|
Washington DC
|
- **[Enhancements to version 3.0](https://www.servicenow.com/docs/access?context=spc-policies-overview&family=washingtondc&ft:locale=en-US)**
Policy enhancements:
- Edit activated policies, save changes, publish changes, and exit edit mode with UI actions in policies. Versions are tracked and version numbers are displayed on the policy records and their related test results.
- Close existing related test results \(findings\) if you publish a new version of a policy or delete a policy. If you choose to close test results, test result and remediation task states transition in accordance with the state transition processes of the Configuration Compliance application. See [Test result and remediation task state transitions in the Security Posture Control application](https://www.servicenow.com/docs/access?context=spc-findings-state-transition&family=washingtondc&ft:locale=en-US) for more information.
- Query the Security Posture Control product with **Software** as an Entity type. Look for any discrepancies that exist between the installed software reported by your vulnerability scanner products and the software reported by scanners and already accounted for in Software Asset Management \(SAM\) and other ServiceNow® products.
Policy condition builder enhancements:
- Select the **OR** condition to search for and monitor diverse types of assets from a single policy.
- Select **Reported only by** as a Connection and choose specific Sources \(third-party service graph connectors and ServiceNow products\) to report on your assets. Monitor only those assets that are reported by the specific ServiceNow® products and third-party sources you select.
Select **CMDB metadata** as a Connection in the condition builder and search for the following assets:
- Devices with host names that have specific patterns with **matches regex** operator for the host name Property. For example, if you enter `lp` manually, you can look for all laptops with 'lp' as the second and third characters in the host name.
- Assets that have been discovered for the first time with the **First seen** timestamp Property.
- Devices based on specific models and model information with the **Model name**, **Has model info**, and **Model data** conditions. This data can help you with security control coverage.
- Assets that were **Last seen** **Within the last n days**. Enter the number of days up to **30**. For example, enter **3** to monitor assets by 'last logon' from Active Directory in the last three days.
- **[Policies \(prior to version 3.0\)](https://www.servicenow.com/docs/access?context=spc-policies-overview&family=washingtondc&ft:locale=en-US)**
Monitor your assets and cloud assets \(AWS only\) for missing endpoint protection agents, unmanaged devices, devices not scanned for vulnerabilities, and critical combinations with vulnerabilities with provided policies.
- Define custom policies based on asset metadata, security tool configuration data, and vulnerabilities to monitor asset compliance with your internal security standards.
- Chain policies together so you can monitor assets in hierarchical categories.
- Filter assets by using custom fields in your CMDB CI classes in policies.
- Exclude assets from your audits and monitoring that match other policies or assets with approved exceptions in Integrated Risk Management \(IRM\).
- **[Service Graph Connectors](https://www.servicenow.com/docs/access?context=spc-use-connectors-policies&family=washingtondc&ft:locale=en-US)**
The application supports 31 Service Graph Connectors for various security and IT tools in the enterprise to import and consolidate asset data to provide you insights on your security posture.
- **[Key insights and custom insights](https://www.servicenow.com/docs/access?context=spc-custom-insight-overview&family=washingtondc&ft:locale=en-US)**
Monitor critical metrics about your asset security posture and security tool coverage by creating custom insights.
|
|
Xanadu
|
- **[Mitigation Controls Monitoring with Security Posture Control](https://www.servicenow.com/docs/access?context=spc-mitigation-exploring&family=xanadu&ft:locale=en-US)**
From within the Security Posture Control workspace, detect mitigation controls of various types as described by MITRE on all on-premise and cloud enterprise assets. Gain insight into which threats to your assets are mitigated by available mitigation controls based on how various security tools are configured.
- Activate mitigation control policies that are included with the application that identify MITRE mitigations on your assets.
- Identify your assets that have Web Application Firewall \(WAF\) protection with supported tools that include F5 BIG-IP. Automatically map a WAF mitigation to vulnerable items by analyzing the policy signatures in the firewall and the Common Vulnerabilities and Exposures \(CVE\) information.
- Identify exploit mitigation controls from endpoint protection or Endpoint Detection and Response \(EDR\) tools like CrowdStrike and Microsoft Defender. Automatically map the EDR exploit mitigation controls to relevant vulnerable items by analyzing the vulnerability information and the EDR mitigation control configuration.
- Populate vulnerable items with relevant attributes that can be used in your Vulnerability Response risk calculator rules.
- Import agent information from the SentinelOne product into your ServiceNow AI Platform® with the [Service Graph Connector for Sentinel One](https://www.servicenow.com/docs/access?context=sgc-sentinelone-integration&family=xanadu&ft:locale=en-US).
- Import asset data from the Splunk product into your ServiceNow AI Platform® with the [Service Graph Connector for Splunk](https://www.servicenow.com/docs/access?context=sgc-splunk-integration&family=xanadu&ft:locale=en-US).
- **[Enhancements to custom insights in the Security Posture Control Workspace](https://www.servicenow.com/docs/access?context=spc-custom-insight-overview&family=xanadu&ft:locale=en-US)**
The name of the Custom insights module has been changed to the Configured insights module in the Security Posture Control Workspace.
You must assign groups to organize your reports by categories when you create custom insight records. Groups determine where your data visualizations are displayed on the dashboard in the Configured insights module according to the criteria you set.
- **[Enhancements to the Condition policy builder in the Policies and findings module](https://www.servicenow.com/docs/access?context=spc-create-policy&family=xanadu&ft:locale=en-US)**
Select **With aggregated data** for **Connection** to ensure that your policy matches assets that have slight variations in reported data. The following properties for policies for hardware assets are supported as they’re reported by different sources:
- Host name
- FQDN
- OS
- OS Version
- OS Domain
- OS Service Pack
- **[Test result and remediation task state transitions](https://www.servicenow.com/docs/access?context=spc-findings-state-transition&family=xanadu&ft:locale=en-US)**
Enhancements to policy audits ensure that retired assets are not evaluated by activated policies. If the state of an asset transitions from **Retired** back to **Active**, it is included in the next policy evaluation.
|
|
Yokohama
|
- **[Create a custom API service graph connector in the Security Posture Control workspace](https://www.servicenow.com/docs/access?context=spc-creating-sgc-template&family=yokohama&ft:locale=en-US)**
Use generative AI to help your developers create SPC API connectors quickly with the Connector builder framework module in the Security Posture Control workspace. With a Now Assist skill that is included with the Now Assist for Vulnerability Response application, your developers have the option to automate steps in the Connector builder framework.
- You have the option to automate the steps for selecting API templates, populating request and header parameters, and response field mapping with generative AI.
**Note:** You must install [Yokohama Patch 11](https://www.servicenow.com/docs/access?context=yokohama-patch-11&family=yokohama&ft:locale=en-US) of the Now Assist for Vulnerability Response application to have access to the generative AI skill for the Connector builder framework. See the [Now Assist for Security Incident Response release notes](https://www.servicenow.com/docs/access?context=secops-now-assist-security-operations-rn&family=yokohama&ft:locale=en-US) and [Supporting information](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-vr&family=yokohama&ft:locale=en-US) for more information.
- Use your custom API connector to integrate with security tools and import asset data that is based on the unique requirements of your environment.
- Help your cybersecurity teams monitor your overall security posture and identify assets that are missing key security tools with the API connectors that you build.
- **[Enhancements to policies and asset profiles included with the Security Posture Control application](https://www.servicenow.com/docs/access?context=spc-policies-overview&family=yokohama&ft:locale=en-US)**
Get insights into your overall security posture and configuration gaps in your security tools using new policies and asset profiles that are included with the Security Posture Control application. Activate these asset profiles and policies in the Security Posture Control workspace so that you can identify gaps in configuration or coverage for the following tools:
- CrowdStrike
- Microsoft Intune, Defender, and SCCM
- HCL Big Fix
- SentinelOne
- Qualys
- Rapid7
- **[SentinelOne integration for mitigation controls monitoring](https://www.servicenow.com/docs/access?context=spc-controls-policies-for-edr&family=yokohama&ft:locale=en-US)**
You can import SentinelOne mitigation controls data with this integration to help you detect which mitigation controls are on your assets. Use this integration with the asset and software data that you import with the SentinelOne Service Graph Connector to help you monitor your security tool coverage on your enterprise assets.
- **[Netskope](https://www.servicenow.com/docs/access?context=sgc-netskope-integration&family=yokohama&ft:locale=en-US)**
This product pulls in asset inventory data for hardware and software from the Netskope database into the ServiceNow Configuration Management Database \(CMDB\) application.
|
|
Zurich
|
- **[Create a custom API service graph connector in the Security Posture Control workspace](https://www.servicenow.com/docs/access?context=spc-creating-sgc-template&family=zurich&ft:locale=en-US)**
Use generative AI to help your developers create SPC API connectors quickly with the Connector builder framework module in the Security Posture Control workspace. With a Now Assist skill that is included with the Now Assist for Vulnerability Response application, your developers have the option to automate steps in the Connector builder framework.
- You have the option to automate the steps for selecting API templates, populating request and header parameters, and response field mapping with generative AI.
**Note:** You must install Zurich Patch 4 of the Now Assist for Vulnerability Response application to have access to the generative AI skill for the Connector builder framework. See the [Now Assist for Security Incident Response \(SIR\) release notes](https://www.servicenow.com/docs/access?context=secops-now-assist-security-operations-rn&family=zurich&ft:locale=en-US) and [Supporting information](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-vr&family=zurich&ft:locale=en-US) for more information.
- Use your custom API connector to integrate with security tools and import asset data that is based on the unique requirements of your environment.
- Help your cybersecurity teams monitor your overall security posture and identify assets that are missing key security tools with the API connectors that you build.
- **[Enhancements to policies and asset profiles included with the Security Posture Control application](https://www.servicenow.com/docs/access?context=spc-policies-overview&family=zurich&ft:locale=en-US)**
Get insights into your overall security posture and configuration gaps in your security tools using new policies and asset profiles that are included with the Security Posture Control application. Activate these asset profiles and policies in the Security Posture Control workspace so that you can identify gaps in configuration or coverage for the following tools:
- CrowdStrike
- Microsoft Intune, Defender, and SCCM
- HCL Big Fix
- SentinelOne
- Qualys
- Rapid7
|
|
Australia
|
No updates for this release.
|