PANW Device Security ServiceNow Tickets Check

This playbook checks the ServiceNow ticket status for Palo Alto Networks Device Security (previously Zingbox) alerts or vulnerabilities and automatically closes the Cortex XSOAR incident when the related ServiceNow ticket is closed. Designed to run as a recurring job.

Device Security by Palo Alto Networks · 5 tasks · 0 inputs · 0 outputs

Details

ID	`PANW Device Security ServiceNow Tickets Check`
From Version	6.10.0
Tasks	5

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

ServiceNow v2

Scripts

device-security-check-servicenow

Commands

closeInvestigation

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

PANW Device Security ServiceNow Tickets Check

Commands used

closeInvestigation

Flowchart

Source

playbook-device-security-check-servicenow.yml

Download History Raw

id: PANW Device Security ServiceNow Tickets Check
version: -1
name: PANW Device Security ServiceNow Tickets Check
description: This playbook checks the ServiceNow ticket status for Palo Alto Networks Device Security (previously Zingbox) alerts or vulnerabilities and automatically closes the Cortex XSOAR incident when the related ServiceNow ticket is closed. Designed to run as a recurring job.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 34f2ced6-838a-4155-90a8-5de8d50e6a9a
    type: start
    task:
      id: 34f2ced6-838a-4155-90a8-5de8d50e6a9a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: Starts the ServiceNow ticket status check workflow.
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: f90d3864-1b6a-48fa-bb18-9de93949a3d8
    type: regular
    task:
      id: f90d3864-1b6a-48fa-bb18-9de93949a3d8
      version: -1
      name: device-security-check-servicenow
      description: Closes the Cortex XSOAR incident if the Device Security ServiceNow ticket was closed. This command should be run in a Job.
      scriptName: device-security-check-servicenow
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: e8a61758-148a-4584-bd5e-d10832a3e407
    type: regular
    task:
      id: e8a61758-148a-4584-bd5e-d10832a3e407
      version: -1
      name: Close incident
      description: Close the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      closeNotes:
        simple: Job finished
      closeReason:
        simple: ""
      id:
        simple: ${incident.id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 5ac1ec1d-b648-4f45-8828-6e918a9c5d03
    type: title
    task:
      id: 5ac1ec1d-b648-4f45-8828-6e918a9c5d03
      version: -1
      name: Done
      description: Indicates that the ServiceNow ticket status check workflow finished.
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 4187f350-078c-4395-a993-12db1d3b983a
    type: condition
    task:
      id: 4187f350-078c-4395-a993-12db1d3b983a
      version: -1
      name: Is ServiceNow v2 enabled?
      description: Checks whether the ServiceNow v2 integration instance is enabled before querying ServiceNow ticket status.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ServiceNow v2
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: state
            iscontext: true
          right:
            value:
              simple: active
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 492.5,
        "x": 50,
        "y": 50
      }
    }
  }
outputs: []
fromversion: 6.10.0
tests:
- No tests (auto formatted)