Instance Security Hardening Settings

Use the glide.security.use_csrf_token property to ensure the use of a secure token to identify and validates incoming requests, which in turn are used to prevent these attacks.

Some hardening settings have been removed with the release of Security Center baseline version 8.0.

Some hardening settings have been removed with the release of Security Center baseline version 5.0.

Some hardening settings have been removed with the release of Security Center baseline version 9.0.

Some hardening settings have been removed with the release of Security Center baseline version 7.0.

Some hardening settings have been removed with the release of Security Center baseline version 6.0.

Some hardening settings have been removed with the release of Security Center baseline version 4.0.

Some hardening settings have been removed with the release of Security Center baseline version 2.0.

Explore how baseline versions for hardening settings align with family and store releases.

Some hardening settings are removed from Security Center baselines.

New hardening settings are broken out by baseline release.

Updated hardening settings are broken out for each baseline release.

New hardening settings have been released with Security Center baseline version 8.0.

New hardening settings have been released with Security Center baseline version 5.0.

New hardening settings have been released with Security Center baseline version 4.0.

New hardening settings are available in Security Center baseline version 9.0.

New hardening settings have been released with Security Center baseline version 7.0.

New hardening settings have been released with Security Center baseline version 6.0.

New hardening settings have been released with Security Center baseline version 2.0.

Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.

Use the glide.ui.magellan.favorites.allow_public to specify whether unauthenticated users are allowed to see Favorites in the navigator.

Sanitize the HTML in the description fields by removing HTML tags that are sources of HTML injection attacks with the sn_impact_common.blacklist_tags_HTML_injection property.

Use the glide.ui.user_cookie.max_life_span_in_days property to set a maximum life span for user cookies created when users log in with the Remember Me checkbox selected. When the cookie expires, users who have selected the Remember Me checkbox are forced to reauthenticate into the instance.

The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.

The client callable GlideSystemUserSessionSandbox scriptable API exposes GlideSystemUserSession's addErrorMessageNoSanitization and addInfoMessageNoSanitization methods to the JavaScript sandbox. This allows all users to call this method via script.

Use the glide.sso.acr.enabled property to manage the account recovery feature.

Use the glide.authenticate.multifactor property to enforce role-based multi-factor authentication (MFA) for all users assigned to specific roles.

The glide.security.scoped_administration.honor_global_acl determines whether an application administration app can inherit global access control list (ACL) rules.

Use a system property to configure to specify which domains are allowed to make cross-origin requests.

Use a system property to help sanitize the HTML allowed in the descriptions fields. This property limits the allowed links to only those from the trusted domains listed in the property.

Use the glide.ui.security.codetag.allow_script property to disable support for embedding HTML JavaScript code created using of the [code] tag.

The glide.security.csrf_previous.time_limit property specifies the time in seconds for a secure token to expire.

Use the glide.security.use_csrf_token property to confirm the use of a secure token to identify and validates incoming requests, which in turn are used to prevent these attacks.

Use the glide.basicauth.required.api property to enhance security for basic authorization for incoming REST requests.

The API and Web Service category ensures that applications have appropriate authentication, authorization and session management, validate all input that traverses a trust boundary and include security controls for all API types.

Reduce the risk of session hijacking by applying continuous authentication policies to mobile sessions.

The glide.sys.domain.include_domain_condition_on_join property controls whether join queries are given domain separated conditions or not in order to ensure they apply domain separation functionality for dot walked fields.

Configure static analysis to examine scripts from both authenticated and unauthenticated users rather than limiting analysis to guest users only.

This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.

The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.

Configure the Auto set content type options property on your instance to prevent MIME confusion attacks.

This configuration affects access for delegated developers that are updating user roles through script. When the configuration is compliant, the developer will not be able to update or insert records into the sys_user_has_role table without also having the user_admin role.

Block expired CSRF tokens to prevent cross-site request forgery attacks.

Secure your instance by preventing unauthorized access from jailbroken devices.

This category looks at the logic and flow unique to each application with general secure principles. Specifically ensure that the intended sequence of business logic flow cannot by bypassed, that limits exist to detect and prevent automated attacks, and that protections against spoofing, tampering, information disclosure and elevation of privilege attacks exist.

Use the glide.http.cache_control property to set the default cache-control value in the HTTP response headers that the ServiceNow AI Platform sends when requesting static content data for a page. Examples of static content include images, CSS, and JavaScript rendered from within, for a page.

Use the sn_cse.com.snc.csf.vault_audit_enabled property to control whether the system logs changes to Code Signing-protected code.

Use system properties to ensure that certificate expiration and trust are checked for certificates received from outbound HTTPS call endpoints when host verification is not performed.

Use the sn_hr_core.impersonateCheck property to prevent a user from impersonating another user and accessing their HR information.

Use the glide.security.strict.actions property to enable checking of UI actions conditions in forms and lists before they execute. When you set this property to true, it adds an extra layer of validation on the table UI actions before they are executed.

Use the com.glide.security.check_unsanitized_html property to enforce sanitization behavior of translated_html fields on a global level for field assignments.

Use the glide.ui.m.blur_ui_when_backgrounded property to obfuscate all fields from the snapshot as the image is saved during the backgrounding process.

Use the glide.script.use.sandbox property to enable script sandboxing.

This control ensures proper encryption using strong algorithms and ciphers. This includes ensuring the recommended version of TLS is used for client connectivity, use of strong cipher suites, use of trusted and signed certificates, ensuring connections are encrypted between components and logging of connection failures.

The Configuration category ensures applications have a secure build environment and hardened third party library components. Specifically, ensuring a build and deploy pipeline is repeatable and includes automated testing and prevents known security issues from being deployed. This includes keeping dependencies up to date and free from known vulnerabilities.

Use the evt_mgmt.connector_assignment_group_admin_roles property to set which roles are authorized for admin access over the assignment group field in connector instances.

Learn how to configure the glide.service_portal.widget.allow_list property securely so that the access control lists (ACLs) for the tables don't expose sensitive information.

Learn how the glide.service_portal.widget.table_allow_list property enhances security by listing tables accessible to unauthenticated users through Service Portal widgets, dependent on additional checks and specific glide property settings.

Create a unique user account for each of your MID Servers to support auditability, enforce security controls, and enable least privilege access.

Activate the Contextual Security Plugin (com.glide.role_management) plugin to enable contextual security, which secures a record/information using create, read, write, and delete functionality.

The glide.security.csrf.rest.public_csrf.enabled property enables Cross-Site Request Forgery (CSRF) token validation for public REST APIs that use session-cookie authentication.

Use the glide.security.csrf.strict.validation.mode property to enable CSRF token strict validation. If the CSRF token doesn't match, it prevents resubmission of the request.

Use the glide.basicauth.required.databrokerrestapiprocessor property to require basic authorization for all inbound Data Broker Rest API requests.

The data protection category addresses the elements of confidentiality, integrity and availability (CIA) of data.

Use a system property to exempt roles from active session timeout limits.

If com.glide.dd_allow_global_access_tables does not contain the recommended value of wf_activity, wf_activity_definition, wf_workflow, wf_workflow_version, sp_portal, sp_widget, and sp_page, then those tables could be read by a delegated developer. This could provide the delegated developer read access to sensitive information.

The glide.sc.req_for.roles.default property defines a default behavior for the retrieveAddress API.

Use system properties to control what roles are automatically added to generative AI skill ACLs.

Use the glide.script.allow.ajaxevaluate to protect the system API from vulnerabilities of Client script execution through AJAX calls.

Avoid loss or leakage of sensitive data by disabling deprecated TLS versions.

If customizations do not require entity expansion, use the glide.stax.allow_entity_resolution property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities.

Manage how external link metadata is used in your instance with Connect Chat.

Use the glide.pop3.process_locked_out property to control inbound email actions for locked out, active users.

Avoid the introduction of unpatched vulnerabilities in the library by disabling legacy JQuery UI usage.

Update user records to disable local login for users with Single Sign-On (SSO) enabled.

Use a system property to prevent the display of explanation of locked form elements.

The glide.script.dot_walk.log_and_allow_violations property controls logging and enforcement of access violations when dot-walk is used cross-scope.

The glide.authenticate.multisso.debug property controls debug logging for Multi-SSO.

Prevent Resource Owner Password Credentials (ROPC) from granting OAuth 2 tokens.

Manage the log messages related to cookies in your instance.

Manage how stack traces are displayed in your instance.

Deactivate this property to prevent the user from publishing or accessing reports. This property disables the published reports feature in reporting.

Avoid the security risks of outdated encryption methods by disabling the use of the TripleDES/3DES encryption algorithm.

Use a system property to ensure that voice interactions/conversations are recorded under the appropriate internal integration user.

Use the glide.db.loguser property to disable SQL error messages from rendering in a browser.

Use the glide.outbound.sslv3.disabled property to force the MID Server to use TLS when making outbound connections, such as REST and SOAP requests. Normally, outbound connections from an instance are forced to use TLS instead of SSL.

Control whether users can download non-scanned attachments if the antivirus service is down or unreachable.

Configure the glide.db.clone.allow_clone_target property to prevent your instance from being used as a clone target.

Decrease the likelihood of authorization errors, and unintended information disclosure by displaying recommendations for high risk UI pages.

Manage how password complexity is handled in your instance.

Control whether demo certificates are used in production SAML configurations.

Use the glide.security.strict.updates property to enable double-checking of security on inbound transactions during form submission. When you set this property to true, it adds an extra layer of table validation before a form renders in the browser.

The glide.ui.attachment.download_mime_types property will force the specified list of dangerous file types to be downloaded to the client and not viewed inline in the browser.

Use the glide.ui.attachment.force_download_all_mime_types property to download MIME types and not to render inline in the browser.

Install the Email Filter (com.glide.email_filter) plugin to install email filtering within the instance. This filtering identifies existing headers, which enables you to decide what to do with the email based on the associated header. Alternatively, set com.glide.email_filter to false.

Learn how to set the glide.service_portal.enable_acls_for_encoded_query_in_list property to the secure value to prevent users from bypassing access control list (ACL) evaluations on a query condition in the Simple List Widget.

Use the glide.live_profile.details property to designate whether a user should be able to view all detail fields, such as company name and phone numbers, in a live profile.

Use a system property to ensure CSRF (Cross-Site Request Forgery) protection is enforced when setting user preferences.

The com.glide.snap.enable_scan property activates the antivirus scan functionality.

The glide.authenticate.basic_auth.restriction.active property controls whether the platform evaluates inbound basic-auth API requests against allowed access paths.

Manage the deny-list passwords in the Excluded Password table.

The sn_ext_usr_reg.captchaEnabled controls if CAPTCHA will be validated for external user registration.

Reduce the risk of requests by malicious bots by enabling CAPTCHA for customer registration.

Use the password_reset.captcha.ignore property to enable or disable requiring a CAPTCHA challenge when a user resets their password.

Manage Code Signing for application configuration data and scripts on your instance.

Use the com.glide.communications.httpclient.disable_crl_check property to control Certificate Revocation List (CRL) revocation checking for outbound HTTP requests over Transport Layer Security (TLS).

Use a system property to enforce cross scope privilege checks on the Service Portal form widget and prevent unauthorized retrieval of forms and table data between scopes.

Enable Cross-Site Request Forgery (CSRF) enforcement to protect authenticated processor requests from CSRF attacks when session cookies are used for authentication.

Manage how two-factor authentication is applied on your instance.

Use system properties to determine whether external users can be assigned the snc_internal role.

Manage the encrypters used for Password2 fields on your instance.

The glide.record.legacy_cross_scope_access_policy_in_script property disables scope fencing allowing scoped apps to access global script interfaces. It was created as a patch to GlideRecord's cross scope access.

Use a system property to protect your Language Learning Models (LLMs) with Guardian.

Use the com.glide.cs.html.sanitizer.enabled property to enable HTML sanitizer service.

Reduce the risk of cookie/session-related hijacking of web apps using a system property.

Use Identity and Access Audit to track changes to user accounts, groups, and roles.

Manage the interpolation protection on your instance.

Use the glide.ui.jelly.js_interpolation.protect property to ensure that any JavaScript about to be executed on a Jelly page is protected from injection with the help of Jelly interpolation.

The MID Server command audit log records details such as the command name, command hash, name of credential used, and execution status.

Use an inactivity timeout on your MID Servers to reduce exposure to potential attackers.

Enable IAM and Boundary Checks for Amazon Bedrock access.

Use the glide.enable.password_policy property to enable password policy checks whenever a user changes their password using the user interface.

Use the The Zero Trust- Policy Based Session Access plugin to control if users authenticating through a mobile app will have their roles reduced.

Use the com.glide.security.protected_table.enabled property to prevent higher privilege users from tampering with log tables.

Reduce the risk of replay attacks by enabling relay state in SAML requests to help prevent replay attacks.

Manage a check for report_view ACLs of published reports.

Use a system property to enable the role masking feature.

The glide.cs.sanitize_inbound_messages.enabled property controls whether Virtual Agent runs a dedicated HTML sanitization check on inbound chat messages sent from a requester to an agent.

Manage the encryption of LDAP authentication requests on your instance.

Enable static analysis to provide compile-time security checks for JavaScript code in the scripting sandbox.

The com.glide.script.static_analysis.enable_sync property controls whether static analysis security violations block script execution synchronously or are recorded asynchronously. Setting this property to true enables synchronous mode, which blocks scripts with security violations.

The glide.security.manager property contains the Java classname of the current Java security manager.

Use a system property to enable cross-origin communication between iframes.

Manage the version of UserCookie that is enabled on your instance to secure the storage of the secret key in the source code.

Use the sn_fsm.use_query_rules property to apply rules and filters to the Field Service Management tables.

Use the glide.script.secure.ajaxgliderecord property to perform access control rule (ACL) validation when server-side records, such as tables, are accessed using GlideAjax APIs within a client script.

Learn how to configure the glide.enforce_security_scope.sn_hr_core property so that the Human Resources Scoped App: Core (com.sn_hr_core) plugin does not expose sensitive data to access control lists (ACLs) from all other scopes.

Learn how to prevent unauthorized access to data in the Human Resources Lifecycle Events application by verifying that the glide.enforce_security_scope.sn_hr_le property is set to the secured value.

Discover how to set the glide.enforce_security_scope.sn_hr_va property to a secure value, preventing data leakage from the Virtual Agent Conversations scoped application.

Use the glide.record.legacy_cross_scope_access_policy_in_script property to control the permissions of scoped apps.

Avoid unauthorized or undesired access to application data by enforcing application-specific access control lists (ACLs) only for application data.

Use the com.glide.communications.httpclient.fail_on_non_pass_crl_status property to control whether the platform terminates outbound HTTP requests when Certificate Revocation List (CRL) checks can't determine revocation status.

Learn how to secure your credentials from unauthorized use by configuring the MID Server property.

The glide.script.dot_walk.enforce_cross_scope_access_all_tables property defines the base access control decision for all table data accessed through dot-walk when the access is cross-scope.

Reduce the risk of brute force account login by enforcing current password policy compliance requirements on login.

Manage how the system handles access control lists that reference roles deleted from the system.

The glide.sg.device_encryption_enabled property enforces the Federal Information Processing Standard (FIPS 140-2) Encryption. Mobile device encryption and passcode ensure that an unauthorized user can't access the content of a device even if the device is physically obtained.

The glide.sys.domain.access_handler.included_tables property controls which tables have cross-domain write protection enforced.

Manage how incoming queries are validated on your instance.

Manage field level ACLs in GlideRecordSandbox on your instance.

Use a system property to prevent list filters from affecting the initial values of created records.

Configure your instance to conduct ACL checks on groupby columns.

The com.snc.platform.security.oauth.mcp.aig_scope_support property controls how OAuth access tokens are cached and reused for Model Context Protocol (MCP) flows in AI Gateway (AIG).

Configure the glide.oauth.state.parameter.required property to prevent your instance from cross-site request forgery (CSRF) attacks.

Learn how to configure the com.glide.communications.httpclient.ocsp_allow_network_error property to prevent bad actors from bypassing Online Certificate Status Protocol (OCSP) checks.

Manage how the password reset functionality operates on your instance.

Enforce query ACLs for Knowledge Quick Links using a system property.

Enforce query ACLs on sublist, list count, and widget data table queries using system properties.

Manage how Read ACLs are enforced on your instance.

Use system properties to ensure that only catalog variables with an empty read role are indexed for search.

Use the glide.cms.catalog_uri_relative property to enforce relative links from the URI parameter on /ess/catalog.do.

Use a system property to enforce cross-scope access checks for newly created tables.

Use the glide.enforce_security_scope.sn_gsm property to control how the application data from the Public Sector Digital Services application is accessed.

Use the glide.enforce_security_scope.sn_gsm_info_req property to control access to playbook data for the Information Request playbooks feature.

Use the com.glide.security.referrerpolicy property to ensure that the Referrer-Policy HTTP header sends the appropriate level of data to each ServiceNow page to help prevent data leaks.

Use the glide.cms.dashboards.sharing_with_secure_search property to control whether users can share dashboards.

Configure the Agent Workspace for HR Case Management plugin so that data in scope master tables can only be accessed by users with the correct permissions, enforcing the principle of least privilege.

Use the glide.enforce_security_scope.sn_svc_appl property to ensure that the data in master scope tables is secured.

Use this property to determine if only the access control lists (ACLs) within the License and Permit plugin will be used in determining access to the scope, or if ACLs from all scopes will be considered.

The com.glide.hub.code_signing.full.validation.enabled property controls the strictness of checks enforced when Code Signing is fully enabled.

Use the glide.security.strict_elevate_privilege property to control whether roles marked as privileged must be manually elevated for the user to be granted the role's capabilities.

Use the glide.security.strict.user_image_upload property to enable access control for the upload/update of a profile picture when performed on a user record.

Use the glide.security.url.whitelist system property to add extra layer of validation to ensure whether any external URL introduced should be a part of inclusion listed URLs.

Use a system property to ensure that any choice field value, when passed via a URL query string, is a valid active choice when a record is created.

Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.

The glide.security.enable_archive_table_acls property controls whether access control lists (ACLs) of the original table, the table the archive table was created from, are evaluated to false.

Prevent Contextual Search results from containing referral links outside the current domain with a system property.

The glide.processors.check_access_before_process system property enables access control list (ACL) enforcement for creating or deleting dashboards when a user is logged in.

Verify that your MID Server user accounts does not have more the necessary granted permissions.

Use a system property to determine the minimum size of the private key used for Certificate Signing Request (CSR) generation with the Certificate Inventory Management application.

The error handling and logging category addresses the quality and verbosity of logged information exposed to stakeholders.

Use the glide.export.escape_formulas property to prevent Excel Injection, also, known as formula injection.

Use the glide.ui.escape_html_list_field property to force HTML escapes for HTML fields in a list view.

Use the glide.html.escape_script property to force escape from JavaScript (<script></script>) tags in HTML fields during list views.

Use the glide.ui.escape_all_script property to force escape of all scripts injected into Jelly.

Learn how scratchpad factors into the security posture of your instance and how to manage it so that malicious scripts can't be executed on it.

Manage how XML escapes are handled on your instance.

Use the glide.ui.escape_text property to force escape of XML values at the parser level before transmitting them to the client's browser.

Use the glide.basicauth.required.excel property to designate if incoming Excel requests should require basic authentication.

Use system properties to exclude tables and fields from Data Generation, which is used to generate fake data sets based on existing data. Tables and fields that are added to these exclusion lists can't be used for Data Generation feature.

Use the sn_ext_usr_reg.allowed_email_domains property to list acceptable external email domains.

Manage the number of days that a registration link can be accessed.

The file and resources category ensures applications handle untrusted file data securely and store untrusted data from untrusted sources with limited permissions in an appropriate location.

Use the glide.ui.strict_customer_uploaded_static_content property to enable restrictions on the file types that can be downloaded when they have been uploaded using the Upload File functionality.

Use system properties to control which inbound IP addresses can connect to self-hosted instances.

Manage the number of interactive sessions on your instance.

Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user.

Manage Glide System's ability to log scripts being executed in the sandbox environment.

When you activate the High Security plugin, it creates or updates hundreds of different configurations to control the level of security on your instance. These configurations mitigate many of the top OWASP attacks by enabling strict access control, input validation, and output encoding.

The glide.security.admin.override.accessterm property controls whether admins can control override access control list (ACL) evaluation.

Use the glide.html.sanitize_all_fields property to enable the HTMLSanitizer script include, which sanitizes HTML input based on exclusion listed and inclusion listed attributes configured in a script.

Use the glide.cookies.http_only property to enable the HTTPOnly attribute for sensitive cookies.

Use the glide.basicauth.required.importprocessor property to designate if incoming import requests should require basic authentication.

Use a system property to the secure value to prevent users from continuing to use a session via cookies after the OAuth token used to create the session expires.

Use the glide.ip.authenticate.strict property to specify IP ranges that can make inbound connections on an instance.

Configuring these properties protect from dangerous APIs being exposed to the scripting engine.

Use the glide.basicauth.required.jsonv2 property to designate if incoming JSONv2 requests should require basic authorization.

KittyScript sandbox enforcement prevents untrusted scripts from executing with unrestricted system privileges. The following properties control enforcement activation, level, and timing. Configuring them incorrectly can cause malicious code to bypass security protections and access restricted APIs.

The com.glide.script.kittyscript.validation.mode property controls JavaScript validation for unauthenticated (guest) users before it runs in the server-side sandbox.

Use this property to manage the distinguished name of a LDAP Server record.

Use the glide.angular.legacy property to protect from potential security risks arising from attacks on vulnerabilities discovered in outdated AngularJS library versions.

The glide.jquery.legacy is used to prevent older prepatched JQuery versions from being used which will introduce unpatched vulnerabilities in the library.

The glide.platform_ml_di.max_attachment_size property controls the maximum allowed size limit for returning attachments in training and prediction flows.

The glide.platform_ml_di.max_attachment_size_graphql property controls the maximum allowed size limit for returning attachments in GraphQL endpoints of training or prediction flows.

The glide.authenticate.basic_auth.allowed_users property defines specific user accounts that bypass the Basic Authentication Restriction gate without multi-factor authentication.

The glide.authenticate.basic_auth.allowed_roles property defines roles that bypass the Basic Authentication Restriction gate without multi-factor authentication.

Use the glide.authenticate.limit.concurrent.sessions.across.all.nodes property with the Limit Concurrent Sessions plugin to manage the number of sessions tracked across all nodes.

Configure the com.glide.limit.concurrent.sessions plugin to reduce the chance of session hijacking on your instance.

Use the glide.guest.active.session.life_span property to control the duration of an active guest's HTTP sessions.

Configure the glide.http.response.get_body.limit.enabled and glide.http.response.get_body.limit properties to protect your instance against OutOfMemoryExceptions.

Use the glide.integrations.active.session.life_span property to enforce the maximum lifespan on active integration HTTP sessions, regardless of session inactivity.

Configure the sn_kb_social_qa.max_comments_per_user_daily property to restrict the number of QA comments per day.

Configure the sn_kb_social_qa.max_subscriptions_per_user_daily property to limit the max number subscriptions a user can subscribe to in a day.

Configure the number of inbound email attachments allowed per Email [sys_email] record on your instance.

Use the glide.authenticate.session_access.mobile.refresh_token_interval property to govern the length of time that must elapse before a mobile device user will be forced to re-authenticate.

Reduce the risk of account takeover in high assurance sessions by limiting session length

The glide.ui.active.session.life_span property enforces max lifespan on active authenticated HTTP sessions irrespective of inactive timeout.

Configure the glide.outbound_http.security.log.allow.all.fields property to false to prevent sensitive Outbound HTTP fields from being logged in plain text.

Configure glide.html_sanitize.discarded_log.enable property to determine if HTML sanitization events will be logged in your instance.

Enable impersonation history logging using a system property.

Use a system property to enable creations of session audit events

Configure glide.sys.log_impersonation to control if user-impersonating events are logged in your instance.

The Malicious Code category ensures that best efforts are made to confirm that your code is free of vulnerabilities and unwanted functionality.

Two script actions are available that enable a site administrator to manage the number of times a user can provide an incorrect password before being locked out from the ServiceNow AI Platform. You can enable either of these script actions to manage failed login attempts.

A script action is available that enables site administrators to manage the number of times a user can provide an incorrect password before being locked out from the ServiceNow AI Platform. You can enable this script action to manage failed login attempts.

Configure the com.glide.attachment.max_size property to control the maximum size (in megabytes) permitted for an uploaded attachment.

The glide.email.smtp.max_recipients specifies the maximum number of recipients the instance can list in the To: line for a single email notification.

Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user.

Decrease the likelihood of a brute force attack by minimizing failed login attempts for high assurance sessions.

Configure the glide.sg.blur_ui_when_backgrounded property so that the UI of the app is blurred when the app is running in the background.

The glide.rest.policy.normalize_apply_all_fields property controls how the platform builds lookup keys for REST API access policies when wildcard flags are set.

Control whether a user can perform raw SQL queries on the database.

Activate and run the Packages Call Removal Tool (com.glide.script.packages_call_removal) plugin, and then consider whether each of the proposed changes should be completed or rejected.

Use this property to enable end users to reset or change passwords using a self-service process.

Use the glide.security.diag_txns_acl property to control stats.do, threads.do, thread_pool_stats, and replication.do access from an unauthenticated connection.

Prevent bypassing Mosaic domain-visibility filtering to maintain data separation boundaries across business units and customer domains.

Set the glide.security.empty_acl.popup_window.enabled property to the secure value of true to block attempts to create, update, or save an invalid ACL. This setting will also provide a client-side model to configure a role or security attribute for the ACL.

Use system properties to prevent an impersonating user from viewing application data.

Configure this property to control if inactive users can authenticate on your instance.

Use a system property to avoid the use of the implicit grant type.