration. These rules define the fields that contain matching data and the order of precedence by which they are evaluated. The lowest Order value is evaluated first.