Security Incident Response

You can access the Security Incident Response Explorer dashboard to view security incident activity in order to instantly pinpoint areas of concern and quickly resolve issues.

You can drill down to the Action Designer to view detailed information about the actions being performed for a specific step in the automated phishing response playbook flow.

After the Block List has been created in your ServiceNow AI Platform and the URL is available, the Check Point administrator configures the Block List as Custom Intelligence Feed on all the Check Point Next Generation Gateways. Before it can accept Block List entries, the Block List must be configured in Check Point and activated in the ServiceNow AI Platform.

If you have not installed the application, follow the instructions to install it.

The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including Palo Alto Networks - Firewall. Before you can use the Palo Alto Networks - Firewall, you must download it from the ServiceNow Store.

HPE ArcSight Logger streams real-time data and categorizes them into specific logs and easily integrates with Security Operations. Before you can use the HPE ArcSight Logger - Incident Enrichment integration, you must download it from the ServiceNow Store and add API URL and login credentials.

The Carbon Black incident enrichment facilitates the investigation of a security incident by querying logs for potentially malicious indicators. Before you can use the Carbon Black - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate Endpoint Base URL and MID server.

Carbon Black is an advanced security system easily integrating with Security Operations. Before you can use the Carbon Black integration, you must download the integration from the ServiceNow Store and add the appropriate Endpoint Base and API Token.

The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including the CrowdStrike Falcon Host integration. Before you can use the CrowdStrike Falcon Host integration, you must download it from the ServiceNow Store and then add a user name and password.

Elasticsearch is a distributed, RESTful search and analytics engine that easily integrates with Security Operations. Before you can use the Elasticsearch - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate API Base URL and login credentials.

McAfee ESM protects endpoints against viruses, spyware, Trojan horses, and other malware threats and integrates easily with Security Operations. Before you can use the McAfee ESM - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate API Base URL and login credentials.

The Microsoft Exchange On-Premises integration provides tools for security analysts to contain and remediate phishing and spear phishing email threats in on-premises instances. Before you can use the Microsoft Exchange On-Premises integration, you must download it from the ServiceNow Store and identify the appropriate Exchange and MID servers.

IBM QRadar is an enterprise security information and event management (SIEM) product that integrates easily with Security Operations. Before you can use the IBM QRadar - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate API Base URL and API Key.

Splunk software searches, monitors, and analyzes machine-generated big data and integrates easily with Security Operations. Before you can use the Splunk - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate API Base URL and login credentials.

The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including the Security Operations Have I been pwned? integration. Before you can use the Have I been pwned? integration, you must download it from the ServiceNow Store.

If you are an existing user, then follow the procedure in this section to activate Microsoft Teams chat connector for MS Teams Graph Spoke user.

Before you can use the Security Operations Palo Alto Networks - WildFire integration, you must download the integration from the ServiceNow Store.

Configure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup.

Activate Slack by validating the Slack connection.

Use the File Explorer section from the Major Security Incident Management workspace to display the folders and files, the sequence those were created in Microsoft SharePoint document library.

After a security incident is created, you can add more details to aid in analysis, such as access roles and different kinds of notes.

Add or modify quick filters for security incidents or response tasks within the list view.

Configure the new entry point list to add it to the investigation page.

Add branding to your reports. You can add header and footer image, header and footer text. You can include this branding information in any of the report template types that you want to create other than the two predefined reports.

When a security incident is in the Review or Closed state, you can enter closure information.

Chat with an AI agent in the ServiceNow Otto panel to add a security incident details to a shift handover report.

Add security incidents to TISC case records.

Chat with an AI agent in the ServiceNow Otto panel to use the Generate SIR Shift Handover Report agentic workflow to help you add a security incident's detail to a shift handover report.

You can add participants to an active conference call if you have not added them before starting the conference call.

To save time, you can add multiple security incident observables to the security incident observables list.

Add participants to a conference call using the search option on the Start conference call pop-up to find and add the required participants. You can also add participants by selecting the participants from the Recommendations list, which provides participant recommendations to add to the conference call.

You can add related records, such as problems, changes, and incidents to existing security incidents.

In addition to the directly mapped fields from the pulled alarm values, and the alarm values you enter manually, you can use the script editor to format field values on the security incident during the mapping step which is optional.

If you determine that a security incident requires a higher level of analysis, add it to a new or existing case.

Add Access Control Lists (ACLs) for Major Security Incident Management workspace users.

Add system properties to control MSIM application behavior. Following are the default system properties that are introduced as part of the Major Security Incident Management status reports.

The Microsoft Defender for Endpoint integration supports running additional actions beyond the standard actions.

Following are the additional configuration settings after you complete the installation.

The Security Incident AI ROI Summary dashboard derives its values from Platform Analytics indicators and an estimation framework rather than from live queries. Knowing how each metric is calculated helps you interpret the time, monetary, and adoption figures that the dashboard reports.

The Security Incident AI ROI Summary dashboard displays time savings, monetary value, and adoption metrics for ServiceNow Otto capabilities. Use this dashboard to measure AI impact across your Security Incident Response team.

Within any alert, you can specify security events or security incidents to be created when the alert is fired.

Field descriptions for Allow and Block List properties outline how each field controls the behavior of observables when they are added to Allow or Block lists within the CrowdStrike Falcon Insight integration.

The Security Analyst can view the upcoming tasks related to the Security Incidents and Response Tasks that are due, overdue or breached the defined SLA.

Analyze and get insights into your security incident data using available prompts or natural language queries from the ServiceNow Otto panel.

An approval process for Block List entries is part of the preconfigured workflow. You approve Block List entries before the entries are activated on Block Lists. After you approve the Block List entry, the Gateway retrieves the entry, and your observable is blocked from that point forward.

Approve observables that are added to a URL Category List so that observable entries are in the appropriate allow or deny lists.

The HPE Security ArcSight ESM - Email Parser integration is supported using an email parser that consumes email notifications from ESM to create security incidents.

Copy an existing profile and its associated settings instead of creating new profiles. If you are creating multiple profiles, and you want to reuse the settings of an existing profile, you may prefer to copy profiles to save time.

After you identify the specific correlation event rule from the list, the next step is to map correlation event fields to the fields in the security incident form.

The ArcSight ESM integration has a bi-directional interface that allows for both correlation events to create security incidents, as well as an ability to update the correlation events once the security incident is created and/or closed with relevant incident details such as security incident number, assignment group, SIR incident URL, and so on.

Based on the ArcSight ESM source and the Query Viewer configured, select a correlation event rule for the profile.

In this step, you ingest sample correlation events and map values to the SIR security incident fields.

You can set up a profile to ingest correlation events.

After you complete the mapping step, preview the values that you mapped in a ServiceNow AI Platform Security Incident Response (SIR) security incident. This preview step permits you to verify that you have mapped all the correlation fields that you want displayed on the security incident.

You can define the polling or pull schedule for new correlated events. During this step, you can verify the existing settings for correlation event retrieval or modify the scheduling as needed. This step also permits you to retrieve historical correlation events using a date range.

In addition to the directly mapped fields from the ingested correlation event values, use the script editor to format field values on the security incident during the mapping step.

As a user with the sn_si.admin role, you create a profile in your ServiceNow AI Platform instance and determine which correlation events create security incidents. Before ServiceNow AI Platform Security Incident Response (SIR) security incidents are created from correlation events, the field values from events are displayed on a layout of a ServiceNow AI Platform security incident so that you can preview how the actual security incident will be created.

Before you run the integration on your ServiceNow AI Platform instance, complete these installation and configuration steps so the application properly integrates with the Security Incident Response and Security Operations products on your ServiceNow AI Platform instance.

Use this option to modify the ArcSight ESM default ingestion settings.

Create a query viewer and define filters that will include recently created correlation events that will be ingested ServiceNow.

The following section lists the setup tasks that you are required to complete in your ServiceNow AI Platform instance prior to installing the application from the ServiceNow Store.

This section provides information on how to troubleshoot any errors that may occur during event ingestion.

The ArcSight ESM event ingestion integration with the Security Incident Response product allows security incident analysts to collect correlated events and automate creation of security incidents with the ServiceNow platform. Data is ingested continually based on a configured polling schedule, and it is used by analysts to identify and respond to potential cyber security threats.

The HPE ArcSight Logger - Incident Enrichment integration searches your logs and adds relevant sighting information to your security incidents.

Using the Integration Hub and Flow Designer, several flows, subflows, and actions are available with the ArcSight ESM integration.

Chat with an AI agent from the ServiceNow Otto panel to help you gain insight into how efficiently your security analysts are working with security incidents resolution.

The following examples provide different scenarios on how mandatory and optional assessment trigger conditions are generated.

Assign Response tasks for a security issue.

You can target questions to specific pre-defined groups by assigning roles to Post Incident Review (PIR) categories.

Assign security incidents.

Enable the JWT Bearer Grant token authentication by attaching a valid Java Key Store (JKS) certificate.

You can manually attach observables when you want to perform threat lookups on observables that are not attached to a security incident on the initial event trigger. Also, you might perform this task when you want more information about a related observable.

You can manually attach observables to a security incident. You manually attach observables when you want to perform threat lookups on observables that are not attached to a security incident on the initial event trigger. Also, you might perform this task when you want more information about a related observable.

Automate detection updates and closures based on the Security Incident Response incident status. The CrowdStrike Next-Gen SIEM integration enables detections to create security incidents and also to update the incidents after they are created or closed.

Automate the incident updates and closures by the SIR incident status. The Microsoft Azure Sentinel integration has a bi-directional interface that enables both incidents to create security incidents and to update the incidents after the security incident is created or closed.

Automate the updates and closures of findings on AWS Security Hub according to the SIR incident status. The AWS Security Hub integration has a bi-directional interface that enables findings ingestion to create security incidents and to update the findings' status according to the changes in the SIR incident.

Advanced Work Assignment (AWA) intelligently routes and assigns security incidents to security analysts on the basis on their availability, capacity, and skills.

Domain separation is supported for AWS Security Hub application. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

AWS Security Hub is a cloud security posture management (CSPM) service that provides automated and continuous security checks and best practice checks against your AWS resources.

You can define and set filter conditions so that you can specify which incoming findings should create security incidents. You can also define additional incident field criteria that allows an incoming finding to be appended to an open security incident instead of creating an another security incident for the same finding.

Domain separation is supported for this application. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

There are restrictions for adding Block List entries to Block Lists. If duplicate, compatibility, or CIDR (Classless Inter-Domain Routing) conflicts exist when you try to add Block List entries to Block Lists, error messages are displayed that help you resolve these errors.

Field descriptions for CrowdStrike Block Request Category List form.

The ServiceNow AI Platform provides a few activity definitions within the base system. In addition, for the playbooks that SIR Workspace base system, there are a few activity definitions defined in the base system under Enterprise Security Case Management PAD Commons application.

Third-party monitoring tools, such as Splunk, can be integrated with Security Incident Response so that security events imported from those tools automatically generate security incidents. You can also import data from third-party tools into security alerts.

When the Security Incident Analytics plugin is activated, you can add the security incident - service impact and security incident - real-time treemaps to the Security Incident Response overview. After they have been added, you can configure the treemaps by modifying treemap categories and indicators.

When an event is created with more JSON-encoded data, that data is imported into any field with a name that matches the fieldName of that value in the JSON data.

You can associate and track the impact of any given issue using parent and child security incident relationships in Security Incident Response.

Based on the requirements of your business, a review of the origins and handling of security incidents is often needed.

You can perform lookups and vulnerability scans from security incidents and from the security incident catalog to identify potential threats and vulnerabilities.

As events are imported from alert monitoring tools, they are first processed by Event Management and grouped into alerts. These alerts can be used to create security incidents based on customizable alert rules, or manually reviewed to select those alerts to be investigated as a security incident.

Security Incident Response Orchestration activities allow users to interact with and retrieve data from Windows or UNIX-based systems and environments using workflow orchestration.

The security incident map provides data by geographical location. The world map is highlighted in every area in which an incident occurs. When the Security Incident Analytics plugin is activated, you can add the security incident map to the Security Incident Response overview. After it has been added, you can configure the map by modifying the map filters.

Security managers can use the high-level graphical interfaces such as maps, treemaps to pinpoint areas of concern.

The Security Incident Response Overview dashboard provides an executive view into security incident activity, providing trends and reports, and drill-downs into specific data.

You can calculate the severity of a security incident using predefined calculators.

The following table below describes the capabilities and applicable screens.

The Carbon Black integration enables you to investigate and respond to security incidents using APIs to query and interact with endpoints associated with security incidents.

Use the Carbon Black integration to investigate and respond to security incidents using APIs to query and interact with endpoints associated with security incidents.

Configure security incident categories and subcategories for granular classification of incidents, which helps you accurately route security incidents.

Configure Major Security Incident Management with Microsoft Teams which helps communication over the chat to resolve Major Security Incident.

Chat message activity is recorded and displayed on the Collaboration tab of the Major Security Incident Management workspace.

Activate Microsoft Teams by validating the Microsoft Teams Connection.

This document describes the steps required to integrate Check Point Next Generation Threat Prevention (NGTP) capabilities with ServiceNow Security Incident Response (SIR) so that applications function properly together.

Check Point Anti-bot - Email Parser integration is supported using an email parser that consumes email notifications from Check Point Anti-bot to create security incidents and drive enrichment and response workflows.

Before you can use the Check Point NGTP integration, you must create an API account, set up policies, and activate the integration.

This dashboard reveals the overall security posture of your organization, including security vulnerability and incidents.

You can invoke the security incident playbook flow automatically or manually.

The Automated Malware playbook provides a sequence of automated steps that helps you resolve malware alerts quickly and efficiently.

This section describes the actions provided in the Flow Designer action library.

Security Incident Response provides a rich set of playbook resources that include a comprehensive library of playbooks, subflows, and actions. You can create or configure playbooks quickly and easily without writing complicated code. You can use these playbooks to resolve security threats in a step-by-step manner.

When a user makes certain unsuccessful login attempts (according to the SIM configuration), a security incident is created.

Duplicate security incidents are categorized as child security incidents and are rolled up to the parent security incidents.

The Predictive Intelligence for User Reported Phishing feature provides a significant solution in triaging and prioritizing user reported phishing emails.

To use Predictive Intelligence for User Reported Phishing, you must install the following applications

Configure and prepare the model to identify user reported phishing emails.

Security Incident Response teams can now drive the finalized verdict for a user reported phishing record based on results from predictive intelligence and threat enrichment integrations.

This section covers a few common problem scenarios.

This feature assists security analysts in triaging and prioritizing user reported phishing emails.

Security operations center (SOC) managers can view overall efficiency metrics and measure the individual performance of the SOC team members in the organization.

Close multiple security incidents at the same time to avoid having to close related incidents individually, such as incidents created with a common root cause or false positive incidents.

Chat with an AI agent in the ServiceNow Otto panel to help you close a security incident.

You can collaborate with analysts and affected users to resolve or discuss about an incident in Security Incident Response application.

Track chat and file activities related to resolving major security incidents through the MSIM Workspace.

The example below demonstrates the common inputs capability action.

You can view the differences between Microsoft Azure Sentinel and Microsoft Graph Security API integrations and choose the right integration with your ServiceNow AI Platform instance.

The following are the required applications to work with Security Incident Response Workspace (sn_si_aw) plugin.

The Admin can configure conference call settings to display a predefined list of users and groups to add to a call.

Add natural language rule sets to the Security incident quality assessment skill. Security analysts use these rules to generate a quality assessment report for security incidents.

Add your existing runbooks to the resolution plan generation skill. The runbooks provide additional context to the resolution plan generation skill.

Establish a connection between Major Security Incident Management and Microsoft SharePoint to enable document collaboration and management of security incidents.

Configure Shift Handover settings to provide complete shift information to the next shift analysts.

The List Threat Events and Initiate Malware Scan capabilities can be triggered from Run Additional Actions.​

The CrowdStrike Falcon Insight integration supports running additional actions like regular expression (regex). The CrowdStrike Falcon Insight integration provides 40 additional actions with the base system.

Register the application with the instance to use OAuth authorization.

HPE Security ArcSight ESM - Email Parser integration uses email notifications from ESM to drive enrichment, and response workflows.

Configure each associated list from the view to handle run time data rendering.

Configure whether the preview modal appears when security analysts attach files to a security incident record.

Configure the refresh interval for security incident lists for automatic update of the security incident list ensuring an updated list for the security analysts.

Improve security incident routing for the security analysts by configuring the Advanced Work Assignment (AWA) for Security Incident Response Workspace.

Register your application in the AWS Security Hub portal and grant your users with read and write access to the application.

The firewall administrator must configure the Custom Intelligence Feed corresponding to the Block List created in NOW platform.

The Check Point Anti-bot - Email Parser integration uses email notifications to drive enrichment, and response workflows.

Install and configure Palo Alto Networks XSIAM integration for Security Operations application from the ServiceNow Store on your ServiceNow AI Platform instance.

Configure the default landing tab (Overview or Details) for security analysts when they select a security incident so they directly land on the page where they need to work on.

Configure whether the contextual menu panel for a security incident is expanded or collapsed by default.

Use this section to configure security incident design time investigation page to add multiple entry points and its associated records within the Security Incident Response Workspace.

McAfee ESM - Email Parser integration uses email notifications from ESM to drive enrichment, and response workflows.

Register your application in the Microsoft Azure portal and grant your users with read and write access to the application.

Register the Microsoft Defender for Endpoint application in the Microsoft Azure portal and grant the read and write access to the application.

Install and Configure Microsoft Defender integration from the ServiceNow Store to control how incidents are retrieved, processed, and converted into security incidents within SIR.

Create a profile and select the Microsoft Defender for Endpoint capabilities that you want the profile to run. You need to configure the settings so that the profile can be triggered only under the defined conditions.

Configure your profile settings so that the profile triggers only under the conditions that you set.

After you create a profile and select the FireEye HX capabilities that you want the profile to run, configure the settings so that the profile can be invoked only under the defined conditions.

Quick filters are easily accessible filters that are available on, security incidents and response tasks lists.

The Admin can define and configure different Shift Handover templates for the Shift Owner to create shift handover records and hand them over to the next shift team.

Create shifts through the Security Incident Response Workspace to use when configuring shift handover records.

Integrate and collaborate with Slack to resolve Major Security Incident to view and filter collaboration chat activities.

Use the Splunk Enterprise Event Ingestion settings to modify the preset configurations and their values as per your requirements.

Use the Splunk Enterprise Security (ES) settings to modify the preset configurations and their values as per your requirements.

Use the LogRhythm Integration Settings to modify the preset system and troubleshooting properties as per you requirements.

Set up Major Security Incident Management with Microsoft Teams connection.

Add a JSON Web Token (JWT) provider to your ServiceNow instance.

Create a JSON Web Token (JWT) signing key to assign to your Java Key Store certificate.

Create or modify timeline event configurations to control which events appear on the security incident timeline.

Configure and verify the timestamp settings before the installation procedure.

Configure access to the Zscaler Internet Access server to authenticate the secure connection between the ServiceNow AI Platform instance and the Zscaler server.

Use Linked Records Configuration to store the information of task tables that can be used to link/promote/propose to Major Security Incident.

Install and configure Major Security Incident Management application.

Plan and configure your Major Security Incident Management implementation.

The ServiceNow Otto for Security Incident Response (SIR) application is supported in the Security Incident Response Workspace and in the legacy Core UI (UI16). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR).

This section describes the configurations needed to work with the Security Incident Response Workspace.

Copy an existing profile and its associated settings instead of creating a new alarm profile. If you are creating multiple alarm profiles for different types of alarms and you want to reuse the settings of an existing profile, you can copy alarm profiles to save time. This process is optional.

Copy an existing profile and its associated settings instead of creating a profile. When you create multiple profiles, you can reuse the settings of an existing profile by copying these profiles.

Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks ingests Alerts and Incidents from Cortex XSIAM into ServiceNow's Security Incident Response platform, enabling seamless post-incident management while maintaining bi-directional status and work note synchronization.

Create response tasks to track separate actions to be performed to respond to the security issue.

Create a profile and select the CrowdStrike Falcon Insight capabilities that you want the profile to run.

Create a list type element, which defines the related list elements more declaratively with filter options such as assignment groups and labels.

Determine the CrowdStrike Next-Gen SIEM detections that are suitable for creating security incidents by creating a detection profile in your ServiceNow AI Platform instance.

Create an AWS Security Hub profile in your ServiceNow AI Platform instance which you are going to use to ingest data from AWS Security Hub and create a corresponding security incident in Security Incident Response Workspace.

Create an incident profile in your ServiceNow AI Platform instance and determine the Microsoft Azure Sentinel incidents that are suitable for creating security incidents.

In an alarm profile that you create and name, you specify which alarms you want to pull from the LogRhythm Client Console. You also define how they are mapped to fields on a ServiceNow AI Platform security incident.

Use sightings searches for CrowdStrike Falcon Insight to locate infected machines across your organization's network and to address security incident response cases.

Create and configure the sightings search profile automatically using the Microsoft Defender for Endpoint.

An API account role is required in your ServiceNow AI Platform instance for this integration. The Username and Password associated with this account are created in the ServiceNow AI Platform and entered in Check Point, so the Check Point authenticates with the ServiceNow AI Platform when retrieving Block List entries.

Create the CrowdStrike API client and generate the client ID and key, which you use to configure the CrowdStrike Falcon Insight integration.

Create an approval group for the McAfee ePO for Security Operations integration that can approve requests for isolating host machines, restoring them to the network.

Create an approval group for the CrowdStrike Falcon Insight for Security Operations integration that can approve requests for isolating host machines, restoring them to the network, and initiating sightings searches.

Register a new application at Azure portal for Microsoft SharePoint integration.

Create a Block List in your ServiceNow AI Platform instance. Once approved and activated, you can create entries for these Block Lists from observables determined to be malicious on Now Platform Security Incident Response (SIR) incidents and request approval to block them.

Create a profile and select the FireEye HX capabilities that you want the profile to run.

Create a profile and select the Microsoft Defender for Endpoint capabilities that you want the profile to run.

Create a security incident category to use to classify security incidents in Security Incident Response Workspace.

Configure Chat Teams and Channel Templates to create chat teams and channels to collaborate, track the chat conversations, and add users and user groups to those Chat Channels. These Channel templates are created in the Microsoft Teams when a major security incident is promoted.

Configure Chat Teams and Channel Templates to create chat teams and channels to collaborate, track the chat conversations, and add users and user groups to those Chat Channels. These Channel templates are created in Slack when a major security incident is promoted.

Configure the sightings search profile using the following procedure.

Security Incident Response ships with a default field mapping that maps a security incident to a Customer Service (CS) case. You can create a CS case from any security incident, edit the Priority, and also add Optional notes.

Create a free form element type to define the free form text more declaratively with filter options such as assignment groups and labels.

Create and manage threat indicators that synchronize directly with CrowdStrike Falcon Insight, enabling consistent, up‑to‑date threat intelligence across your security environment.

Create indicators from associated observables of the security incident using the Microsoft Defender for Endpoint.

Create a list type element, which defines the related list elements more declaratively with filter options such as assignment groups and labels.

To create a multiple record Splunk alert with custom fields, you must build a search that is designed to match the ServiceNow columns you want to populate.

In addition to manually adding users to a Post Incident Review (PIR) assessment list for a security incident, you can define assignment rules for automatically adding users or group to the list.

Use these steps to create processes for Automated Malware in the Process Automation Designer (PAD).

Use these steps to create processes for Automated Phishing in the Process Automation Designer (PAD).

Use these steps to create processes for Failed Login Manual in the Process Automation Designer (PAD).

Use these steps to create processes for Manual Malware in the Process Automation Designer (PAD).

Use these steps to create playbooks for Manual Phishing in Workflow Studio.

Create a project in Process Mining Workspace using the pre-build process models definitions from the content pack to scan through audit logs of security incident records and identify inefficiencies in your security incident life cycle.

Create quick filters to create reusable, predefined filters that appear on the security incidents and response tasks list pages enabling security analysts to filter the list items without adding the filter conditions each time.

Visualize and analyze security incidents and their associated data in a relationship graph.

Create a node relationship graph in Security Incident Response so you can better analyze a security incident by correlating it with malicious observables, configuration items (CIs), similar security incidents (SIRs), response tasks, and other related information.

A report can further be divided into various sections. Use the Report section to break down the report into multiple sections and reorganize them in order.

Analysts can create a report in Security Incident Response to include the status of an incident and share it via email.

Use subsection elements to further organize a subsection into multiple elements. Subsection elements help define visualizations, lists, free-form text more declaratively with filter options such as assignment groups and labels.

Use the report subsection to further organize the section into multiple subsections and configure their alignment and position using the available types such as Text side panel, Primary, and Secondary.

Create a new report template for analyst summary or an executive summary for an incident.

Create various report templates, which can be applied to the major security incidents and generate a status report. You can add standard and custom Major Security Incident Response form fields to the report template that are dot-walkable. In addition, you can format and configure the report based on your requirements using sections, subsections, and its elements.

Create rollup record configuration to link and unlink additional records to MSI.

You can create and view an observable within a security incident and take appropriate action. Having observables available in the security incident is scalable and reduces response time.

Create subcategories for a category for a deeper classification of a security incident in Security Incident Response Workspace.

Create a visualization element type to define the visualization elements more declaratively with filter options such as assignment groups and labels.

Add the URL categories that are available in the Zscaler Internet Access product to the ServiceNow AI Platform instance to specify an action for each URL so that you have easy access for granular filtering and policy creation.

Create a view for modal window for a Security Case.

Customize the List layout for a Security Case table when it is displayed on the Link Records page with the Major Security Incident Management workspace.

As a Major Security Incident (MSI) manager, you can create and distribute the different status reports to different stakeholders at various intervals based on the configured report template or a previous status report throughout the course of the major security incident resolution.

Create a Linked Record configuration for a Security Case.

Create required business rules for a Security Case.

Create UI actions for the source table for a Security Case.

The investigation screen leverages the related list views created on security incident to configure associated lists.

The CrowdStrike Falcon Host integration allows you to push observables in a security incident into a watchlist, making them able to generate additional alerts. This integration is an implementation of the CrowdStrike Falcon Host - Publish to Watchlist workflow.

With the CrowdStrike Falcon Insight for Security Operations integration, you can make remediation actions on the endpoints in real time, use profiles to gather details about the host, and make specific queries or actions on the endpoint using the ServiceNow AI Platform Security Incident Response product.

Activate and set up the CrowdStrike Falcon X Sandbox to interface with your ServiceNow instance and Security Incident Response product.

With the CrowdStrike Falcon X Sandbox for Security Operations integration, you can submit files and URLs as part of the security incident response process to CrowdStrike Falcon X Sandbox to perform a detailed malware and threat analysis.

The CrowdStrike Next-Gen SIEM integration automatically ingests detection data that may indicate potential security incidents and streamlines the creation of security incidents in the ServiceNow Security Incident Response (SIR), ensuring timely and effective response.

Block Request Category List classify observables in ServiceNow based on the block or allow action selected in the CrowdStrike platform. The Category List provides options to initiate a change request for list approval. This ensures that approvals are routed and processed seamlessly as part of the Block Request capability flow.

The Allow List Entries display records created through Block Requests with the Allow action. It lists allowed hash observables with a Success or Expired status and provides key details such as observable type, source, status, active state, date added, and complete activity history, including status and expiration updates from the CrowdStrike platform.

The Block List Entries display records created through Block Requests with the Block action. It lists blocked Hash observables with a Success or Expired status and provides key details such as observable type, source, status, active state, date added, and complete activity history, including status and expiration updates from the CrowdStrike platform.

Install and configure the CrowdStrike Next-Gen SIEM integration for Security Operations application from the ServiceNow Store on your ServiceNow AI Platform instance.

Customize some of the input fields of a generative AI skill to suit the requirements of your environment.

Copy and customize the SI to MSI promotion flows to control how File Explorer and chat channels are configured when a Security incident is promoted to a Major Security Incident.

You can create report templates that can be used to generate an incident summary or an executive summary for analysis and sharing.

In the base system, you can select on-demand orchestrations that execute predefined workflows. You can define new on-demand orchestrations to customize how workflows are invoked from the Run Orchestration choice lists.

Use the new Risk Score Calculator to define and calculate the risk score of security incidents based on the user-defined criteria, which provide a transparent intelligence scoring of security incidents. The risk score is auto-calculated for the security incident records.

You can configure the profile settings so that a profile runs only when a set of specific conditions is met or you can set up a profile to search for specific field values on a security incident.

You can delete a report in Security Incident Response which is in published or draft state.

The Determine Shell Script by OS workflow activity determines which operating system to use in the workflow

Disable the automated alarm closure capability if you no longer want to view the security incident closure information on the LogRhythm Web Console. Once deactivated, the ServiceNow AI Platform no longer closes alarms within the LogRhythm Web Console. This process is optional.

Domain separation is supported in Microsoft Defender for Endpoint integration. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.

Domain separation is supported in Security Incident Response. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.