ServiceNow Event Collector

Use this integration to fetch audits, syslog transactions, cases, and outbound HTTP logs from ServiceNow as Cortex XSIAM events.

Analytics & SIEM · ServiceNow

Details

IDServiceNow Event Collector
ProviderServiceNow
CategoryAnalytics & SIEM
From Version8.4.0
Docker Imagedemisto/auth-utils:1.0.0.10133006
Supported ModulesAttack Surface Management Exposure Management Agentix Cortex Cloud Cloud Runtime Security Cloud Posture Security XSIAM EDR

README

Use this integration to fetch audit, case, syslog transactions, and outbound HTTP logs from ServiceNow as Cortex XSIAM events.
This integration was integrated and tested with Vancouver version of ServiceNow API.

Configure ServiceNow Event Collector in Cortex

Parameter Description Required
ServiceNow URL, in the format https://company.service-now.com/   True
Username   True
Password   True
Client ID   False
Client Secret   False
ServiceNow API Version (e.g., ‘v1’)   False
Use OAuth Login Select this checkbox to use OAuth 2.0 authentication. When enabled and Username and Password are configured, the integration will automatically perform the initial OAuth login and renew the refresh token when it expires. False
Event Types To Fetch Event types to fetch. Defaults to ‘Audit’ if no type is specified. False
Maximum audit events to fetch Maximum number of audit events per fetch. False
Maximum syslog transactions events to fetch Maximum number of syslog transactions events per fetch. False
Maximum case events to fetch Maximum number of case events per fetch. False
Maximum outbound HTTP log events to fetch Maximum number of outbound HTTP log events per fetch. False
Events Fetch Interval   False
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

service-now-get-audit-logs

Returns events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

Base Command

service-now-get-audit-logs

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. Required
limit Maximum audit events to fetch. Default is 1000. Optional
from_date The date and time of the earliest event. The time format is “{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}”. Example: “2021-05-18 13:45:14” indicates May 18, 2021, 1:45PM. Optional
offset Starting record index from which to begin retrieving records. Optional

Context Output

There is no context output for this command.

Human Readable

Audit Events

_time documentkey fieldname newvalue record_checkpoint sys_created_on sys_id tablename
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 audit
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 audit
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 audit
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 audit

service-now-get-syslog-transactions

Returns syslog transactions events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

Base Command

service-now-get-syslog-transactions

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. Required
max_fetch_syslog_transactions Maximum syslog transactions events to fetch. Default is 1000. Optional
from_date The date and time of the earliest event. The time format is “{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}”. Example: “2021-05-18 13:45:14” indicates May 18, 2021, 1:45PM. Optional
offset Starting record index from which to begin retrieving records. Optional

Context Output

There is no context output for this command.

Human Readable

Syslog Transactions Events

_time acl_time business_rule_count client_transaction cpu_time sys_created_on sys_id source_log_type
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table

service-now-get-case-logs

Returns case events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

Base Command

service-now-get-case-logs

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. Required
max_fetch_case Maximum case events to fetch. Default is 1000. Optional
from_date The date and time of the earliest event. The time format is “{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}”. Example: “2021-05-18 13:45:14” indicates May 18, 2021, 1:45PM. Optional
offset Starting record index from which to begin retrieving records. Optional

Context Output

There is no context output for this command.

Human Readable

Case Events

_time acl_time business_rule_count client_transaction cpu_time sys_created_on sys_id source_log_type
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table
2024-01-28T13:21:43Z 3 DELETED DELETED -1 2024-01-28 13:21:43 3 test_table

service-now-get-outbound-http-logs

Returns outbound HTTP log events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

Base Command

service-now-get-outbound-http-logs

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. Required
limit Maximum outbound HTTP log events to fetch. Default is 1000. Optional
from_date The date and time of the earliest event. The time format is “{yyyy}-{mm}-{dd} {hh}:{mm}:{ss}”. Example: “2021-05-18 13:45:14” indicates May 18, 2021, 1:45PM. Optional
offset Starting record index from which to begin retrieving records. Optional

Context Output

There is no context output for this command.

Human Readable

Outbound HTTP Log Events

_time _ENTRY_STATUS name request_url response_status_code sys_created_on sys_id sys_updated_on source_log_type
2024-01-28T13:21:43Z new HTTP Request https://api.example.com 200 2024-01-28 13:21:43 abc123 2024-01-28 13:21:43 outbound_http_log
2024-01-28T13:22:15Z modified HTTP Request https://api.example.com 200 2024-01-28 13:21:43 abc123 2024-01-28 13:22:15 outbound_http_log

service-now-oauth-login

Generate a refresh token using your existing credentials. Use this command if you encounter access_denied or other errors related to your access token when using OAuth 2.0.

Base Command

service-now-oauth-login

Configuration parameters

  • url — ServiceNow URL, in the format https://company.service-now.com/ (required)
  • credentials — Username (required)
  • client_credentials — Client ID
  • api_version — ServiceNow API Version (e.g., 'v1')
  • use_oauth — Use OAuth Login
  • event_types_to_fetch — Event Types To Fetch
  • max_fetch — Maximum audit events to fetch
  • max_fetch_syslog_transactions — Maximum syslog transactions events to fetch
  • max_fetch_case — Maximum case events to fetch
  • max_fetch_outbound_http — Maximum outbound HTTP log events to fetch
  • eventFetchInterval — Events Fetch Interval
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (5)

  • service-now-get-audit-logs

    Returns events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

  • service-now-get-case-logs

    Returns cases extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

  • service-now-get-outbound-http-logs

    Returns outbound HTTP log events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

  • service-now-get-syslog-transactions

    Returns syslog transactions events extracted from ServiceNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding the API request limitation.

  • service-now-oauth-login

    Generate a refresh token using your existing credentials. Use this command if you encounter access_denied or other errors related to your access token when using OAuth 2.0.

Source

ServiceNowEventCollector.py ServiceNowEventCollector_test.py ServiceNowEventCollector.yml ServiceNowEventCollector_description.md command_examples.txt
Download History Raw 
Use this integration to collect audit, case, and syslog transactions logs automatically from ServiceNow.

To use ServiceNow on Cortex XSIAM, ensure your user account has the rest_api_explorer and web_service_admin roles.
These roles are required to make API calls.
However, they may not suffice for viewing records in some tables.
Please make sure you have the correct role so you have permissions to work with the relevant table.
  
### Instance Configuration
The integration supports two types of authorization:
1. Basic authorization using username and password.
2. OAuth 2.0 authorization.

#### OAuth 2.0 Authorization
To use OAuth 2.0 authorization:
1. Log in to your ServiceNow instance and create an endpoint for Cortex XSIAM to access your instance. For more information, see [Snow OAuth](https://docs.servicenow.com/bundle/orlando-platform-administration/page/administer/security/task/t_CreateEndpointforExternalClients.html).
2. Click the lock next to the Client Secret to reveal it.
3. Copy the `Client Id` and `Client Secret` into the `ClientID` and `Client Secret` fields of the instance configuration. The `Client Id` and `Client Secret` were automatically generated when you created the endpoint.
4. Enter the ServiceNow account **Username** and **Password** in the integration instance configuration. The integration will automatically perform the initial OAuth login on first use and automatically renew the refresh token when it expires.
5. Select the Use **OAuth Login** checkbox and click **Done**.