ServiceNow

Use ServiceNow data in Cortex XSIAM.

Secure configurations, monitor identity risks, and manage agent security across your ServiceNow environment.

This connector includes the following capabilities and sub-capabilities (if applicable):

• Agent Security Scanning: This capability is available with any active Cortex Cloud Posture Security license.

  • agent-activity-scan: Agent Activity Monitoring. This sub-capability is available with any active Cortex Cloud Posture Security license.

• Identity Posture: Maintain visibility and control over ServiceNow identities, including users, groups and roles. This capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.

  • Groups: Ingest groups from ServiceNow. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.

  • Roles: Ingest roles from ServiceNow. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.

  • Users: Ingest users from ServiceNow. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.

• Security Posture: Detect, monitor and alert on settings of your SAAS application. This capability is available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

  • saas-posture-config-remediation: Help remediate the misconfigured security settings of your SAAS application. This sub-capability is available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

Agent Security

How to configure the ServiceNow connector

To access ServiceNow, Cortex XSIAM requires the following information, which you will specify during the connection process.

• Instance URL

• Client ID and Client Secret

Ensure you have the necessary administrative privileges in your ServiceNow instance, including the ability to elevate your role to security_admin to create and manage Access Control Lists (ACLs).

Task 1: Create an Application Registry

1. Create a Service User

   1. Sign in to your ServiceNow instance.

   2. In the search box, start typing and select User Administration > Users > New and enter the following details:

      1. User ID

      2. First name and Last name

      3. Email

   3. Select the Web service access only check box. This is critical as it ensures the user cannot be used for interactive sign-in.

   4. Select the Active check box and Submit the new user record.

   5. Select a role for the new user:

      • The role must have read and write permission to the sys_gen_ai_skill_applicability table.

      • For all other tables, only read permission is required.

      • If necessary, you can create a custom role in ServiceNow with these specific permissions. The read permission will enable Cortex XSIAM to scan the ServiceNow AI Platform for agent risks. The write permission to the applicability table will enable you to remediate risky plugins and take agents offline.

2. Create the Authentication Scope

   1. Before creating the OAuth 2.0 integration, create a scope that limits Cortex XSIAM's access to only the Table API.

   2. Navigate to the Authentication Scopes table (sys_auth_scope.list) by using the filter navigator.

   3. Click New to define the authentication scope.

   4. Specify a meaningful Name for your authentication scope, such as SaaS_Agent_Security_Scope or SSPM Agentic Scope.

   5. (Optional) Specify a Description.

   6. Click Submit.

Keep the authentication scope name handy, as it is required when configuring the REST API Auth Scope and OAuth 2.0 integration.

1. Create the Application Registry (OAuth Client) Standard Release Instructions:

   1. Log in to ServiceNow as an administrator.

   2. Navigate to the Application Registries page (System OAuth > Application Registry).

   3. Select New > Create an OAuth API endpoint for external clients.

   4. Copy the auto-generated Client ID and Client Secret and keep them handy.

   5. Ensure the following additional details are filled in correctly:

      1. Set the Application to Global.

      2. Ensure it's accessible from all application scopes.

      3. Ensure the Active check box is selected.

   6. OAuth Application User: Enter the user you created in Step 1.

   7. Default grant type: Choose Client Credentials. (Ensure that the system property glide.oauth.inbound.client.credential.grant_type.enabled is set to true).

   8. Specify your OAuth Scope that you created in Step 2.

   9. Click Submit.

Task 2: Connect ServiceNow to Cortex XSIAM

1. In Cortex XSIAM, navigate to Settings → Data Sources & Integrations.

2. Click + Add new.

3. In the Add Data Sources or Integrations page, search for ServiceNow.

4. Under Recommended, hover over the new ServiceNow and click Add Instance to launch the configuration wizard.

5. Under the Capabilities tab, Enter a Name for your application.

6. Select Security Posture under Default Capabilities.

7. Click Next.

8. Under Connection, enter the Instance ServiceNow URL, Client ID and Client Secret.

9. Under Configuration tab, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

10. A confirmation message indicates that ServiceNow is successfully connected. Confirm the Summary details and click Save instance.

Security Posture

How to configure the ServiceNow connector

Cortex XSIAM connects to ServiceNow using OAuth 2.0 authorization. Before connecting, you register an OAuth 2.0 application in ServiceNow. Cortex XSIAM then redirects you to ServiceNow to log in and grant access.

To access ServiceNow, Cortex XSIAM requires the following information, which you will specify during the connection process:

• Instance URL: The unique URL for your ServiceNow instance.

• Client ID: Generated by ServiceNow to uniquely identify your OAuth 2.0 application.

• Client Secret: Generated by ServiceNow; used by Cortex XSIAM to authenticate to the OAuth 2.0 application.

Task 1: Create an authentication scope in ServiceNow

By default, an OAuth token grants full access to all REST APIs the ServiceNow account can access. Create an authentication scope to limit Cortex XSIAM access to the Table API only.

1. Log in to ServiceNow as an administrator.

2. Verify that the REST API Auth Scope plugin (com.glide.rest.auth.scope) is activated. Navigate to System Definition > Plugins and search for the plugin. If it is not installed, follow the ServiceNow documentation to activate it.

3. Create the authentication scope:

4. Navigate to the Authentication Scopes table (sys_auth_scope.list) using the filter navigator.

5. Click New.

6. Enter a Name for the scope — for example, SaaS-Security-Connector. Optionally add a Description. Record this name. You will need it when configuring the REST API Auth Scope and the OAuth 2.0 application.

7. Click Submit.

8. Create a REST API Auth Scope and link it to your authentication scope:

   1. Navigate to System Web Services > API Auth Scopes > REST API Auth Scope.

   2. Click New.

   3. Enter a Name for the REST API Auth Scope.

   4. From the REST API list, select Table API.

   5. Configure the access level:

      • Read-only access (configuration scans, account scans, third-party plugin scans; no automated remediation): Deselect Apply auth scope to all http methods in this API, then set HTTP Method to GET.

      • Read and write access (scans plus automated remediation): Select Apply auth scope to all http methods in this API.

      • In the Auth Scope field, enter the name of the authentication scope you created.

   6. Click Submit.

Task 2: Create an OAuth 2.0 application in ServiceNow

1. Log in to ServiceNow as an administrator.

2. Navigate to System OAuth > Application Registry.

3. Click New and select Create an OAuth API endpoint for external clients.

4. Fill in the application details:

   • Redirect URL — Enter the redirect URL you copied from Cortex. If you also want to enable ticketing, add the ticketing redirect URL separated by a comma.

   • Auth Scopes — Add the authentication scope you created in Step 1.

   • If the form includes an Enforce Token Restrictions checkbox, make sure it is not selected.

   • Click Submit.

5. ServiceNow registers the application and displays it in the Application Registries list.

6. Open your OAuth 2.0 application and copy the Client ID and Client Secret to a text file. Do not proceed until you have copied both values. You must provide them during onboarding.

Task 3: Verify ServiceNow table access

Cortex XSIAM must be able to access the following ServiceNow tables via the REST Table API:

sys_plugins, sys_properties, sys_scope, sys_user, sys_user_has_role, sys_user_role, oauth_entity, oauth_credential, v_plugin, sys_db_object, pwd_reset_request

For each table:

1. Navigate to System Definition > Tables.

2. Locate the table record and click its name to open it.

3. Select the Application Access tab.

4. Verify that Allow access to this table via web services is selected. If not, select it and click Update.

Task 4: Connect ServiceNow to Cortex XSIAM

1. In Cortex XSIAM, navigate to Settings → Data Sources & Integrations.

2. Click + Add new.

3. In the Add Data Sources or Integrations page, search for ServiceNow.

4. Under Recommended, hover over the new ServiceNow and click Add Instance to launch the configuration wizard.

5. Under the Capabilities tab, Enter a Name for your application.

6. Select Security Posture under Default Capabilities.

7. Click Next.

8. Under Connection, enter the Instance ServiceNow URL, Client ID and Client Secret.

9. Under Configuration tab, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

10. A confirmation message indicates that ServiceNow is successfully connected. Confirm the Summary details and click Save instance.