Security Operations

The MITRE ATLAS framework documents adversarial tactics and techniques targeting AI (artificial intelligence) and ML (machine learning) systems, complementing traditional IT security frameworks.

The MITRE-ATT&CK framework is a knowledge base of common tactics, techniques, and procedures (TTP) that your organization can access to develop specific threat models and methodologies against cyberattacks.

Before you can use the VirusTotal integration, you must download it from the ServiceNow Store.

After an application has been given entitlement, you must activate its dependencies plugin and activate the application. This process also applies to applications downloaded to sub-production instances.

You have the option to review the details, edit the configuration of a skill, and reactivate it in the Guided Setup.

The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including the Security Operations Whois integration. Before you can use the Security Operations Whois integration, you must download it from the ServiceNow Store, and you must have a valid account from WhoisXML API.

Use the following steps to add an integration to your Security Incident Response application.

All the selected capabilities are listed as tabs on the Add APIs page. Add at least one API for each capability.

Add application details for your integration.

Add the Early Warning flag or Admiralty score as a weighted criterion in a risk rule to prioritize vulnerable items based on vulnerability intelligence data.

You can add configuration items to one or more existing cases. After the CIs have been added to cases, you can use Security Case Management to analyze the data.

Configure the connection details for the integration.

You can add IoCs and observables to existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.

After you have created a case, you can add artifacts, such as security incidents, CIs, and indicators of compromise, to the case. These artifacts act as clues in solving the case.

For a scanner, normalize assets, labels, and detections into one consistent format before this data reaches Unified Security Exposure Management.

You can add security incidents to one or more existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.

You can add affected users to one or more existing cases. After the user records have been added to cases, you can use Security Case Management to analyze the data.

AI Security Exposure Management integrates with Employee Center and third-party security tools to enable AI asset owners to remediate AI posture findings (configuration issues) directly through lightweight tasks. These tasks can reduce time to remediate (TTR) by assigning a task directly to the asset owner.

Access the entire attack surface across various types of findings on the AI Security Exposure Management dashboard with the AI Exposures module. AI Security Exposure Management is a dedicated module of the Security Exposure Management workspace.

Install and configure the required applications.

Resolve the finding or request an exception from Employee Center AI posture findings (configuration issues) directly through lightweight tasks.

The AI guardrails helper skill and agentic workflow can help you understand finding types, associated guardrails, and how guardrails map to findings. See what type of findings you have, understand the guardrails associated with findings, and see why the skill to mapped guardrails to particular findings.

Use the AI agent to ask about the guardrails that were identified by the AI skill component in the AI Guardrails Helper, automatically defer findings with existing mitigations in the form of guardrails, or create exception rules to auto-defer future findings.

This AI skill can help you identify finding types, understand the guardrails that might be already mapped to findings, and see why they were selected by the skill to map to specific findings. This information can help you determine which findings might be already mitigated or deferred for later review or remediation.

As you are analyzing a case, you can add annotations to any artifact.

Early Warning for Security Exposure Management, powered by Armis, enriches the Central Vulnerability Database (CVDB) in Unified Security Exposure Management (USEM) with vulnerability intelligence of imminent exploit. This enables your security team to prioritize and patch vulnerabilities before threat actors weaponize them.

The lists of supporting artifacts assigned to a case can sometimes get long and there may be instances where you want to remove particular artifacts from a list. Rather than permanently remove the artifacts, you can exclude them from the list and, as needed, return them to the list at a later time.

Chat with an AI agent to help you assess the potential exposure of your configuration items and your business services to vulnerabilities.

Create an asset profile with conditions to group assets. You can use these asset profiles in your policies.

Associate MITRE ATLAS tactics and techniques with a security incident for better security incident and threat analysis.

Associate MITRE-ATT&CK tactics and techniques to a security case for better security case management and threat analysis at a granular level.

Associate MITRE-ATT&CK tactics and techniques to an observable for better security incident and threat analysis at a granular level.

Associate the MITRE-ATT&CK tactics and techniques to the security incident for better security incident and threat analysis.

You can use the associated MISP events list view to view the events that have been created manually or automatically in the context of a security incident.

Attack patterns are a type of Tactics, Techniques, and Procedures (TTPs) that describe the methods that adversaries attempt to compromise targets. Attack Patterns apply for STIX 2.x.

Use the base system auto-extraction rules to import the MITRE-ATT&CK information from any existing third-party integrations.

The Block Action capability blocks observables associated with a security incident on a firewall, web proxy, or other control point using implementation flows. This capability is used during incident response investigations to contain an identified threat.

Use bulk edit risk modification to request an adjusted risk rating, and optionally apply compensating controls, across multiple vulnerable items that share a single vulnerability.

Risk modification in the Bulk Edit dialog is restricted in specific scenarios based on the vulnerabilities mapped to the selected items and the vulnerability configuration.

Attack modes and methods, sometimes referred to as Tactics, Techniques, and Procedures (TTPs), are representations of how cyber adversaries behave. They characterize what these adversaries do and how they do it, in increasing levels of detail. Attack modes and methods apply for STIX 1.1.

Avoid some of the pitfalls you can encounter when writing your own integrations by following these guidelines.

Before you run Threat Intelligence in your instance, you must download it from the ServiceNow Store. You can also set up properties and define a threat source.

These troubleshooting suggestions can help you resolve common issues you can encounter when setting up or running integrations.

The ServiceNow platform provides several mechanisms for developing integrations with external systems. The ServiceNow Security Operations product suite adds integration capabilities intended to streamline the process of integrating with security-focused external systems.

Indicators of Compromise (IoC) are artifacts observed on a network or operating system that are likely to indicate an intrusion. Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or domain names. IoC applies for STIX 1.1 and 2.x.

OPSWAT Metadefender is a security solution that provides access to multiple anti-malware machines and easily integrates with Security Operations.

Observables represent stateful properties (such as the MD5 hash of a file or the value of a registry key) or measurable events (such as the creation of a registry key or the deletion of a file) that are pertinent to the operation of computers and networks. Observables apply for STIX 1.1 and 2.x.

Threat Intelligence Orchestration activities allow users to determine whether a threat has been seen before in other security incidents or on other systems using workflow orchestration.

The Security Operations applications (Security Incident Response, Threat Intelligence, and Vulnerability Response) can be seamlessly integrated with other ServiceNow applications to enhance their functionality.

The Capability Execution Tracking - Complete flow action updates the audit record when the flow is complete.

The Capability Execution Tracking - Failure flow action records a failure to the audit record.

In addition to creating cases manually from Security Case Management, you can also create cases from security artifacts, such as security incidents, indicators of compromise, affected users, and configuration items.

In Security Incident Response, you can create cases from security incidents, CIs, and affected users, as well as add those artifacts to existing cases.

Security Case Management provides a means for security analysts who are engaged in threat hunting to gather information on suspicious activity in their environment. Case-related records, such as security incidents, observables, CIs, and affected users can be added to cases to accommodate broad and specific analysis.

You can create a new case from one or more affected users in the User [sys_user] table. You can also add users to existing cases.

You can create a new case from one or more configuration items (CI) in the Configuration Item [cmdb_ci] table. You can also add CIs to existing cases.

In Threat Intelligence, you can create cases from IoCs and observables, as well as add IoCs and observables to existing cases. You can also create observables directly from a case.

Integration capability implementations specify the flow to be executed. In the base system, flows are executed sequentially, in the order specified in the implementation. You can change the order as needed.

Checks the Carbon Black command status and retrieves processes to use in the flow.

Determines whether the MID Server identified in the MID Server Host field of the integration's configuration is up and running. If the field is set to Any, the flow action verifies that any MID Server is up and running.

Determines the status of a Carbon Black session within the flow.

Select the capabilities that you want to include in your integration.

The new Integration Capabilities Framework 2.0 has been redesigned to enable implementation of integrations in a simple and consistent manner. This ensures a consistent experience for similar types of integrations (for example: observable reputation lookup).

Closes a Carbon Black session within the flow.

The Collect Carbon Black Configurations flow action gathers configuration information to use in the flow.

The Combine results workflow activity merges the results from third-party integrations to use in the workflow.

Many of the flows associated with third-party integrations include the same activities. For example, activities for beginning and completing processing.

Configure the ServiceNow AI Platform to automatically create events in MISP.

Install and configure the Early Warning for Security Exposure Management integration plugin to ingest vulnerability intelligence and enrich your vulnerability database with threat signals.

Gain immediate insights into your staff's vulnerability to phishing attacks by integrating with KnowBe4, a leading cybersecurity awareness training platform. Through KnowBe4 integration, identify trends and areas of improvement in your cybersecurity training programs, monitor overall phishing resilience and proactively strengthen your organization's security measures.

Gain valuable insights into phishing simulation metrics directly within the Cybersecurity Executive Dashboard through seamless integration with Microsoft Defender for Office 365.

Review the MITRE ATLAS system property values to configure how ATLAS information is handled in security incidents.

Review the MITRE-ATT&CK system property values.

Configure the ServiceNow AI Platform to do sighting searches for observables in the MISP instance. With this information, you can determine how often threats occur.

Configure AI skills and agentic workflows for ServiceNow Otto for Unified Security Exposure Management.

Use the AI Admin Hub console to configure and activate the generative AI skills for ServiceNow Otto for Threat Intelligence Security Center (TISC).

This section guides you through the entire process of implementing Unified Security Exposure Management (USEM) on your ServiceNow AI Platform instance. It provides detailed instructions on how to download the application from the ServiceNow Store, install it, and configure it to optimize your security workflows.

New observables can be created from cases in Security Case Management.

You can create a security case from affected users in the User [sys_user] table. After the affected users have been used to create a new case, you can use Security Case Management to analyze the data.

You can create a security case from configuration items in the Configuration Item [cmdb_ci] table. After the CIs have been used to create a new case, you can use Security Case Management to analyze the data.

In Security Incident Response, you can create cases from security incidents. After the security incidents have been used to create a new case, you can use Security Case Management to analyze the data.

Cases are used to track information about a campaign or state actor threatening your organization. After a case is created, you can add artifacts that allow you to review and analyze all related information within a single case record.

In Threat Intelligence, you can create a case from artifacts (IoCs or observables). After the IoCs or observables have been used to create a case, you can use Security Case Management to analyze the data.

You can assign tags to security incidents, response tasks, vulnerable items, observables, IoCs, and security cases to create metadata on the responding record and define who should have access to specific types of security content. The tags can be added to security groups to organize them.

The Create Command Process flow action create a Carbon Black command process to use in the flow .

Create detection rules and map them against the tactics and techniques. With this mapping, you can see the coverage for the detection rules in your organization.

When you use domain separation, you can create overrides to existing Security Operations properties that allow you to customize the functions of the applications in each of your domains.

You can use Duplication Rules to identify new email, enrichment data, or field maps with active duplicate records and process them appropriately.

You can specify email addresses for reports and control automatic email behaviors using email Properties.

The Create enrichment data records flow action creates or updates enrichment records to use in the flow.

Transform data from JSON, XML, or Properties file format to ServiceNow records using enrichment data maps.

Security Operations provides you with finer field-mapping granularity so you can map a Security Operations table to any other table.

Field Value Transforms defines one transformation between provided source data, and the replacement value to use.

Create and use filter groups to locate records from any table on your instance. For example, you can create a group of all computers by the same manufacturer. You can also filter configuration items (CIs) that have similar vulnerabilities or that fall within a particular subnet IP address range.

You can create an integration and add the associated integration card to the Security Integrations screen. This procedure is intended for partners who create third-party integrations.

You can select a single or multiple users and apply security annotations to them using the Actions on selected rows choice menu.

Operating system groups are used to map an operating system to specific process types and scripts in Security Incident Response workflows. The scripts define how running processes for the defined operating system groups are retrieved. New operating systems can be added as needed.

You can select a single or multiple observables and apply security annotations to them using the Actions on selected rows choice menu.

Annotations on CIs allow you to track activity across incidents. You can add annotations to a single or multiple CIs.

Security tag rules provide filtering for security tag access.

The Create Session flow action establishes a Carbon Black session to use in the flow.

Escalate a security incident to any group associated with the incident using Escalations.

Create a workflow trigger that contains a condition on a table.

CrowdStrike Falcon Intelligence provides cyber security intelligence that easily integrating with Security Operations.

CrowdStrike Falcon Intelligence enriches Threat Intelligence with data for security incidents and associated observables.

Use this generative AI skill to identify the primary (first-found) vulnerable items for configuration items along with duplicate vulnerable items that are imported by your vulnerability scanners.

Define an attack pattern to help categorize attacks.

Define a campaign to group adversarial behaviors.

Define a course of action to prevent an attack or to respond to an attack that is in progress.

Define identities who represent actual individuals, organizations, or groups.

Define sightings that denote that an indicator was seen.

Define an Infrastructure that is any systems, software services, and any associated physical or virtual resources intended to support some purpose of an attack.

Define an intrusion set that is a grouped set of adversarial behaviors and resources with common properties.

Define a geographic location to provide more context to other SDOs.

Define malware analysis that captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.

Define a malware that represents malicious code.

Define marking definitions that represent a specific data marking.

Define relationships between the indicator object and other SDOs.

Define relationships between SDOs, except the indicator object.

Define relationships between SDOs and the observable object (SCO).

Define object sighting that describes that an object (malware, tool, threat actor, and so on) was seen.

Define the technique detection coverage that your organization must measure and detect specific adversary techniques.

Define mitigation coverage per technique to gain visibility into how well your organization can prevent related attacks.

Define threat actors who are individuals, groups, or organizations who act with malicious intent.

Define threat groupings as objects that have a shared context.

Define threat notes that convey information to provide further context or analysis that is not available in existing objects.

Define threat opinions as an assessment of the accuracy of the information in a STIX object.

Define threat reports that describe a threat actor, malware, attack technique, including context and related details.

Define tools as legitimate software that is used to perform attacks.

Define vulnerability as a weakness or defect in a software or hardware component that attackers exploit.

The Capability - Determine CIs workflow activity determines which configuration items (CIs) to include in the workflow.

The Determine Observables workflow activity determines which observable to include in the workflow

The Sightings Search - Determine Observables workflow activity determines which observables to include in the workflow.

Domain separation is supported in MISP. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.

This domain separation overview pertains to MITRE-ATT&CK. Domain separation allows you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.

Domain separation is supported in the Threat Intelligence module that is available as part of Security Incident Response. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

Downloading an application from the ServiceNow Store for the first time involves a number of easy steps. Some of the steps are performed on the ServiceNow Store and some in your instance.

The Early Warning CVD Attributes table stores vulnerability intelligence signals for vulnerabilities. Each attribute represents a threat indicator ingested from the Early Warning feed.

Install the required applications for Early Warning for Security Exposure Management.

Complete the following setup steps in your Armis Intelligence Center console environment before you configure Early Warning for Security Exposure Management in your ServiceNow AI Platform instance.

Editing an integration enables you to modify existing published integrations to adapt to evolving requirements or correct configurations.

Edit transforms in your existing email event records.

Generate new Security Operations records from external detection systems using Email Parsing. This feature provides a method for integrating information from external tools such as malware detection, vulnerability detection, firewalls, threat intelligence, and more.

You can set up the integration of information from external detection systems, provide granularity in processing security operations records, handle unmatched emails, and prevent duplication of records using Email Processing.

Email Properties specify which inboxes are used as input in Email Parsing to import information from external detection systems to create records for security, vulnerability, and IoCs. You can set up a general account for all external detection systems to use, or individual email accounts for Security Incident Response, Threat Intelligence, or Vulnerability Response.

The Email Search and Delete capability returns the number of threat emails from an email server search and, optionally, returns details for each email found. After the email search is completed, you can delete the emails.

Employee Service Center provides a standardised approval experience and process for Business Unit Heads, Service Owners, and IT Heads, who may not regularly log in to USEM. It enables them to manage approvals from a central location, such as Employee Center Approval Requests, ensuring that requests are routed to the right approvers, decisions are tracked transparently, and actions are completed efficiently. This improves operational efficiency, accountability, and the overall approver experience.

The Enrich CI capability allows you to enrich data for configuration items associated with a security incident.

The Enrich Observable capability allows you to enrich observables with additional information from a variety of sources using implementation flows. This capability is used during incident response investigations to contain an identified threat.

The Enrich Observable WhoIs workflow performs enrichment on selected observables. If the observables are of a type recognized by the WhoisXML API Integration, the observables are enriched.

Enrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records. Security Operations workflows use enrichment data maps and provide output data to security incidents.

The first step in installing a Security Operations application is to verify that the application or the product and its associated applications have valid ServiceNow entitlements.

You can create events in MISP automatically or manually from the ServiceNow AI Platform. You can also edit the event data in MISP from the ServiceNow AI Platform.

You can remove artifacts from the lists of supporting artifacts. They are not permanently removed and can be returned to the case as needed.

The Execute Shell Script workflow activity runs a MID server shell script within the workflow.

The Execution Tracking - Begin flow action starts the auditing process for a Security Operations Integration flow that operates on observables.

The Execution Tracking - Begin (CIs) flow action starts the auditing process for a Security Operations Integration flow that operates on configuration items (CIs).

The Execution Tracking - Begin (Mail Search) capability execution action creates an execution tracking record and marks the record state as Started. This action is used by all capability and implementation flows to keep track of their state.

The Capability Execution Tracking - No Impls flow action creates an error record when no integration capability implementation is found.

SIR Integration Builder offers a guided experience to efficiently integrate new tools through a simplified workflow.

AI Security Exposure Management is a part of the Unified Security Exposure Management product suite of applications. AI Security Exposure Management integrates with third-party AI security products to help you manage various types of potential AI exposure across your environment.

The Vulnerability Response Integration with Cisco AI Defense imports AI model vulnerabilities and AI model validation data (results from automated red teaming or pentests) into your ServiceNow AI Platform instance. Use this data to detect security risks, drive remediation workflows, and verify compliance with AI security requirements.

Fix Intelligence for Security Exposure Management enriches USEM with a de-duplicated catalog of remediation actions, each linked to the findings and assets it resolves and scored by the risk it removes.

Threat analysts and security operations teams can use ServiceNow generative AI skills to summarize case management content and generate threat intelligence case reports with ServiceNow Otto for Threat Intelligence Security Center (TISC).

Unified Security Exposure Management (USEM) is a platform that brings together infrastructure, application, container, and configuration exposures into one unified experience.

The Extract Shell Script from MID script workflow activity pulls a MID server shell script to use with in the workflow.

Security Operations tables can be mapped to and from other tables, linking a security incident to a customer service case or a problem to other parts of the Security Operations system.

Transforms unique customer field values into field values recognized by Security Operations email parsing, data enrichment or tables using field maps. Supports choice fields, references, and aligns external data into the standard terminology and format for your new record.

The Filtered Allowlisted Observables workflow activity removes observables that can be ignored from the list of observables. This activity can accelerate the investigation and remediation process.

Activating the Fix Intelligence for Security Exposure Management plugin (sn_vul_fix) installs the following tables, role, scripts, automation, and integration components.

Fix Intelligence for Security Exposure Management enriches your exposure findings with normalized fix information and stores each unique fix as a Fix record. The feature links every fix to the findings it resolves and rolls up a risk score per fix. Your team can remediate by fix instead of one finding at a time.

Fix Intelligence for Security Exposure Management provides prescriptive fix and remediation intelligence , so your security team can remediate exposure findings by fix instead of one finding at a time.

Reference information about the roles, tables, and other components installed with Fix Intelligence for Security Exposure Management.

The Security Common Orchestration Get Configuration Item FQDN flow action retrieves the fully qualified domain name (FQDN) of a configuration item. This flow action can accelerate the investigation and remediation process.

The Create Compliance Search action creates a compliance search for emails in the designated Exchange server(s) using the search queries defined and returns the name of compliance search created.

The Get IP from CI flow activity gathers the IP address from configuration items (CIs) to use in the flow.

This workflow activity determines the IPV4 address associated with a configuration item (CI).

The Get Network Statistics capability retrieves a list of active network connections from a host or endpoint. It can be used for incident enrichment during investigations. This capability is triggered automatically when a configuration item is added to a security incident.

The Security Common Orchestration - Get Network Statistics via netstat flow action retrieves the network statistics for an affected resource on a Windows-based system. This flow action can accelerate the investigation and remediation process.

The Get Observable Sightings Queries workflow activity retrieves queries from the integration configuration.

TheGet Running Processes workflow activity retrieves the running processes of a configuration item on a Windows-based system. This activity can accelerate the investigation and remediation process.

The Get Running Processes capability retrieves a list of running processes on a configuration item (CI) from a host or endpoint. This capability is used for incident enrichment during investigations.

The Get Sensor ID workflow activity gathers running processes using PowerShell to use in the workflow.

The Get Sensor ID flow action gathers sensor identifiers to use in the flow.

Review the following information before you set up your MISP integration for Security Operations.

Review the following information before you start setting up your MITRE-ATT&CK framework.

The Get Supported Capabilities flow action retrieves the name and number of integrations that are active and support the requested capability.

The Risk and Compliance dashboard is a unified dashboard that provides a comprehensive analytical data of reports available from the major GRC applications for the chief information security officer to understand the compliance and risk posture of the organization. The dashboard consolidates data from various products within the ServiceNow GRC suite of applications.

The Risk and compliance dashboard gives the compliance and risk users a comprehensive overview of risk and compliance information in a single dashboard that aids in their key decisions.

Use a remediation task rule to group the findings that share a fix, so your team can remediate them together as a single unit of work.

You can import security tag rules from other tables in your deployment.

After you have excluded artifacts from a list in a case, you can return them to the case you can continue to work on them.

Sightings denote that an indicator or object was seen. Objects may be a malware, tool, threat actor, and so on.

Ingest MITRE D3FEND data (tactics, techniques, and artifacts) from the MITRE website to integrate with the Security Incident Response application.

Install and configure the MISP integration for Security Operations from the ServiceNow Store on your ServiceNow AI Platform instance so that you can start investigating security incidents using the MISP data.

Install and configure the ServiceNow AI Platform Integration with Cisco AI Defense application in your ServiceNow AI Platform instance to import scan results and model validation data from Cisco AI Defense.

You can activate the plugins for third-party integrations and configure them for use from the same screen.

Activate the Fix Intelligence for Security Exposure Management plugin (sn_vul_fix) to add the Fix tables, role, and integration to your USEM environment.

All ServiceNow integrations are available on the ServiceNow Store. Core applications, such as Security Incident Response, are visible in the ServiceNow Products tab on the store. Integration add-ons are visible in the Certified Apps tab.

Use this task to set up the Vulnerability Response integration with Palo Alto Prisma AIRS and import AI security scan results, posture findings, and model validation data into your ServiceNow AI Platform instance.

Install the SIR integration builder to integrate capabilities to Security Incident Response.

You can install the Unified Exposure Pipeline application (sn_vul_int_cmn) if you have the admin role.If the application does NOT include demo data or it does NOT install related applications and plugins, delete or revise the following sentence:The application includes demo data and installs related ServiceNow Store applications and plugins if they are not already installed.

Several types of components are installed with Security Support Common. They provide common functionality for use across the various security applications, such as Security Incident Response.

Components installed with the AI Security Exposure Management application.

Several types of components are installed when you activate the Security Support Common plugin including but not limited to tables, user roles, and modules.

Strengthen your organization's defense against prominent cybersecurity threats by incorporating phishing integrations with the Cybersecurity Executive Dashboard. The Phishing Integrations enhance the Cybersecurity Executive Dashboard by seamlessly incorporating data from third-party phishing simulation tools such as KnowBe4 and Microsoft Defender for Office 365.

Unified Security Exposure Management supports multiple third-party integrations to help with vulnerability management, orchestration and remediation. This section provides guidelines for managing integrations.

The Integration Capabilities framework provides a consistent architecture to support interoperability with third-party integrations. This abstracted interface and data model insulates integrations from changes to the core application and ensures a consistent experience for similar types of integrations.

IoC repository contains STIX objects, each of these objects contain a specific piece of information.

The Isolate Host capability restricts system connections to other devices. Isolate host is executed against a configuration item (CI).

Correlate and perform link analysis of observables, security incidents, and MITRE-ATT&CK related information so that your organization can start hunting for threats.

The updated Employee Service Center experience consolidates vulnerability approvals under one interface.This allows customers to efficiently manage security exceptions without navigating multiple systems or UIs.

Manage the CVE and technique information that is mapped after you import the MITRE TAXII collections.

Manage the groups that have been imported from the MITRE TAXII collections. Groups are sets of related intrusion activity that are tracked by a common name in the security community. Analysts track clusters of activities using various terms such as threat groups, activity groups, threat actors, intrusion sets, and campaigns. In STIX, groups are known as intrusion sets.

Manage the malware information that you imported from the MITRE TAXII collections. Malware is a type of TTP that represents malicious code. It refers to a program that is covertly inserted into a system. The intent of a malware is to compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS).

Manage the mitigations that have been imported from the MITRE TAXII collections. Mitigations enable you to prevent an adversary from successfully executing techniques or sub-techniques against your organization. In STIX, mitigations are known as course of actions.

Map detection tools to MITRE ATLAS techniques and tactics to identify monitoring capabilities for your organization.

View the tactics and techniques in an imported MITRE ATLAS matrix to understand available threat intelligence data. You can activate the matrix to make it available for use in threat analysis.

Define the data source and detection tool mapping for MITRE-ATT&CK tactics and techniques. This mapping provides the insight into the relevance and availability of the data sources and the detection tools for monitoring the data sources in your environment.

Manage the MITRE relationships information that you imported from the MITRE TAXII collections.

Manage the tools information that you imported from the MITRE TAXII collections. Tools are legitimate software that are used by threat actors to perform attacks.

The Map Processes Data flow action maps Carbon Black process data within the flow.

Map your overall technique detection coverage with the technique that enables your organization to detect specific adversary techniques.

Use the Data Component Mapping if you are using the latest TAXII collections, and you want to maintain a relationship between the data sources, data components, and the various techniques. Map the data sources with the additional context of data components that provides an extra sublayer of context to data sources that enable you to understand adversary behaviors in MITRE-ATT&CK better.

Map your mitigation coverage with the technique that enables you to detect your organization's overall mitigation strategy.

The marking definitions object represents a specific marking.

OPSWAT Metadefender allows threat data, detected by the third-party Metadefender scanner, to be downloaded to the Threat Intelligence application for tracking, prioritization, and resolution.

You can set up MISP integration in the ServiceNow AI Platform to perform a sighting search, observable enrichment, and to create and update events in MISP.

You can review the MISP event data so that you can see detailed information about the MISP events.

With MISP integration for Security Operations, you can investigate security incidents with sighting searches, observable enrichment, and create or update events in MISP. Using MISP, you can investigate targeted attacks faster, improve the detection ratio, and reduce the number of false positives in your environment.

You can use the MISP user information page to view all the associated users for the ServiceNow AI Platform MISP integration for Security Operations.

Review the user roles that are required in the MISP integration for Security Operations integration.

The overall technique mitigation coverage is determined based on the formula defined in the mitigation coverage calculator.

The MITRE Card displays MITRE ATLAS technique information that has been aggregated from threat lookups, observables, or SIEM integrations associated with a security incident.

You can set up, map data sources, map overall technique detection coverage, and maintain the MITRE-ATT&CK repository in the ServiceNow AI Platform.

Use the MITRE-ATT&CK framework across the Threat Intelligence and the SIR module to detect and analyze threats to your organization.