FeedServiceNow

Details

ID	`FeedServiceNow`
Provider	ServiceNow
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/auth-utils:1.0.0.8240011`

README

This is a feed integration for extracting indicators from ServiceNow.

Configure ServiceNow Generic Feed in Cortex

Parameter	Description	Required
Server URL	The format should be https://company.service-now.com/	True
Use OAuth Login	Select this checkbox if to use OAuth 2.0 authentication. See (?) for more information.	False
Use JWT Authentication	Select this checkbox to use JWT authentication. See (?) for more information.	False
Username / Client ID		True
Password / Client Secret		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch indicators		True
Indicator Verdict	Indicators from this integration instance will be marked with this verdict	False
Source Reliability	Reliability of the source providing the intelligence data	True
Feed Expiration Policy		False
Feed Fetch Interval		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Tags	The tag applied to the indicator when being forwarded into the TIM.	False
Query URL	The API route of the requested information in ServiceNow	True
Indicator Field	The field needed from the ServiceNow response which contains the indicator value	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

snow-get-indicators

Retrieve indicators from ServiceNow.

Base Command

snow-get-indicators

Input

Argument Name	Description	Required
limit	The number of indicators that can be returned. Default is 1.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
use_oauth — Use OAuth Login
use_jwt — Use JWT Authentication
credentials — Username / Client ID (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
feedTags — Tags
query_url — Query URL (required)
indicator_field — Indicator Field (required)

Commands (1)

snow-get-indicators
Retrieve indicators from ServiceNow.

Source

FeedServiceNow.py FeedServiceNow_test.py FeedServiceNow.yml FeedServiceNow_description.md command_examples.txt

Download History Raw

!snow-get-indicators limit=2