Skip to main content

Set Up ServiceNow Integration for Threat Escalation

  • Updated

The ServiceNow Integration for Threat Escalation capability for enterprise accounts using Intezer Autonomous SOC.

To enhance incident response capabilities, Intezer offers integration with ServiceNow, a leading IT service management platform. This integration enables organizations to set up a robust workflow for threat escalation, facilitating faster incident resolution and improved security posture.

Example incident created by the integration: 

incident-example-52.png

Technical Overview

Intezer will send alert data to ServiceNow via a dedicated Scripted REST API that will store the alert data in a dedicated table for Intezer's alerts. A Transform Map will map records from Intezer's alerts table into the Incidents or Security Incidents tables.

This approach allows to customize and adjust the new incident records according to the organization needs and policies. 

snow-diagram-new.png

Create the integration components in ServiceNow

The following instructions will describe how to create the required components in ServiceNow for the integration.

Notice: If not specified otherwise, set fields that are not explicitly mentioned according to your organization policy.

  1. Create Intezer's alerts table
  2. Create a user
  3. Create a Scripted REST API
  4. Create a Transform Map
  5. Test the integration
  6. Send integration details to Intezer

Create Intezer's alerts table

  1. Go to System definition > Tables and click New
  2. Set the following information:
    Label Intezer Alerts
    Name u_intezer_alerts
    Extends table Import Set Row
  3. Go to the Columns tab and double-click Insert a new row... 
    new-column.png
  4. Set the following information:
    Column label alert
    Type String
    Max length 100000
  5. Go to the Application Access tab and select the following options:
    • Can read
    • Can create
    • Allow access to this table via web servicesapplication-access.png
  6. Click on Submit
  7. To verify the table was created go back to System definition > Tables and search for the Intezer Alerts table (by Label)
    table-search-result.png

Create a user

  1. Go to System Security > Users and Groups > Users and click New
  2. Set the following information:
    User ID intezer
    First name Intezer
    Active (Checkbox) True
    Web service access only (Checkbox) True
  3. Click Submit
  4. Open the created user properties
  5. Click on Set Password
    snow-set-password.png
  6. Generate a password and click Save Password
    • 💡 Store the password in a secured location, you will need it in a later step 
      set-password.png
  7. Go to the Roles tab and click Edit
    roles.png
  8. Add the u_intezer_alerts_user role and click Save
    edit-roles.png
  9. Click on Update in the user properties page 

Create a Scripted REST API

  1. Go to System Web Services > Scripted Web Services > Scripted REST APIs and click New
  2. Set the following information:
    Name Intezer
    API ID intezer
  3. Click Submit
  4. Open the created API
  5. Go to the Resources tab and click New
  6. Set the following information:
    Name Alerts
    Active (Checkbox) True
    HTTP method POST
    Relative path /alerts
    Script 
    (function process(/*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {

     var result = new global.JSON();
     var alerts = new GlideRecord("u_intezer_alerts");
     alerts.initialize();
     alerts.newRecord();
     alerts.setValue('u_alert', JSON.stringify(request.body.data));
     var insert_result = alerts.insert();
     result['insert_result'] = insert_result;
     return result;

    })(request, response);
  7.  Set the following information in the Security section:
    Required authentication (Checkbox) True
    Requires ACL authorization (Checkbox) True
    ACLS Scripted REST External Default

Create a Transform Map

Notice: This section provide an example for a Transform Map that maps Intezer's alerts into the Incident table. You may implement the Transform Map differently according to your organization needs. 

  1. Go to System Import Sets > Administration > Transform Maps and click New
  2. Set the following information:
    Name Intezer Alerts
    Source table Intezer Alert [u_intezer_alerts]
    Target table Incident [incident]
    Active (Checkbox) True
    snow-transform-map.png
  3. Click Submit
  4. Open the created Transform Map and go to the Field Maps
    field-maps.png
  5. Click New, set Choice action to ignore, set the Source field and Target field, then click Submit:
    Source field Target field
    Created by Caller
  6. For each of the following fields, set Choice action to ignore (when applicable), set the Use source script checkbox, set the Source script and Target field, then click Submit:
    Source script Target field 
    answer = (function transformEntry(source) {
    // Could be adjusted to the organization needs
    return "Inquiry / Help";
    })(source);
    		 Category 
    answer = (function transformEntry(source) {
    return "New";
    })(source);
    		 State 
    answer = (function transformEntry(source) {
    // Could be adjusted to the organization needs
    var parser = new JSONParser();
    var alert = parser.parse(source.getElement("u_alert"));
    if (alert.triage.risk_category == "critical") {
    return 1; // high
    }
    else {
    return 2; // medium
    }
    })(source);
    		 Urgency 
    answer = (function transformEntry(source) {
    // Could be adjusted to the organization needs
    return 1; // high
    })(source);
    		 Impact 
    answer = (function transformEntry(source) {
    var parser = new JSONParser();
    var alert = parser.parse(source.getElement("u_alert"));
    // Could be adjusted to the organization needs
    return "Escalated alert" + (alert.alert.device.hostname ? (" on " + alert.alert.device.hostname) : "");
    })(source);
    		 Short description 
    answer = (function transformEntry(source) {
    var parser = new JSONParser();
    var alert = parser.parse(source.getElement("u_alert"));

    function optional(value) {
    return value ? (Array.isArray(value) ? value.join(", ") : value ) : "N/A";
    }

    function desc_item(key, value) {
    return key + ": " + optional(value);
    }

    // Could be adjusted to the organization needs
    var description = [desc_item("Intezer alert URL", alert.intezer_alert_url),
    desc_item("Alert ID", alert.alert.alert_id),
    desc_item("Alert title", alert.alert.alert_title),
    desc_item("Alert source", alert.source_display),
    desc_item("Source alert URL", alert.alert.alert_url),
    desc_item("Alert verdict", alert.triage_result.alert_verdict_display),
    desc_item("Risk category", alert.triage_result.risk_category_display),
    desc_item("Alert creation time", alert.alert.creation_time_display)];

    if (alert.alert.device) {
    description.push(desc_item("Hostname", alert.alert.device.hostname),
    desc_item("OS name", alert.alert.device.os_name),
    desc_item("OS type", alert.alert.device.os_type),
    desc_item("Device ID", alert.alert.device.id));

    }
    description.push(desc_item("Response status", alert.response.status_display),
    desc_item("Mitigation status", alert.alert.mitigation_status_display),
    desc_item("User recommended actions", alert.response.user_recommended_actions_display),
    desc_item("Alert descriptions", alert.alert.descriptions),
    desc_item("Site", alert.alert.site_name),
    desc_item("External account name", alert.alert.external_account_name),
    desc_item("External severity", alert.alert.severity_display));

    return description.join("\n");
    })(source);
    		 Description
  7. For the following field, set the Use source script checkbox, set the Coalesce checkbox, set the Source script and Target field, then click Submit:
    Source script Target field 
    answer = (function transformEntry(source) {
    var parser = new JSONParser();
    var alert = parser.parse(source.getElement("u_alert"));
    return "intezer_alert:"+alert.alert.alert_id;
    })(source);
    		 Correlation ID
  8. If a popup message is displayed, with a title "Coalesce field not indexed", click OK
    popup-message.png
    • If the popup message is not displayed, verify that the field is indexed by clicking on the Index Coalesce Fields link under Intezer Alerts Transform Map (under related links section)
      index-coalesce-fields.png

 

Test the integration

Example Webhook request body

💡Learn more about the available fields in the API docs

{
    "intezer_alert_url": "https://analyze.intezer.com/alerts/1712212302503451234",
    "source": "my_source",
    "source_display": "My Source",
    "alert": {
        "alert_id": "1712212302503451234",
        "alert_url": "https://myenv.myedr.com",
        "alert_title": "wannacry.exe",
        "device": {
            "hostname": "my-pc-2",
            "os_name": "Windows 11",
            "os_type": "windows",
            "id": "1628421234056811234"
        },
        "severity": "medium",
        "severity_display": "Medium",
        "mitigation_status_display": "Not Mitigated",
        "descriptions": ["The majority of sections in this PE have high entropy, a sign of obfuscation or packing",
                         "This binary may contain encrypted or compressed data as measured by high entropy of the sections (greater than 6.8)"],
        "creation_time_display": "19 Jun 23 | 21:53",
        "site_name": "Acme HQ",
        "external_account_name": "myaccountname"
    },
    "triage_result": {
        "risk_category": "critical",
        "risk_category_display": "Critical",
        "alert_verdict": "confirmed_threat",
        "alert_verdict_display": "Confirmed Threat",
        "families": [{"familiy_name": "Wannacry",
                      "family_id": "0b13c0d4-7779-4c06-98fa-4d33ca98f8a9"}],
        "family_id": "1234",
        "risk_score": 20,
        "risk_level": "critical",
        "threat_name": "Wannacry"
    },
    "response": {
        "status": "escalated",
        "status_display": "Escalated",
        "user_recommended_actions": [{
              "action_context": {
                "process_id": 4321
              },
              "action_name": "Kill Process",
              "action_key": "kill_process"
            }],
        "user_recommended_actions_display": "Kill Process"
    }
}

Code samples

Python

# replace the url with the Scripted REST API created in your ServiceNow instance
url = 'https://SERVICE-NOW-INSTANCE.service-now.com/api/API namespace/intezer/alerts'

# test with intezer user to make sure it has the proper permissions
user = 'intezer'
pwd = 'password for intezer user'

alert = {
    "intezer_alert_url": "https://analyze.intezer.com/alerts/1712212302503451234",
    "source": "my_source",
    "source_display": "My Source",
    "alert": {
        "alert_id": "1712212302503451234",
        "alert_url": "https://myenv.myedr.com",
        "alert_title": "wannacry.exe",
        "device": {
            "hostname": "my-pc-2",
            "os_name": "Windows 11",
            "os_type": "windows",
            "id": "1628421234056811234"
        },
        "severity": "medium",
        "severity_display": "Medium",
        "mitigation_status_display": "Not Mitigated",
        "descriptions": ["The majority of sections in this PE have high entropy, a sign of obfuscation or packing",
                         "This binary may contain encrypted or compressed data as measured by high entropy of the sections (greater than 6.8)"],
        "creation_time_display": "19 Jun 23 | 21:53",
        "site_name": "Acme HQ",
        "external_account_name": "myaccountname"
    },
    "triage_result": {
        "risk_category": "critical",
        "risk_category_display": "Critical",
        "alert_verdict": "confirmed_threat",
        "alert_verdict_display": "Confirmed Threat",
        "families": [{"familiy_name": "Wannacry",
                      "family_id": "0b13c0d4-7779-4c06-98fa-4d33ca98f8a9"}],
        "family_id": "1234",
        "risk_score": 20,
        "risk_level": "critical",
        "threat_name": "Wannacry"
    },
    "response": {
        "status": "escalated",
        "status_display": "Escalated",
        "user_recommended_actions": [{
              "action_context": {
                "process_id": 4321
              },
              "action_name": "Kill Process",
              "action_key": "kill_process"
            }],
        "user_recommended_actions_display": "Kill Process"
    }
}

response = requests.post(url,
auth=(user, pwd),
json=alert)

if response.status_code != 200:
print('Status:', response.status_code, 'Headers:', response.headers, 'Error Response:', response.json())
exit()

# Decode the JSON response into a dictionary and use the data
data = response.json()
print(data)

cURL

curl "https://SERVICE-NOW-INSTANCE.service-now.com/api/API_ID/intezer/alerts" \
--request POST \
--header "Accept:application/json" \
--header "Content-Type:application/json" \
--data "{
    \"intezer_alert_url\": \"https://analyze.intezer.com/alerts/1712212302503451234\",
    \"source\": \"my_source\",
    \"source_display\": \"My Source\",
    \"alert\": {
        \"alert_id\": \"1712212302503451234\",
        \"alert_url\": \"https://myenv.myedr.com\",
        \"alert_title\": \"wannacry.exe\",
        \"device\": {
            \"hostname\": \"my-pc-2\",
            \"os_name\": \"Windows 11\",
            \"os_type\": \"windows\",
            \"id\": \"1628421234056811234\"
        },
        \"severity\": \"medium\",
        \"severity_display\": \"Medium\",
        \"mitigation_status_display\": \"Not Mitigated\",
        \"descriptions\": [\"The majority of sections in this PE have high entropy, a sign of obfuscation or packing\",
                         \"This binary may contain encrypted or compressed data as measured by high entropy of the sections (greater than 6.8)\"],
        \"creation_time_display\": \"19 Jun 23 | 21:53\",
        \"site_name\": \"Acme HQ\",
        \"external_account_name\": \"myaccountname\"
    },
    \"triage_result\": {
        \"risk_category\": \"critical\",
        \"risk_category_display\": \"Critical\",
        \"alert_verdict\": \"confirmed_threat\",
        \"alert_verdict_display\": \"Confirmed Threat\",
        \"families\": [{\"familiy_name\": \"Wannacry\",
                      \"family_id\": \"0b13c0d4-7779-4c06-98fa-4d33ca98f8a9\"}],
        \"family_id\": \"1234\",
        \"risk_score\": 20,
        \"risk_level\": \"critical\",
        \"threat_name\": \"Wannacry\"
    },
    \"response\": {
        \"status\": \"escalated\",
        \"status_display\": \"Escalated\",
        \"user_recommended_actions\": [{
              \"action_context\": {
                \"process_id\": 4321
              },
              \"action_name\": \"Kill Process\",
              \"action_key\": \"kill_process\"
            }],
        \"user_recommended_actions_display\": \"Kill Process\"
    }
}" \
--user 'intezer':'intezer user password'

 

Send integration details to Intezer

Send the following details to support@intezer.com so we could activate the Webhook requests:

  • ServiceNow Instance
    • Example: https://dev123456.service-now.com/
  • Resource path of the Alerts resource created in Scripted REST API
    resource-path.png
  • Password for the Intezer user created in Create a user
    • Notice: Use a secured method to share the password. For example, use a service like https://yopass.se/ 

 

Return to top