Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

ServiceNOW

9/2022

Overview

The Oort security platform can integrate with ServiceNOW to open tickets in response to failed Checks for various security configuration and identity threat events.

This document will walk you through the process of setting up access to ServiceNOW and will also walk you through the setup inside of the Oort console.

ServiceNOW Configuration

To add the necessary configuration in ServiceNOW, you need to have admin access to the following:

From the ServiceNOW admin console, select User Administration.

Create a new account for the Oort integration. Set the password according to your organization’s service account password policy and store it securely.

Check the Web service access only option.

Give it the incident_manager role.

Click Save.

Oort Configuration

Within the Oort console, navigate to -

Integrations -> New Integration -> ServiceNOW

Enter the following information:

2022 09 18 16 08 55

Enter a name and description. Enter your ServiceNOW instance URL. It may be a custom URL if you have that configured. Enter the username and password of the account that you created.

Click Save.

To test the integration, navigate to a user that is failing a particular check, such as Inactive Users. Go to the Checks tab for that user.

Click the three dot option menu for a failing check and select Open Ticket. The ticket will appear in the lower section.

After testing successfully, click the Collect Now button to begin initial data collection immediately.

Data Payload Details

The following table shows an overview of JSON styled payload that will be sent from Oort out to ServiceNow

Field
Description

login

end user login

displayName

User's Display Name

status

Status, such as Active or Inactive

userTypeClassification

Valid values: INTERNAL, EXTERNAL, MISSING, UNCLASSIFIED, INCONSISTENT, SERVICE_ACCOUNT

ipAddresses

Up to 5 IP addresses recently used by the user

lastSignInLocation

Last geolocation the user signed in from

managerLogin

Manager LoginID

phoneNumber

Phone Number

unusedApplications

Up to 2 applications the user is assigned to but not using

usedApplications

Up to 5 applications used by the user

usedFactors

Up to 5 factors used by the user

Example Ticket Description with End User Digest

PreviousSendGridNextShared Signals Framework (SSF) and SSF Receivers

Last updated