FeedServiceNow

Details

ID	`FeedServiceNow`
Provider	ServiceNow
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/auth-utils:1.0.0.8240011`

README

This is a feed integration for extracting indicators from ServiceNow.

Configure ServiceNow Generic Feed in Cortex

Parameter	Description	Required
Server URL	The format should be https://company.service-now.com/	True
Use OAuth Login	Select this checkbox if to use OAuth 2.0 authentication. See (?) for more information.	False
Use JWT Authentication	Select this checkbox to use JWT authentication. See (?) for more information.	False
Username / Client ID		True
Password / Client Secret		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch indicators		True
Indicator Verdict	Indicators from this integration instance will be marked with this verdict	False
Source Reliability	Reliability of the source providing the intelligence data	True
Feed Expiration Policy		False
Feed Fetch Interval		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Tags	The tag applied to the indicator when being forwarded into the TIM.	False
Query URL	The API route of the requested information in ServiceNow	True
Indicator Field	The field needed from the ServiceNow response which contains the indicator value	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

snow-get-indicators

Retrieve indicators from ServiceNow.

Base Command

snow-get-indicators

Input

Argument Name	Description	Required
limit	The number of indicators that can be returned. Default is 1.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
use_oauth — Use OAuth Login
use_jwt — Use JWT Authentication
credentials — Username / Client ID (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
feedTags — Tags
query_url — Query URL (required)
indicator_field — Indicator Field (required)

Commands (1)

snow-get-indicators
Retrieve indicators from ServiceNow.

Source

FeedServiceNow.py FeedServiceNow_test.py FeedServiceNow.yml FeedServiceNow_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: ServiceNow
commonfields:
  id: FeedServiceNow
  version: -1
configuration:
- additionalinfo: The format should be https://company.service-now.com/
  display: Server URL 
  name: url
  required: true
  section: Connect
  type: 0
- additionalinfo: Select this checkbox if to use OAuth 2.0 authentication. See (?) for more information.
  display: Use OAuth Login
  name: use_oauth
  type: 8
  required: false
  section: Connect
- additionalinfo: Select this checkbox to use JWT authentication. See (?) for more information.
  display: Use JWT Authentication
  name: use_jwt
  type: 8
  required: false
  section: Connect
- display: Username / Client ID
  displaypassword: Password / Client Secret
  hiddenusername: true
  name: credentials
  required: true
  section: Connect
  type: 9
- advanced: true
  display: Trust any certificate (not secure)
  name: insecure
  required: false
  section: Connect
  type: 8
- advanced: true
  display: Use system proxy settings
  name: proxy
  required: false
  section: Connect
  type: 8
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  required: false
  section: Collect
  type: 8
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  required: false
  section: Collect
  type: 18
- additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: F - Reliability cannot be judged
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  section: Collect
  type: 15
- display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  required: false
  section: Collect
  type: 17
- display: ''
  name: feedExpirationInterval
  required: false
  section: Collect
  type: 1
- defaultvalue: "240"
  display: Feed Fetch Interval
  name: feedFetchInterval
  required: false
  section: Collect
  type: 19
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  required: false
  section: Collect
  type: 8
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  required: false
  section: Collect
  type: 0
- additionalinfo: The API route of the requested information in ServiceNow
  display: Query URL
  name: query_url
  required: true
  section: Collect
  type: 0
- additionalinfo: The field needed from the ServiceNow response which contains the indicator value
  display: Indicator Field
  name: indicator_field
  required: true
  section: Collect
  type: 0
description: This is a feed integration for extracting indicators from ServiceNow.
display: ServiceNow Generic Feed
name: FeedServiceNow
script:
  commands:
    - arguments:
      - defaultValue: 1
        description: The number of indicators that can be returned.
        name: limit
      description: Retrieve indicators from ServiceNow.
      name: snow-get-indicators
  dockerimage: demisto/auth-utils:1.0.0.8240011
  feed: true
  isFetchSamples: true
  runonce: false
  script: ''
  subtype: python3
  type: python
sectionorder:
- Connect
- Collect
tests:
- No test - no instance
fromversion: 5.5.0