PANW IoT Incident Handling with ServiceNow

This playbook creates a ServiceNow ticket after the incident is enriched by Palo Alto Networks IoT security portal (previously Zingbox Cloud).

IoT by Palo Alto Networks · 12 tasks · 2 inputs · 2 outputs

Inputs

  • IoTConfigListName — The list name defined in the XSOAR Lists for the RACI and ServiceNow calculation.
  • CreateServiceNowTicket — Determines if a ServiceNow ticket should be created based on the RACI calculation. Set to True to create an incident.

Outputs

  • PaloAltoNetworksIoT — This path will have field "device" for the device details and "raci" if the command "iot-security-get-raci" has output.
  • ServiceNow.Record — The ServiceNow record after creating the ServiceNow ticket.

Commands used

iot-security-get-device servicenow-create-record

Flowchart

yes yes yes yes Start Start Incident Enrichment Incident Enrichment Get Device Details from IoT Server - iot-security-get-device Get Device Details from I... iot-security-get-device Applying RACI model Applying RACI model Calculate RACI - iot-security-get-raci Calculate RACI iot-security-get-raci Done Done IOT_CONFIG list configured? IOT_CONFIG list configured? ServiceNow Table Exists? - Exists ServiceNow Table Exists? Exists servicenow-create-record - servicenow-create-record servicenow-create-record servicenow-create-record Manual investigation Manual investigation Is ServiceNow v2 enabled and create ServiceNow ticket? Is ServiceNow v2 enabled ... Is Palo Alto Networks IoT Enabled? Is Palo Alto Networks IoT...