ServiceNow Generic Feed (v1.0.1)
This pack contains an integration that can be used to pull indicators from ServiceNow CMDB and put them inside the TIM with the option to provide tagging.
- Author
- Anshumaan Mishra
- Support
- community
- URL
- https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/bd-p/Cortex_XSOAR_Discussions
- Categories
- Data Enrichment & Threat Intelligence
Integrations (1)
- ServiceNow Generic Feed
README
What does this pack do?
- Enables users to fetch Indicators from ServiceNow platform into Cortex XSIAM TIM.
- Tag indicators that are added into the TIM.
- Query ServiceNow data with the ServiceNow query URL.
<~XSIAM>
Supported Indicator Types
”"”Type of Indicator (Reputations), used in TIP integrations”””
- Account = “Account”
- CVE = “CVE”
- Domain = “Domain”
- DomainGlob = “DomainGlob”
- Email = “Email”
- File = “File”
- FQDN = “Domain”
- MD5 = “File MD5”
- SHA1 = “File SHA-1”
- SHA256 = “File SHA-256”
- Host = “Host”
- IP = “IP”
- CIDR = “CIDR”
- IPv6 = “IPv6”
- IPv6CIDR = “IPv6CIDR”
- Registry = “Registry Key”
- SSDeep = “ssdeep”
- URL = “URL”
Configure ServiceNow Generic Feed Indicator on XSIAM Tenant
- Go to Settings > Configurations > Automation & Feed Integrations.
- Search for ServiceNow Generic Feed
- Click Add instance.
- Insert the ServiceNow URL.
- Insert your credentials (user name and password).
- Scroll down to the Collect section.
- Mark Fetch Indicators and select the desired indicator type to fetch
</~XSIAM>