FeedServiceNow

This is a feed integration for extracting indicators from ServiceNow.

Data Enrichment & Threat Intelligence · ServiceNow Generic Feed · Feed

Details

IDFeedServiceNow
ProviderServiceNow
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/auth-utils:1.0.0.8240011

README

This is a feed integration for extracting indicators from ServiceNow.

Configure ServiceNow Generic Feed in Cortex

Parameter Description Required
Server URL The format should be https://company.service-now.com/ True
Use OAuth Login Select this checkbox if to use OAuth 2.0 authentication. See (?) for more information. False
Use JWT Authentication Select this checkbox to use JWT authentication. See (?) for more information. False
Username / Client ID   True
Password / Client Secret   True
Trust any certificate (not secure)   False
Use system proxy settings   False
Fetch indicators   True
Indicator Verdict Indicators from this integration instance will be marked with this verdict False
Source Reliability Reliability of the source providing the intelligence data True
Feed Expiration Policy   False
Feed Fetch Interval   False
Bypass exclusion list When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. False
Tags The tag applied to the indicator when being forwarded into the TIM. False
Query URL The API route of the requested information in ServiceNow True
Indicator Field The field needed from the ServiceNow response which contains the indicator value True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

snow-get-indicators

Retrieve indicators from ServiceNow.

Base Command

snow-get-indicators

Input

Argument Name Description Required
limit The number of indicators that can be returned. Default is 1. Optional

Context Output

There is no context output for this command.

Configuration parameters

  • url — Server URL (required)
  • use_oauth — Use OAuth Login
  • use_jwt — Use JWT Authentication
  • credentials — Username / Client ID (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedBypassExclusionList — Bypass exclusion list
  • feedTags — Tags
  • query_url — Query URL (required)
  • indicator_field — Indicator Field (required)

Commands (1)

  • snow-get-indicators

    Retrieve indicators from ServiceNow.

Source

FeedServiceNow.py FeedServiceNow_test.py FeedServiceNow.yml FeedServiceNow_description.md command_examples.txt
Download History Raw 
import pytest
from FeedServiceNow import Client, list_records_from_url, create_indicator_object, add_indicators_to_tim

CREATE_INDICATOR_PACK = [
    (
        [
            {
                "manufacturer.name": "Extreme Networks, Inc.",
                "ip_address": "198.51.100.0",
            },
        ],
        ["production", "network"],
        "ip_address",
        [
            {
                "value": "198.51.100.0",
                "type": "IP",
                "fields": {"tags": ["production", "network"]},
                "rawJSON": {
                    "manufacturer.name": "Extreme Networks, Inc.",
                    "ip_address": "198.51.100.0",
                },
            }
        ],
    ),
    (
        [
            {
                "manufacturer.name": "some network 1",
                "ip_address": "192.0.2.1",
            },
            {
                "manufacturer.name": "some networks 2",
                "ip_address": "192.0.2.2",
            },
        ],
        ["test"],
        "ip_address",
        [
            {
                "value": "192.0.2.1",
                "type": "IP",
                "fields": {"tags": ["test"]},
                "rawJSON": {
                    "manufacturer.name": "some network 1",
                    "ip_address": "192.0.2.1",
                },
            },
            {
                "value": "192.0.2.2",
                "type": "IP",
                "fields": {"tags": ["test"]},
                "rawJSON": {
                    "manufacturer.name": "some networks 2",
                    "ip_address": "192.0.2.2",
                },
            },
        ],
    ),
    (
        [],
        ["empty"],
        "ip_address",
        [],
    ),
]


@pytest.mark.parametrize(
    "indicator_list, feedtags, indicator_field, expected_result",
    CREATE_INDICATOR_PACK,
)
def test_create_indicator_object(indicator_list, feedtags, indicator_field, expected_result):
    """
    Given:
        A list of ServiceNow records, feed tags, and indicator field name
    When:
        Calling create_indicator_object
    Then:
        Returns properly formatted indicator objects with correct structure
    """
    result = create_indicator_object(
        indicator_list=indicator_list,
        feedtags=feedtags,
        indicator_field=indicator_field,
    )

    assert result == expected_result


ADD_INDICATORS_TO_TIM = [
    (
        [
            {
                "value": "192.0.2.1",
                "type": "IP",
                "fields": {"tags": ["Tag 1", "Tag 2"]},
                "rawJSON": {"manufacturer.name": "some network 1", "ip_address": "192.0.2.1"},
            },
            {
                "value": "some ip 2",
                "type": "IP",
                "fields": {"tags": ["Tag 1", "Tag 2"]},
                "rawJSON": {"manufacturer.name": "some networks 2", "ip_address": "some ip 2"},
            },
        ],
        "success",
    ),
    (
        [],
        "Indicators do not exist",
    ),
]


@pytest.mark.parametrize(
    "indicators_objs, expected_result",
    ADD_INDICATORS_TO_TIM,
)
def test_add_indicators_to_TIM(indicators_objs, expected_result):
    """
    Given:
        A list of Indicator objects with correct structure for the demisto.createIndicators command
    When:
        Calling add_indicators_to_TIM
    Then:
        Returns the output of the add_indicators_to_TIM function.
    """

    result = add_indicators_to_tim(indicators=indicators_objs)

    assert result == expected_result


def test_records_list_command(requests_mock):
    """
    Given:
        A ServiceNow client and query parameters
    When:
        Calling records_list_command
    Then:
        The records are fetched via the client HTTP request
    """
    base_url = "https://company.service-now.com/"
    query_url = "api/now/cmdb_ci_ip_address"
    full_url = f"{base_url}{query_url}"

    mock_response = {
        "result": [
            {"ip_address": "some ip 1", "manufacturer.name": "some network 1"},
            {"ip_address": "some ip 2", "manufacturer.name": "some network 2"},
        ]
    }

    requests_mock.get(full_url, json=mock_response)

    client = Client(
        credentials={"identifier": "user", "password": "pass"},
        url=base_url,
        verify=False,
        proxy=False,
    )

    human_readable, response = list_records_from_url(client, query_url)

    assert response == mock_response