ServiceNow CIS-SecOps cheat sheet

Security Operations is a ServiceNow suite of Security Incident Response, Threat Intelligence, Vulnerability Response, and the SecOps analyst workspace, enabled by plugins such as com.snc.security_incident and com.snc.vulnerability.

Security Incident [sn_si_incident] extends Task, inheriting number, state, assignment_group, assigned_to, priority, work notes, and SLA support; response steps use Security Incident Task [sn_si_task].

SIR roles: sn_si.admin configures and accesses all incidents, sn_si.manager oversees teams, sn_si.analyst creates and edits incidents, sn_si.read is view-only, sn_si.basic has limited access, and sn_si.integration is for integration users.

The security incident lifecycle follows NIST IR phases: New, Analysis, Contain, Eradicate, Recover, Review, and Closed; Cancelled applies to records that are not valid incidents.

Security incidents relate to configuration items through the task_ci many-to-many table, which populates the Affected CIs related list.

Observables are stored in sn_si_observed_data and linked to the incident; they hold IPs, domains, URLs, hashes, and email addresses used for enrichment.

Domain separation is supported: sn_si records carry a domain value, so a user sees records in their domain unless granted broader domain visibility.

Behavior is controlled by system properties beginning with sn_si. (for example close requirements and notifications), maintained in the System Properties table.

Security incidents are created manually, promoted from an alert [sn_si_alert], generated by SIEM or EDR integrations, or opened from a phishing report.

Observables [sn_si_observed_data] capture IP, domain, URL, file hash, and email artifacts tied to the incident and can be enriched against threat intelligence.

Response tasks [sn_si_task] break an incident into assigned steps; task templates pre-populate the standard task set for a given incident type.

Containment actions such as blocking an IP, isolating a host, or disabling an account run through integrations or flow actions and are recorded as tasks or work notes.

Closing a security incident requires a close code and close notes; the close code classifies the outcome (for example true positive or false positive) for reporting.

Flagging a major security incident escalates notifications and visibility and typically adds a post-incident review task.

The Analyst Workspace consolidates incident details, observables, tasks, SLAs, and related records into one view for the analyst.

Related incidents and alerts can be linked to show campaign-level relationships and shared observables.

Threat intelligence uses STIX-style objects: Indicator, Observable, Threat Actor, Campaign, Attack Pattern, Malware, Tool, and Report.

An IOC carries a type (IP, domain, URL, file hash, email), value, confidence, TLP marking, and valid-from and valid-to dates.

TLP governs sharing: RED is named recipients only, AMBER is limited distribution, GREEN is community, and CLEAR/WHITE is public.

Threat intelligence sources and feeds are configured in the Threat Intelligence module and can import data on a schedule or on demand.

Incident observables are enriched by looking them up against threat intelligence, returning indicator matches, confidence, and threat scores.

Indicator matching compares observable values to IOC records; a match increases the observable's confidence or score and can drive automated actions.

Attack patterns map to MITRE ATT&CK techniques, giving analysts adversary-behavior context for an incident.

Threat intelligence objects link to one another (actor to campaign to indicator), so an incident can be rolled up to an adversary or campaign.

Vulnerability Response imports scanner findings as Vulnerability Entries [sn_vul_entry], then deduplicates and rolls them into Vulnerable Items [sn_vul_vulnerable_item] tied to a CI.

Supported scanner integrations include Qualys, Tenable, Rapid7, and cloud providers such as AWS and Azure; other findings use third-party entries.

Each vulnerable item stores CVSS base score, severity, and exploitability, which combine with asset and business criticality to produce the risk score.

Remediation Tasks group vulnerable items for fix implementation and can spawn a Change Request to perform the change.

Vulnerable items can be deferred with a reason and time period, or marked false positive or exception instead of remediated.

Vulnerability Groups aggregate related vulnerable items for coordinated assignment and remediation.

Assignment rules route vulnerable items to the correct assignment group based on CI attributes or CI class.

Dashboards report open vulnerable items by severity, age, and remediation SLA compliance.

Security Operations integrations cover SIEM (Splunk, QRadar), EDR (CrowdStrike, Carbon Black), threat intelligence (VirusTotal, Anomali), and vulnerability scanners, configured in the Integrations area.

Inbound alerts land in the Alert [sn_si_alert] table and can be promoted to security incidents manually or automatically.

IntegrationHub provides prebuilt spokes and actions for external security tools; custom integrations use REST messages, Import Sets, or Data Streams.

Flow Designer automates triage, enrichment, task creation, and notifications using record, schedule, or email triggers.

Flow actions can call IntegrationHub actions to perform containment (block IP, isolate endpoint) and write results to work notes.

Reports and dashboards on sn_si_incident, sn_si_alert, and sn_vul_vulnerable_item track volume, MTTR, SLA compliance, and severity trends.

Performance Analytics adds time-series indicators and trend dashboards to SecOps data and requires the subscription.

Scheduled reports and scheduled flows distribute recurring SecOps metrics to stakeholders.