> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-servicenow.md). # Onboard ServiceNow SaaS Security connects to ServiceNow using OAuth 2.0 authorization. Before onboarding, you register an OAuth 2.0 application in ServiceNow. During onboarding, SaaS Security redirects you to ServiceNow to log in and grant access. After connecting, SaaS Security scans your ServiceNow instance for misconfigured settings, third-party plugins, and account risks. You can also use the same OAuth 2.0 application to enable ServiceNow ticketing from SaaS Security. Onboarding for scans and linking for ticketing are separate procedures, but the OAuth 2.0 application can include redirect URLs for both. The onboarding process requires the following credentials: | Item | Description | | ------------- | -------------------------------------------------------------------------------------------- | | Client ID | Generated by ServiceNow to uniquely identify your OAuth 2.0 application. | | Client Secret | Generated by ServiceNow; used by SaaS Security to authenticate to the OAuth 2.0 application. | | Instance URL | The unique URL for your ServiceNow instance. | *** #### Step 1 — Get the redirect URL from Cortex Before registering your OAuth 2.0 application in ServiceNow, retrieve the redirect URL that SaaS Security requires. 1. Log in to [Cortex](https://cortex.paloaltonetworks.com). 2. Select **Settings > Data Sources and Integrations > Add New** and click the ServiceNow tile. 3. On the **Capabilities** tab, enter a name for this instance. 4. Under Default Capabilities, confirm Security Posture is selected. 5. Click Next. 6. On the **Connections** tab, select OAuth 2.0. SaaS Security displays the Redirect URL value on the configuration page. 7. Copy the redirect URL and save it to a text file. **Note**: Do not complete the onboarding flow yet. You will return to this page after configuring ServiceNow. *** #### Step 2 — Create an authentication scope in ServiceNow By default, an OAuth token grants full access to all REST APIs the ServiceNow account can access. Create an authentication scope to limit SaaS Security access to the Table API only. 1. Log in to ServiceNow as an administrator. 2. Verify that the REST API Auth Scope plugin (com.glide.rest.auth.scope) is activated. Navigate to System Definition > Plugins and search for the plugin. If it is not installed, follow the [ServiceNow documentation to activate it](https://www.servicenow.com/docs/bundle/xanadu-platform-security/page/administer/security/task/activate-rest-api-auth-scope.html). 3. Create the authentication scope: 4. Navigate to the Authentication Scopes table (sys\_auth\_scope.list) using the filter navigator. 5. Click New. 6. Enter a Name for the scope — for example, SaaS-Security-Connector. Optionally add a Description. **Note**: Record this name. You will need it when configuring the REST API Auth Scope and the OAuth 2.0 application. 7. Click Submit. 8. Create a REST API Auth Scope and link it to your authentication scope: 9. Navigate to System Web Services > API Auth Scopes > REST API Auth Scope. 10. Click New. 11. Enter a Name for the REST API Auth Scope. 12. From the REST API list, select Table API. 13. Configure the access level: 1. Read-only access (configuration scans, account scans, third-party plugin scans; no automated remediation): Deselect Apply auth scope to all http methods in this API, then set HTTP Method to GET. 2. Read and write access (scans plus automated remediation): Select Apply auth scope to all http methods in this API. 14. In the Auth Scope field, enter the name of the authentication scope you created. 15. Click Submit. *** #### Step 3 — Create an OAuth 2.0 application in ServiceNow 1. Log in to ServiceNow as an administrator. 2. Navigate to System OAuth > Application Registry. 3. Click New and select Create an OAuth API endpoint for external clients. 4. Fill in the application details: * Redirect URL — Enter the redirect URL you copied from Cortex. If you also want to enable ticketing, add the ticketing redirect URL separated by a comma. * Auth Scopes — Add the authentication scope you created in Step 2. * If the form includes an Enforce Token Restrictions checkbox, make sure it is not selected. 5. Click Submit. ServiceNow registers the application and displays it in the Application Registries list. 6. Open your OAuth 2.0 application and copy the Client ID and Client Secret to a text file. **Note**: Do not proceed until you have copied both values. You must provide them during onboarding. *** #### Step 4 — Verify ServiceNow table access SaaS Security must be able to access the following ServiceNow tables via the REST Table API: sys\_plugins, sys\_properties, sys\_scope, sys\_user, sys\_user\_has\_role, sys\_user\_role, oauth\_entity, oauth\_credential, v\_plugin, sys\_db\_object, pwd\_reset\_request For each table: 1. Navigate to System Definition > Tables. 2. Locate the table record and click its name to open it. 3. Select the Application Access tab. 4. Verify that Allow access to this table via web services is selected. If not, select it and click Update. *** #### Step 5 — Connect SaaS Security to ServiceNow 1. Return to the Cortex onboarding flow you started in Step 1 (or navigate to Settings > Data Sources and Integrations > Add New > ServiceNow tile). 2. On the Connections tab, select OAuth 2.0. 3. Enter your Instance URL, Client ID, and Client Secret. 4. Select the permission level: * Read Permissions — if you configured the authentication scope for GET only. * Read and Write Permissions — if you configured the authentication scope for all HTTP methods. 5. Click Connect. SaaS Security redirects you to the ServiceNow login page. 6. Log in using a ServiceNow administrator account assigned to the admin role. **Note**: The account must not be assigned to the snc\_read\_only role — this restricts the account to read-only access and will cause onboarding to fail. After onboarding is complete, you can restrict the account to read-only access. Full access is required only during onboarding and reauthentication. 7. Review the consent form and click Allow to grant access. 8. On the Configurations tab: * Set the Sync Interval. * (Optional) Add a Tag. 9. Click Next to complete onboarding. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-servicenow.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.