category: Data Enrichment & Threat Intelligence
provider: ServiceNow
commonfields:
  id: FeedServiceNow
  version: -1
configuration:
- additionalinfo: The format should be https://company.service-now.com/
  display: Server URL 
  name: url
  required: true
  section: Connect
  type: 0
- additionalinfo: Select this checkbox if to use OAuth 2.0 authentication. See (?) for more information.
  display: Use OAuth Login
  name: use_oauth
  type: 8
  required: false
  section: Connect
- additionalinfo: Select this checkbox to use JWT authentication. See (?) for more information.
  display: Use JWT Authentication
  name: use_jwt
  type: 8
  required: false
  section: Connect
- display: Username / Client ID
  displaypassword: Password / Client Secret
  hiddenusername: true
  name: credentials
  required: true
  section: Connect
  type: 9
- advanced: true
  display: Trust any certificate (not secure)
  name: insecure
  required: false
  section: Connect
  type: 8
- advanced: true
  display: Use system proxy settings
  name: proxy
  required: false
  section: Connect
  type: 8
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  required: false
  section: Collect
  type: 8
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  required: false
  section: Collect
  type: 18
- additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: F - Reliability cannot be judged
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  section: Collect
  type: 15
- display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  required: false
  section: Collect
  type: 17
- display: ''
  name: feedExpirationInterval
  required: false
  section: Collect
  type: 1
- defaultvalue: "240"
  display: Feed Fetch Interval
  name: feedFetchInterval
  required: false
  section: Collect
  type: 19
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  required: false
  section: Collect
  type: 8
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  required: false
  section: Collect
  type: 0
- additionalinfo: The API route of the requested information in ServiceNow
  display: Query URL
  name: query_url
  required: true
  section: Collect
  type: 0
- additionalinfo: The field needed from the ServiceNow response which contains the indicator value
  display: Indicator Field
  name: indicator_field
  required: true
  section: Collect
  type: 0
description: This is a feed integration for extracting indicators from ServiceNow.
display: ServiceNow Generic Feed
name: FeedServiceNow
script:
  commands:
    - arguments:
      - defaultValue: 1
        description: The number of indicators that can be returned.
        name: limit
      description: Retrieve indicators from ServiceNow.
      name: snow-get-indicators
  dockerimage: demisto/auth-utils:1.0.0.8240011
  feed: true
  isFetchSamples: true
  runonce: false
  script: ''
  subtype: python3
  type: python
sectionorder:
- Connect
- Collect
tests:
- No test - no instance
fromversion: 5.5.0