ServiceNow Event Collector

Use this integration to fetch audits, syslog transactions, cases, and outbound HTTP logs from ServiceNow as Cortex XSIAM events.

Analytics & SIEM · ServiceNow

Details

IDServiceNow Event Collector
ProviderServiceNow
CategoryAnalytics & SIEM
From Version8.4.0
Docker Imagedemisto/auth-utils:1.0.0.10133006
Supported ModulesAttack Surface Management Exposure Management Agentix Cortex Cloud Cloud Runtime Security Cloud Posture Security XSIAM EDR

README

Use this integration to fetch audit, case, syslog transactions, and outbound HTTP logs from ServiceNow as Cortex XSIAM events.
This integration was integrated and tested with Vancouver version of ServiceNow API.

Configure ServiceNow Event Collector in Cortex

Parameter Description Required
ServiceNow URL, in the format https://company.service-now.com/   True
Username   True
Password   True
Client ID   False
Client Secret   False
ServiceNow API Version (e.g., ‘v1’)   False
Use OAuth Login Select this checkbox to use OAuth 2.0 authentication. When enabled and Username and Password are configured, the integration will automatically perform the initial OAuth login and renew the refresh token when it expires. False
Event Types To Fetch Event types to fetch. Defaults to ‘Audit’ if no type is specified. False
Maximum audit events to fetch Maximum number of audit events per fetch. False
Maximum syslog transactions events to fetch Maximum number of syslog transactions events per fetch. False
Maximum case events to fetch Maximum number of case events per fetch. False
Maximum outbound HTTP log events to fetch Maximum number of outbound HTTP log events per fetch. False
Events Fetch Interval   False
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

service-now-get-audit-logs

Returns events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

Base Command

service-now-get-audit-logs

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. Required
limit Maximum audit events to fetch. Default is 1000. Optional
from_date The date and time of the earliest event. The time format is “{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}”. Example: “2021-05-18 13:45:14” indicates May 18, 2021, 1:45PM. Optional
offset Starting record index from which to begin retrieving records. Optional

Context Output

There is no context output for this command.

Human Readable

Audit Events

_time documentkey fieldname newvalue record_checkpoint sys_created_on sys_id tablename
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 audit
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 audit
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 audit
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 audit

service-now-get-syslog-transactions

Returns syslog transactions events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

Base Command

service-now-get-syslog-transactions

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. Required
max_fetch_syslog_transactions Maximum syslog transactions events to fetch. Default is 1000. Optional
from_date The date and time of the earliest event. The time format is “{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}”. Example: “2021-05-18 13:45:14” indicates May 18, 2021, 1:45PM. Optional
offset Starting record index from which to begin retrieving records. Optional

Context Output

There is no context output for this command.

Human Readable

Syslog Transactions Events

_time acl_time business_rule_count client_transaction cpu_time sys_created_on sys_id source_log_type
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table

service-now-get-case-logs

Returns case events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

Base Command

service-now-get-case-logs

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. Required
max_fetch_case Maximum case events to fetch. Default is 1000. Optional
from_date The date and time of the earliest event. The time format is “{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}”. Example: “2021-05-18 13:45:14” indicates May 18, 2021, 1:45PM. Optional
offset Starting record index from which to begin retrieving records. Optional

Context Output

There is no context output for this command.

Human Readable

Case Events

_time acl_time business_rule_count client_transaction cpu_time sys_created_on sys_id source_log_type
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table

service-now-get-outbound-http-logs

Returns outbound HTTP log events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

Base Command

service-now-get-outbound-http-logs

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. Required
limit Maximum outbound HTTP log events to fetch. Default is 1000. Optional
from_date The date and time of the earliest event. The time format is “{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}”. Example: “2021-05-18 13:45:14” indicates May 18, 2021, 1:45PM. Optional
offset Starting record index from which to begin retrieving records. Optional

Context Output

There is no context output for this command.

Human Readable

Outbound HTTP Log Events

_time _ENTRY_STATUS name request_url response_status_code sys_created_on sys_id sys_updated_on source_log_type
2024-01-28T13:21:43Z new HTTP Request https://api.example.com 200 2024-01-28 13:21:43 abc123 2024-01-28 13:21:43 outbound_http_log
2024-01-28T13:22:15Z modified HTTP Request https://api.example.com 200 2024-01-28 13:21:43 abc123 2024-01-28 13:22:15 outbound_http_log

service-now-oauth-login

Generate a refresh token using your existing credentials. Use this command if you encounter access_denied or other errors related to your access token when using OAuth 2.0.

Base Command

service-now-oauth-login

Configuration parameters

  • url — ServiceNow URL, in the format https://company.service-now.com/ (required)
  • credentials — Username (required)
  • client_credentials — Client ID
  • api_version — ServiceNow API Version (e.g., 'v1')
  • use_oauth — Use OAuth Login
  • event_types_to_fetch — Event Types To Fetch
  • max_fetch — Maximum audit events to fetch
  • max_fetch_syslog_transactions — Maximum syslog transactions events to fetch
  • max_fetch_case — Maximum case events to fetch
  • max_fetch_outbound_http — Maximum outbound HTTP log events to fetch
  • eventFetchInterval — Events Fetch Interval
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (5)

  • service-now-get-audit-logs

    Returns events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

  • service-now-get-case-logs

    Returns cases extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

  • service-now-get-outbound-http-logs

    Returns outbound HTTP log events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

  • service-now-get-syslog-transactions

    Returns syslog transactions events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

  • service-now-oauth-login

    Generate a refresh token using your existing credentials. Use this command if you encounter access_denied or other errors related to your access token when using OAuth 2.0.

Source

ServiceNowEventCollector.py ServiceNowEventCollector_test.py ServiceNowEventCollector.yml ServiceNowEventCollector_description.md command_examples.txt
Download History Raw 
category: Analytics & SIEM
provider: ServiceNow
commonfields:
  id: ServiceNow Event Collector
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: ServiceNow URL, in the format https://company.service-now.com/
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  type: 9
  required: true
  section: Connect
- display: Client ID
  displaypassword: Client Secret
  name: client_credentials
  type: 9
  required: false
  section: Connect
- display: ServiceNow API Version (e.g., 'v1')
  name: api_version
  type: 0
  required: false
  section: Connect
- additionalinfo: Select this checkbox to use OAuth 2.0 authentication.
  display: Use OAuth Login
  name: use_oauth
  type: 8
  required: false
  section: Connect
- display: Event Types To Fetch
  section: Collect
  name: event_types_to_fetch
  type: 16
  required: false
  additionalinfo: Event types to fetch. Defaults to 'Audit' if no type is specified.
  defaultvalue: 'Audit'
  options:
  - Audit
  - Syslog Transactions
  - Case
  - Outbound HTTP Log
- additionalinfo: Maximum number of audit events per fetch.
  defaultvalue: '10000'
  display: Maximum audit events to fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: Maximum number of syslog transactions events per fetch.
  defaultvalue: '10000'
  display: Maximum syslog transactions events to fetch
  name: max_fetch_syslog_transactions
  type: 0
  required: false
  section: Collect
- additionalinfo: Maximum number of case events per fetch.
  defaultvalue: '10000'
  display: Maximum case events to fetch
  name: max_fetch_case
  type: 0
  required: false
  section: Collect
- display: Maximum outbound HTTP log events to fetch
  additionalinfo: Maximum number of outbound HTTP log events per fetch.
  defaultvalue: '10000'
  name: max_fetch_outbound_http
  type: 0
  required: false
  section: Collect
- defaultvalue: 1
  display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
description: Use this integration to fetch audits, syslog transactions, cases, and outbound HTTP logs from ServiceNow as Cortex XSIAM events.
display: ServiceNow Event Collector
name: ServiceNow Event Collector
script:
  commands:
  - name: service-now-get-audit-logs
    description: Returns events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.
    arguments:
    - auto: PREDEFINED
      defaultValue: "False"
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - "True"
      - "False"
      required: true
    - description: Maximum audit events to fetch. Default is 1000.
      name: limit
    - name: from_date
      description: 'The date and time of the earliest event. The time format is "{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}". Example: "2021-05-18 13:45:14" indicates May 18, 2021, 1:45PM.'
      required: false
      isArray: false
      defaultValue: ""
    - name: offset
      description: Starting record index from which to begin retrieving records.
      required: false
      isArray: false
      defaultValue: ""
  - name: service-now-get-syslog-transactions
    description: Returns syslog transactions events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.
    arguments:
    - auto: PREDEFINED
      defaultValue: "False"
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - "True"
      - "False"
      required: true
    - description: Maximum syslog transactions events to fetch. Default is 1000.
      name: limit
    - name: from_date
      description: 'The date and time of the earliest event. The time format is "{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}". Example: "2021-05-18 13:45:14" indicates May 18, 2021, 1:45PM.'
      required: false
      isArray: false
      defaultValue: ""
    - name: offset
      description: Starting record index from which to begin retrieving records.
      required: false
      isArray: false
      defaultValue: ""
  - name: service-now-get-case-logs
    description: Returns cases extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.
    arguments:
    - auto: PREDEFINED
      defaultValue: "False"
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - "True"
      - "False"
      required: true
    - description: Maximum case events to fetch. Default is 1000.
      name: limit
    - name: from_date
      description: 'The date and time of the earliest event. The time format is "{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}". Example: "2021-05-18 13:45:14" indicates May 18, 2021, 1:45PM.'
      required: false
      isArray: false
      defaultValue: ""
    - name: offset
      description: Starting record index from which to begin retrieving records.
      required: false
      isArray: false
      defaultValue: ""
  - name: service-now-get-outbound-http-logs
    description: Returns outbound HTTP log events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.
    arguments:
    - auto: PREDEFINED
      defaultValue: "False"
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - "True"
      - "False"
      required: true
    - description: Maximum outbound HTTP log events to fetch. Default is 1000.
      name: limit
    - name: from_date
      description: 'The date and time of the earliest event. The time format is "{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}". Example: "2021-05-18 13:45:14" indicates May 18, 2021, 1:45PM.'
      required: false
      isArray: false
      defaultValue: ""
    - name: offset
      description: Starting record index from which to begin retrieving records.
      required: false
      isArray: false
      defaultValue: ""
  - name: service-now-oauth-login
    description: Generate a refresh token using your existing credentials. Use this command if you encounter access_denied or other errors related to your access token when using OAuth 2.0.
    outputs: []
  dockerimage: demisto/auth-utils:1.0.0.10133006
  isfetchevents: true
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 8.4.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests
supportedModules:
- xsiam