|
Zurich
|
- **[Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks](https://www.servicenow.com/docs/access?context=cortex-xsiam-siem&family=zurich&ft:locale=en-US)**
As a profile admin:
- Create profiles for incident ingestion.
- Filter Cortex XSIAM incidents.
- Map Cortex XSIAM **Incident**, **Alert**, and **Event** fields to SIR security incident fields.
- Aggregate incidents to existing open security incidents to avoid having to create duplicate security incidents.
- Synchronize ServiceNow instance Work notes with Palo Alto Networks XSIAM comments.
- **[Set up Splunk environment](https://www.servicenow.com/docs/access?context=splunk-es-addon&family=zurich&ft:locale=en-US)**
The ServiceNow Security Operations Event Ingestion Add-on for Splunk ES enables seamless integration between Splunk and ServiceNow Security Operations, allowing you to send security-related events from Splunk ES to a ServiceNow security incident.
- **[LLM-powered SIR integration builder](https://www.servicenow.com/docs/access?context=sir-integration-builder-now-assist&family=zurich&ft:locale=en-US)**
With the ServiceNow platform's latest LLM powered integrations, you can create product-ready integration quickly. The LLM-powered integration builder has the following capabilities:
- Automatically generates integration code from a public API documentation.
- Provides guided setup built on existing capabilities.
- Provides easy edit and maintenance of the generated auto code.
- **[Deny rule for phishing emails](https://www.servicenow.com/docs/access?context=urp-about&family=zurich&ft:locale=en-US)**
The security admin can add rules to prevent the conversion of phishing emails such as false positives or low-risk messages into security incidents. Any new phishing email is verified first with the deny rules to avoid unwanted security incidents.
- **[Update information in security incident related records](https://www.servicenow.com/docs/access?context=edit-related-records-in-list&family=zurich&ft:locale=en-US)**
The security analysts can now edit related records such as associated observables, for a security incident directly from the Related Records list view. Security analysts can quickly update the records without leaving their current context.
- **[Advanced Work Assignment for SIR](https://www.servicenow.com/docs/access?context=awa-for-sir&family=zurich&ft:locale=en-US)**
Use Advanced Work Assignment \(AWA\) to streamline the security incident assignment process which ensure that critical incidents are handled by the most appropriate and available analysts. This improves overall response times and efficiency in security operations.
As an admin, configure the following:
- Service channels
- Queues
- Assignment rules
- Presence states
- Rejection reasons
As an analyst, do the following:
- Set your availability
- Accept or reject incoming security incidents
- **[Prevent duplicate security incidents for IT incidents](https://www.servicenow.com/docs/access?context=si-creation&family=zurich&ft:locale=en-US)**
Prevent the creation of duplicate security incidents when ITIL users escalate an IT incident to a security incident, the system by enabling the `sn_si.disable_duplicate_security_incident` system property.
- **[Ingest third-party risk scores](https://www.servicenow.com/docs/access?context=define-risk-score-calculator-rules-sir&family=zurich&ft:locale=en-US)**
Factor third-party risk scores into security incident risk calculation by ingesting and mapping those scores for better prioritization of high-risk threats.
- **[Simplified adding categories and sub-categories for security incidents](https://www.servicenow.com/docs/access?context=category-management-sir&family=zurich&ft:locale=en-US)**
Admin can create categories and subcategories in Security Incident Response Workspace based on threat types, compliance requirements, or reporting needs.
Security analysts can assign these categories and subcategories to security incidents.
- **[Security incident Details tab](https://www.servicenow.com/docs/access?context=security-incident-details-form&family=zurich&ft:locale=en-US)**
Include the **Functional Impact**, **Recoverability** and **Information Impact** fields on the Details tab of a security incident to improve triage accuracy, incident handling efficiency, and executive reporting for calculating the risk score.
- **[Add indirectly linked VITs to CVEs](https://www.servicenow.com/docs/access?context=configure-mitre-att-ck-properties&family=zurich&ft:locale=en-US)**
In MITRE-ATT&CK framework, identify all third-party entities \(TPEs\) associated with common vulnerabilities and exposures \(CVEs\) and then calculate and display the total number of vulnerable items \(VITs\) indirectly linked to those CVEs through the TPEs by setting the **sn\_ti.include\_cve\_vit\_indirect\_relation** system property.
- **[Configure on-call schedules](https://www.servicenow.com/docs/access?context=on-call-schedule-sir&family=zurich&ft:locale=en-US)**
As an admin, manage on-call schedules through the following activities:
- Create a shift and assign or remove members to or from the shift.
- Create and edit on-call schedules for groups.
- View any group’s on-call schedule.
As an analyst, track your on-call responsibilities through the following activities:
- Specify your availability and preferred contact methods.
- View your on-call schedule.
- See other members of your shift.
- **[Users accessing the same incident](https://www.servicenow.com/docs/access?context=security-incident-overview&family=zurich&ft:locale=en-US)**
When you open an incident, the initials of all the users currently accessing the same incident are displayed to avoid conflicts.
- **[Universal search field for linking observables](https://www.servicenow.com/docs/access?context=sir-records&family=zurich&ft:locale=en-US)**
Search across all the field values of the associated observables for an incident.
- **[CrowdStrike Next-Gen SIEM integration](https://www.servicenow.com/docs/access?context=crowdstrike-next-gen-integration-secops&family=zurich&ft:locale=en-US)**
As a Profile Admin:
- Discover CrowdStrike Next-Gen SIEM detections that are candidates for security incidents and automate the creation of these security incidents.
- Create detection profiles.
- Map CrowdStrike Next-Gen SIEM Detection and Events Fields to SIR security incident fields.
- Filter CrowdStrike Next-Gen SIEM defects.
- Aggregate detections to existing open security incidents so that you don't have to create duplicate security incidents.
- Automate CrowdStrike Next-Gen SIEM detection status updates for Security Incident Response.
- Synchronize CrowdStrike Next-Gen SIEM detection comments with SIR Work notes.
- **[Create an event profile](https://www.servicenow.com/docs/access?context=splunk-event-ingest-create-profile-security&family=zurich&ft:locale=en-US)**
- Enables bidirectional updates and closure synchronization between Splunk ES and Splunk integrations.
- Enables retrieval of historical, and ongoing data including closed events, with an option to pull the closed events into the ServiceNow Splunk ES instance.
- Receive updates for the mapped fields in SIR.
- **[Components installed with Security Incident Response](https://www.servicenow.com/docs/access?context=installed-with-sir&family=zurich&ft:locale=en-US)**
A new Profile Admin role \(sn\_si.ingestion\_profile\_admin\) provides access to configure plugins, and to create, edit, delete, and manage profiles for the Splunk, Splunk ES, and Azure Sentinel Integration for Security Operations application.
- **[Enhancements to relationship graphs](https://www.servicenow.com/docs/access?context=sir-relationship-graph&family=zurich&ft:locale=en-US)**
As an admin:
- Define default child nodes to populate in the relationship graph.
- Configure relationship labels.
As an analyst:
- Add or remove child nodes at the parent node level.
- Save the state of the relationship graph.
- Retrieve updated data.
|