device-security-check-servicenow

Closes the Cortex XSOAR incident if the Device Security ServiceNow ticket was closed. This command should be run in a Job.

python · Device Security by Palo Alto Networks

Details

IDdevice-security-check-servicenow
Languagepython
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10404775
Tagsdevice security

README

Closes the Cortex XSOAR incident if the Device Security ServiceNow ticket was closed. This command should be run in a Job.

Script Data

Name Description
Script Type python3
Tags device security
Cortex XSOAR Version 6.10.0

Dependencies

This script uses the following commands and scripts.

  • ServiceNow
  • ServiceNow v2
  • servicenow-get-record

Used In

This script is used in the following playbooks and scripts.

  • PANW Device Security ServiceNow Tickets Check

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

device_security_check_servicenow.py device_security_check_servicenow_test.py device_security_check_servicenow.yml device_security_check_servicenow_description.md
Download History Raw 
## device-security-check-servicenow Script

This script is run by 'device-security-check-service-playbook', which is triggered by a recurring Cortex XSOAR job.

It goes through all open Cortex XSOAR incidents based on two incident types:
"Device Security Alert" and "Device Security Vulnerability". It searches for incidents where the custom fields "Device Security ServiceNow Table Name" and "Device Security ServiceNow Record ID" are populated, which indicates that a corresponding ServiceNow ticket was created.

It then loops through each one of these incidents, and queries ServiceNow for the ticket
status. If the status is "Closed" in ServiceNow, the script closes the Cortex XSOAR incident.