ServiceNow CIS-SecOps key terms

A suite of ServiceNow applications-Security Incident Response, Threat Intelligence, and Vulnerability Response-that helps security teams detect, prioritize, investigate, and remediate threats using shared platform data and workflows.

The ServiceNow application used to manage the full lifecycle of security incidents, from intake and triage through investigation, containment, eradication, recovery, and closure, with playbooks and a dedicated workspace.

A ServiceNow record on the sn_si_incident table that represents a suspected or confirmed security threat and holds details such as priority, affected CIs, observables, tasks, and response history.

A role-based interface that brings security incident queues, record details, observables, threat context, and response actions together so analysts can work without switching between modules.

A child record of a security incident that assigns one response step, such as evidence collection or containment, to a person or group with its own state, priority, and due date.

A defined sequence of automated and manual response steps that guides analysts through handling an incident consistently and can be launched manually or by a trigger condition.

The set of lifecycle states a security incident moves through-such as Draft, Analysis, Containment, Eradication, Recovery, and Closed-that controls required fields, SLA timing, and reporting.

An artifact associated with an investigation, such as an IP address, domain name, file hash, or email address, that can be enriched, scored, and promoted to threat intelligence.

A record that links an observable to a specific security incident or detection, showing where and when that indicator or artifact was observed in the environment.

A piece of technical evidence, such as a malicious file hash, IP address, or domain, that suggests a system has been compromised and can be used for detection or hunting.

Curated information about threats, including indicators, threat actors, campaigns, and tactics, used to enrich security incidents and prioritize vulnerabilities based on real-world risk.

Complementary standards for cyber threat intelligence: STIX defines the structured data model for indicators and related objects, while TAXII defines the protocol for sharing those objects between systems.

An internal or external source of threat data that ServiceNow imports on a schedule, normalizes into observables and indicators, and matches against security incidents and vulnerable items.

A configured source in ServiceNow that supplies threat intelligence, such as a commercial vendor, an open-source repository, or an internal team, and defines how data is retrieved and trusted.

The action of querying threat intelligence sources for an observable and attaching reputation, confidence, and context so analysts can judge whether it is malicious.

A label applied to security incidents to classify them by threat type, source, or handling requirement, enabling filtering, routing, and grouped reporting across queues.

A team or queue that owns security incidents or response tasks; routing rules, SLAs, and access controls use it to determine who is responsible for the work.

A service level agreement that sets target response and resolution times for security incidents based on priority and can trigger warnings or escalations when time runs out.

A high-impact incident that needs elevated coordination, stakeholder communication, and executive visibility, often tracked through a separate process and reviewed by senior management.

The incident response phase aimed at limiting the spread and impact of a threat, for example by isolating a host, disabling an account, or blocking a malicious IP.

The ServiceNow application that imports vulnerability findings from scanners, matches them to configuration items, calculates risk, and tracks remediation tasks through to closure.

A record representing a specific vulnerability detected on a specific configuration item, including severity, risk score, exploit status, and remediation state.

A record on the sn_vul_vulnerability table that describes a weakness such as a CVE, including severity, references, and exploitability, independent of any single affected asset.

A work item assigned to a team to fix one or more vulnerable items, with priority, due date, approvals, and status used to track remediation progress.

A formal request to accept or dismiss a vulnerability finding because it is not applicable, cannot be fixed, or is a false positive; approval and an expiry date are usually required.

A calculated value that combines vulnerability severity, exploitability, and asset criticality to rank findings so teams can remediate the highest-risk items first.

A record in the configuration management database that represents an asset or service, such as a server or application, and provides business context for incidents and vulnerabilities.

The configuration management database that stores configuration items and their relationships, supplying the asset and service context used for impact analysis and prioritization.

A ServiceNow platform capability for running integrations and reusable actions, including spokes for third-party security tools, that automates data exchange and response steps in SecOps workflows.

A low-code tool for building automated flows with triggers, actions, conditions, and approvals that can create records, enrich data, and run response steps in SecOps.

A connector between ServiceNow and a security tool such as a SIEM, EDR, or vulnerability scanner that imports events or findings and can send response actions back to the tool.

ServiceNow staging tables and mapping rules that convert raw integration data into target records such as security incidents, observables, or vulnerable items during an import.

A ServiceNow framework that identifies incoming configuration item data and reconciles it against the CMDB, creating or updating records so incident and vulnerability impact stays accurate.

Reporting tools that display SecOps metrics through visual widgets and historical trend data, helping managers monitor incident volume, response times, and vulnerability backlogs.

A metric measuring the average time from incident creation to first response or resolution, used to evaluate SOC performance and identify process bottlenecks.

Predefined roles such as sn_si.admin, sn_si.manager, sn_si.analyst, and sn_si.basic that determine who can view, work, configure, and administer SecOps records and applications.

A ServiceNow capability that partitions data and processes so different business units, customers, or regions see only their own security incidents, vulnerabilities, and configurations.

Rules that rank security incidents or vulnerable items using risk score, asset criticality, threat context, and business impact so analysts work the most important records first.