FeedServiceNow

This is a feed integration for extracting indicators from ServiceNow.

Data Enrichment & Threat Intelligence · ServiceNow Generic Feed · Feed

Details

IDFeedServiceNow
ProviderServiceNow
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/auth-utils:1.0.0.8240011

README

This is a feed integration for extracting indicators from ServiceNow.

Configure ServiceNow Generic Feed in Cortex

Parameter Description Required
Server URL The format should be https://company.service-now.com/ True
Use OAuth Login Select this checkbox if to use OAuth 2.0 authentication. See (?) for more information. False
Use JWT Authentication Select this checkbox to use JWT authentication. See (?) for more information. False
Username / Client ID   True
Password / Client Secret   True
Trust any certificate (not secure)   False
Use system proxy settings   False
Fetch indicators   True
Indicator Verdict Indicators from this integration instance will be marked with this verdict False
Source Reliability Reliability of the source providing the intelligence data True
Feed Expiration Policy   False
Feed Fetch Interval   False
Bypass exclusion list When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. False
Tags The tag applied to the indicator when being forwarded into the TIM. False
Query URL The API route of the requested information in ServiceNow True
Indicator Field The field needed from the ServiceNow response which contains the indicator value True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

snow-get-indicators

Retrieve indicators from ServiceNow.

Base Command

snow-get-indicators

Input

Argument Name Description Required
limit The number of indicators that can be returned. Default is 1. Optional

Context Output

There is no context output for this command.

Configuration parameters

  • url — Server URL (required)
  • use_oauth — Use OAuth Login
  • use_jwt — Use JWT Authentication
  • credentials — Username / Client ID (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedBypassExclusionList — Bypass exclusion list
  • feedTags — Tags
  • query_url — Query URL (required)
  • indicator_field — Indicator Field (required)

Commands (1)

  • snow-get-indicators

    Retrieve indicators from ServiceNow.

Source

FeedServiceNow.py FeedServiceNow_test.py FeedServiceNow.yml FeedServiceNow_description.md command_examples.txt
Download History Raw 

 ServiceNowGenericFeed fetches records from a ServiceNow CMDB API endpoint and ingests them as indicators into Cortex XSOAR TIM with user desired tags.
***
## ServiceNowGenericFeed
- This integration can be used to pull indicators from ServiceNow with a given user query and add them to the Threat Intelligence Module.