Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The ServiceNow Action Bundle for ThreatQuotient enables a user to create and sync tickets and observables in ServiceNow.  For each indicator, an observable will be created in ServiceNow that will be linked to the newly created ticket.   ThreatQ objects that are not mapped as indicators will be created in ServiceNow and associated attributes mapped to items in ServiceNow.   

See the ServiceNow to ThreatQ Object Mapping table for more details.  

The integration provides the following action:

• ServiceNow - Create Ticket - creates tickets and observables in ServiceNow based on ThreatQ indicators and objects. 
• ServiceNow - Sync Ticket - receives a collection of ThreatQ Incidents or Events to either sync or create tickets in ServiceNow.  
• ServiceNow - Sync Observables - receives a collection of ThreatQ Indicators and creates ServiceNow observables or updates existing ones.

The action is compatible with the following system object types:

The action returns the following enriched object types:

Prerequisites

• An active ThreatQ TDR Orchestrator (TQO) license.
• A ServiceNow Username and Password.
• A data collection containing at least one of the following object types:
  • Adversary
  • Asset
  • Attack Pattern
  • Campaign
  • Course of Action
  • Exploit
  • Target
  • Identity
  • Indicator
  • Intrusion Set
  • Malware
  • Report
  • Tool
  • TTP
  • Vulnerability

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the action zip file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the action zip file using one of the following methods:
   • Drag and drop the zip file into the dialog box
   • Select Click to Browse to locate the zip file on your local machine

   ThreatQ will inform you if the action already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the action contains changes to the user configuration. The new user configurations will overwrite the existing ones for the action and will require user confirmation before proceeding.

You will still need to configure the action.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.
 

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Actions option from the Category dropdown (optional).
3. Click on the action entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   The configurations set on this page will be used as the default settings when inserting this action into a new workflow. Updating the configurations on this page will not update any instances of this action that have already been deployed to a workflow. In that scenario, you must update the action’s configurations within the workflow itself.

   Create Ticket Parameters

   Parameter	Description
   Hostname	Your ServiceNow Hostname.
   Username	Your ServiceNow Username.
   Password	Your ServiceNow Password.
   Ticket Creation Behavior	Select the creation behavior.  Options include: A Single ticket / case with all items linked (default) Individual tickets / cases per item
   Ticket / Case Type	Select the type of ticket / case to create in ServiceNow.  Options include: Security Incident (default) Incident Security Incident Response Task Security Case
   Name	This populates the ticket / case name in ServiceNow.
   Description	This is an optional field where users can provide a description for the case / ticket created.
   Observable Rating	Select the rating for each observable attached to the ticket / case in ServiceNow.  Options include:  Malicious (default) Unknown
   Append ticket / case name with object name	By checking this box it will append the indicator value to the “Name” provided. This parameter is only available if you have select Individual Tickets / Cases per item option for the Ticket / Case Type parameter.
   Assignment Group	Optional - Specify the name of the Assignment Group for the new ticket.
   Assigned To	Optional - Specify the full name/email of the assignee for the new ticket. If this field is populated it is mandatory to also specify the Assignment Group.
   Requests per minute	The maximum number of requests to make to ServiceNow per-minute.  The default value is 100. This parameter is only available if you have select Individual Tickets / Cases per item option for the Ticket / Case Type parameter.
   Objects per run	The maximum number of objects to send to ServiceNow per-run.  The default value is 5000. This parameter is only available if you have select Individual Tickets / Cases per item option for the Ticket / Case Type parameter.

   
   

   Sync Ticket Parameters

   Parameter	Description
   Hostname	Your ServiceNow Hostname.
   Username	Your ServiceNow Username.
   Password	Your ServiceNow Password.
   ThreatQ URL	Enter the full URL to ThreatQ platform. This will be used to link observables to ThreatQ objects.
   Ticket / Case Type	Select the type of ticket / case to create in ServiceNow.  Options include: Security Incident (default) Incident Security Incident Response Task Security Case
   Description	This is an optional field where users can provide a description for the case / ticket created.
   Related Security Incidents to Security Cases	For ThreatQ objects representing Security Cases - add the related ThreatQ objects representing Security Incidents as relations in ServiceNow if they have the attribute ServiceNow Ticket Number
   Properties to Update/Add for Security Incidents	Select the properties from ServiceNow that should be updated/populated using the corresponding ThreatQ attributes for Security Incidents.  Options include: Assignment Group Assigned To Affected User Category Subcategory Priority Business Criticality Impact Urgency Risk Score (Overwrite value)
   Properties to Update/Add for Security Cases	Select the properties from ServiceNow that should be updated/populated using the corresponding ThreatQ attributes for Security Case.  Options include: Assignment Group Assigned To Priority Impact Urgency Case Type Rating
   Properties to Update/Add for Service Desk Incidents	Select the properties from ServiceNow that should be updated/populated using the corresponding ThreatQ attributes for Service Desk Incidents.  Options include: Assignment Group Assigned To Severity Impact Urgency Contact Type Category Subcategory
   Properties to Update/Add for Security Incident Response Tasks	Select the properties from ServiceNow that should be updated/populated using the corresponding ThreatQ attributes for Security Incident Response Tasks.  Options include: Assignment Group Assigned To Affected User Priority Impact Urgency Contact Type
   Objects to Run	Maximum number of objects to send to ServiceNow per-run.

   
   

   Sync Observables Parameters

   Parameter	Description
   Hostname	Your ServiceNow Hostname.
   Username	Your ServiceNow Username.
   Password	Your ServiceNow Password.
   ThreatQ URL	Enter the full URL to ThreatQ platform. This will be used to link observables to ThreatQ objects.
   Observable Rating	Select the rating for each observable created in ServiceNow.  Options include:  Malicious (default) Unknown
   Objects per run	The maximum number of objects to send to ServiceNow per-run.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.

Actions

The following action is available:

{
    "short_description": "Block address - 8.8.8.8",
    "description": "This is a test description"
}

{
    "result": {
        "sys_id": "bd50ee481b181d1014a264207e4bcb8a",
        "number": "INC0010058"
    }
}

{
    "sysparm_query": "number={{attribute_servicenow_ticket_number}}",
    "sysparm_display_value": "true"
}

{
    "short_description": "{{Incident/Event_Value}}",
    "description": "This is a test description",
    "category": "Malicious code activity"
}

{
    "result": {
        "sys_id": "bd50ee481b181d1014a264207e4bcb8a",
        "number": "INC0010058"
    }
}

{
    "sysparm_query": "value=148.23.67.12",
    "sysparm_fields": "sys_id"
}

{
    "result": {
        "sys_id": "bd50ee481b181d1014a264207e4bcb8a",
    }
}

{
    "result": {
        "sys_id": "bd50ee481b181d1014a264207e4bcb8a"
    }
}

{
    "value": "1.0.1.0",
    "type": "IP address (V4)",
    "finding": "Malicious"
}

{
    "result": {
        "sys_id": "bd50ee481b181d1014a264207e4bcb8a"
    }
}

{
    "task": "bd50ee481b181d1014a264207e4bcb8a",
    "observable": "bd50ee481b181d1014a264207e4bcb8a"
}

{
    "result": {
        "sys_id": "30ffdb5e1ba1e91014a264207e4bcb80"
    }
}

{
    "name": "APT34",
    "description": "Object imported from ThreatQ Adversary when ticket SIR0010047 was created.",
    "created": "2024-01-17T04:56:19.000Z",
    "modified": "2024-01-17T04:56:19.000Z"
}

{
    "result": {
        "sys_id": "bd50ee481b181d1014a264207e4bcb8a"
    }
}

Enriched Data

Object counts and action runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and action runtime may vary based on system resources and load.

Create Ticket

Sync Ticket

Use Case Example

Create Ticket Action

1. A user submits a data collection using the ServiceNow - create ticket action to the ServiceNow with a data collection containing 100 system objects (100 IP Address).
2. The ServiceNow creates tickets and observables for submitted data and establishes a relationship between them.
3. The action returns the submitted data collection enriched the following:
   • 100 Indicators
   • 300 indicator attributes

Sync Ticket Action

1. A user submits a data collection using the ServiceNow - Sync Ticket action to the ServiceNow with a data collection containing 10 ThreatQ Events ingested using ServiceNow CDF.
2. The ServiceNow update the tickets and their related observables using ThreatQ attributes and properties.
3. The action returns number and link to the ServiceNow ticket.

Sync Observables

1. A user submits a data collection using the ServiceNow - Sync Observables action to the ServiceNow with a data collection containing 100 ThreatQ indicators.
2. The ServiceNow update the observables, if they exist, or creates new ones using ThreatQ attributes and properties.

Known Issues / Limitations

• The ThreatQ platform limits the incoming list of values to 100.  If the collection is bigger than that, even if the user selects to create a single ticket that links all the items, multiple tickets will be created per 100.  Example: incoming list of 450 will result in the creation of 5 tickets.  

Change Log

• Version 2.0.0
  • Added two new actions: ServiceNow Sync Ticket and ServiceNow Sync Observables. 
  • Added new two new configuration fields to the ServiceNow - Create Ticket action:
    • Assignment Group - Optionally specify the name of the Assignment Group for the new ticket.
    • Assigned To - Optionally specify the full name/email of the assignee for the new ticket.
  • Added support for Incident and Event object types (ServiceNow Sync Ticket).
  • Updated integration name to ServiceNow Action Bundle.  
• Version 1.1.0
  • Added compatibility support for all ThreatQ indicator types.  
  • Added compatibility support for the following object types: 
    • Adversary
    • Asset
    • Attack Pattern
    • Campaign
    • Course of Action
    • Exploit Target
    • Identity
    • Intrusion Set
    • Malware
    • Report
    • Tool
    • TTP
    • Vulnerability
• Version 1.0.0
  • Initial release