ServiceNow CIS-SecOps flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

sn_si_incident table

The core Security Incident Response table; extends Task, so it inherits number, state, assignment, priority, and SLA fields and stores incident-specific details.

Security Incident Task table

sn_si_task records individual response steps under a security incident and extends Task for assignment, due dates, and work notes.

sn_si.admin role

Security Incident Response administrator role with full configuration and data access, including properties, assignment rules, and all incidents.

sn_si.analyst role

Role that lets a user create, edit, and work security incidents, observables, and tasks; it does not grant administrative configuration rights.

Security incident states

NIST-aligned lifecycle: New, Analysis, Contain, Eradicate, Recover, Review, and Closed, with Cancelled used for records that are not valid incidents.

Domain separation in SIR

Security incident records carry a domain field, so users only see incidents in their domain unless granted domain admin or global visibility.

task_ci relationship

Many-to-many table linking tasks, including security incidents, to configuration items; it populates the Affected CIs related list.

Observable

sn_si_observed_data record holding an IP, domain, URL, hash, or email associated with a security incident and used for threat intelligence enrichment.

Promote alert to incident

UI action on an Alert [sn_si_alert] record that creates a linked security incident, carrying over the short description and observables.

Close code

Required classification value entered when closing a security incident (for example true positive or false positive) that supports reporting and metrics.

Response task template

Predefined set of security incident tasks applied to an incident to standardize handling for a given incident type.

Major security incident

Flag on a security incident that escalates visibility and notifications and typically triggers a post-incident review.

Analyst Workspace

Security Operations interface that consolidates incident details, observables, tasks, SLAs, and related records into one analyst view.

Post-incident review

Task created after containment and recovery to capture lessons learned, root cause, and follow-up actions for a security incident.

Indicator of Compromise

Threat intelligence record with a type, value, confidence, TLP marking, and validity dates that can be matched against incident observables.

TLP

Traffic Light Protocol sharing marking: RED for named recipients only, AMBER for limited distribution, GREEN for community, and CLEAR/WHITE for public.

Threat actor

STIX object representing an individual or group that conducts malicious activity; linked to campaigns, indicators, and attack patterns.

Attack pattern

STIX object describing adversary behavior or technique, commonly mapped to MITRE ATT&CK, used to contextualize security incidents.

Threat intelligence feed

Configured source that supplies indicator and object data to ServiceNow on a schedule or on demand.

Observable enrichment

Lookup of an incident observable against threat intelligence sources to return indicator matches, confidence, and threat scores.

Vulnerable item

sn_vul_vulnerable_item record linking one configuration item to one vulnerability definition, carrying severity, risk score, state, and remediation ownership.

Vulnerability entry

Raw scanner finding imported into Vulnerability Response; entries are deduplicated and rolled up into vulnerable items.

Remediation task

Task that groups vulnerable items for fix implementation and can generate a change request for the actual change.

Vulnerability group

Container that aggregates related vulnerable items so they can be assigned, tracked, and remediated together.

Risk score

Vulnerability Response score combining CVSS severity with asset and business criticality and exploitability to prioritize remediation work.

Deferral

Action that suspends remediation of a vulnerable item for a stated reason and time period, tracked separately from actively open items.

sn_si_alert table

Stores inbound security alerts from SIEM, EDR, and other sources; alerts can be promoted to security incidents for investigation.

IntegrationHub

ServiceNow subscription feature providing reusable spokes and actions that Flow Designer calls to integrate with external security tools.

Flow Designer

No-code automation tool that triggers on record events, schedules, or email and runs actions, including IntegrationHub actions.

Import set

Staging mechanism that loads external data into ServiceNow tables through transform maps, often used for bulk alert or vulnerability ingestion.

REST message

Outbound REST configuration defining endpoint, authentication, and method used by integrations to call external security APIs.

Performance Analytics

Subscription module providing time-series indicators and dashboards for trends such as incident volume and mean time to resolve.