{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41266,"path":"platform-security/index.md","title":"Australia Platform security","bundle":"psec","doc_type":"toc","release":"australia","body":"\n# Australia Platform security\n\n- [Secure your instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platsec-landing.md) -- Platform security provides capabilities to secure the instance.\n- [ServiceNow Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/servicenow-vault-landing.md) -- ServiceNow Vault provides a single location to review and implement data security tools, including encryption, data discovery and classification, anonymization, zero trust access, and log export, to protect sensitive data across its entire lifecycle.\n  - [Exploring ServiceNow Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-servicenow-vault.md) -- Learn more about ServiceNow Vault and review the benefits it can provide for your data protection needs.\n    - [AI in ServiceNow Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-now-assist-vault.md) -- With the ServiceNow Otto for Vault application, you can automate many tasks in Vault with the help of AI. These tasks include securing custom applications to improve your security posture, checking role access for an encrypted column to monitor your instance’s encryption access posture, and others.\n    - [Vault Suite](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/vault-suite.md) -- Vault Suite deploys the complete set of ServiceNow Vault capabilities on your instance automatically, eliminating manual plugin setup.\n  - [Configuring ServiceNow Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configuring-servicenow-vault.md) -- Learn how to install and configure ServiceNow Vault.\n    - [Install ServiceNow Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/install-vault.md) -- Install the ServiceNow Vault application and assign the required roles.\n    - [Install Vault Suite](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/install-vault-suite.md) -- Use Vault Suite to deploy ServiceNow Vault and its underlying plugins in a single step, without configuring each plugin separately.\n    - [Vault roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/vault-roles.md) -- Learn and set up the roles necessary to use ServiceNow Vault.\n    - [Install plugins](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/install-vault-plugins.md) -- Learn how to review and install the necessary plugins for ServiceNow Vault.\n    - [Install ServiceNow Otto for Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configuring-now-assist-vault.md) -- Install the ServiceNow Otto for Vault application from the ServiceNow Store to get AI capabilities within Vault.\n    - [Use guided setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/use-vault-guided-setup.md) -- Use guided setup to configure an application with ServiceNow Vault.\n  - [Use agentic AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/use-now-assist-vault-agentic-ai.md) -- Use the ServiceNow Otto for Vault agentic workflows to complete tasks autonomously.\n    - [Securing custom apps with Vault agents agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/now-assist-vault-securing-custom-apps-agents.md) -- Use the securing custom apps with Vault agents agentic workflow to get recommended data classifications and available protections for a custom application.\n    - [Access Observer configuration agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/now-assist-vault-access-observer-config.md) -- Use the Access Observer configuration agentic workflow to view, create, deactivate, and delete Access Observer settings for a particular field.\n    - [Summarize Access Observer logs agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/now-assist-vault-access-observer-logs.md) -- Use the summarize Access Observer logs agentic workflow to review and summarize access logs for a specific field, identifying access sources, users, and their roles.\n    - [Field encryption with Vault module agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/now-assist-vault-field-encryption-module.md) -- Use the field encryption with Vault module agentic workflow to encrypt specific fields and configure secure access to users with designated roles.\n  - [Use generative AI skills](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/using-now-assist-vault.md) -- The ServiceNow Otto for Vault application includes the generative AI skills and features that enable you to streamline your administrative workload.\n    - [Generate a custom data pattern by using ServiceNow Otto for Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/generate-custom-data-pattern-now-assist-vault.md) -- Use the generate custom data pattern skill to create a custom regular expression data pattern from your description and add it as an active data pattern to your instance.\n    - [Check role access for an encrypted column with ServiceNow Otto for Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/check-role-access-now-assist-vault.md) -- Use the check role access for encrypted column skill to identify user roles that have access to encryption and decryption keys in your instance.\n    - [Schedule a Data Discovery job with ServiceNow Otto for Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/schedule-data-discovery-job-now-assist-vault.md) -- Use the schedule data discovery job skill to schedule one-time or recurring Data Discovery jobs with ServiceNow Otto for Vault. Data Discovery jobs can detect sensitive data such as PII or PHI provided as input to the Azure OpenAI model.\n  - [ServiceNow Vault console dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/vault-dashboard.md) -- Use the ServiceNow Vault console dashboard to track and manage your ServiceNow Vault security tools.\n    - [Tools and metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/vault-tools.md) -- Learn about the tools and metrics ServiceNow Vault uses to protect and discover sensitive data.\n    - [Default policies and configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/vault-default-policies-configs.md) -- ServiceNow Vault has a set of ready-to-use policies and configurations for selected tools to help you get started quickly.\n- [ServiceNow Otto for Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/now-assist-vault-landing.md) -- With ServiceNow Otto for Vault, you can generate custom data patterns, check role access for an encrypted column, and schedule data discovery jobs. ServiceNow Otto for Vault can make it easier for you to perform common tasks without going to multiple systems.\n- [Platform Security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platsec-sublanding.md) -- Platform security provides capabilities to secure the instance.\n  - [Security Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sec-center-v2.md) -- ServiceNow Security Center is an application that consists of a set of tools designed to help your organization maintain the security of your ServiceNow deployments. Using Security Center, you can improve security posture and strengthen compliance levels with a seamless user experience.\n    - [Security Center landing page](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sec-center-landing.md) -- Use the Security Center landing page to find the information and tools you need to secure your instance.\n    - [Security Tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/security-task-manager.md) -- Use Security Tasks to monitor, prioritize, and assign all your security-related tasks in one place.\n      - [Automatic Security Task generation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/auto-sec-task.md) -- Learn about how and when your instance generates Security Tasks.\n      - [Edit Security Tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/create-edit-security-tasks.md) -- Learn how to create, edit, delete, or export Security Tasks in Security Center\n      - [Export Security Tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/export-security-tasks.md) -- Export Security Tasks into files that you can download and use in other software.\n    - [Security posture console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sc-posture-console.md) -- Improve your ability to identify, respond to, and recover from security threats with comprehensive visibility and step-by-step instructions.\n      - [Security Best Practices](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/security-best-practices-manager.md) -- Use Security Best Practices to implement privacy and security configuration tasks on your ServiceNow instance.\n        - [Complete a best practice](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/complete-a-security-best-practice-on-your-servicenow-instance.md) -- Complete a security best practice to implement security configurations on your ServiceNow instance.\n        - [View activity of a best practice](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/view-activity-of-a-best-practice.md) -- Track the chronological and timestamped history related to a security best practice that you're completing on your ServiceNow instance, along with the user that initiated the activity.\n        - [View data of completed best practices](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/view-statistics-of-completed-best-practices.md) -- See visual representations of the total amount of best practices completed, or segmented by maturity level.\n        - [Filter the security best practices table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/apply-filters-to-the-security-best-practices-table.md) -- Apply filters to return more relevant results for your security best practices.\n          - [Save a filter for future use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/apply-filters-to-the-security-best-practices-table.md) -- Apply filters to return more relevant results for your security best practices.\n          - [Use a saved filter](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/apply-filters-to-the-security-best-practices-table.md) -- Apply filters to return more relevant results for your security best practices.\n        - [Best Practices](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/best-practices.md) -- Learn details about the Best Practices in the Security Posture Console.\n      - [Security posture dashboards](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/scc-sec-posture-dashboard.md) -- Use the customizable single and multi-instance security posture dashboards to monitor your security KPIs. These dashboards consolidate the important information regarding the security of your instances in a single location and include a number of base system dashboard widgets.\n    - [Access Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/identity-and-access-management.md) -- Use the tools in the Access Management section verify that your data is only accessible to the users and processes that need it.\n    - [Security configuration console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/homepage.md) -- Use the security configuration page to get an overview of the security posture of your instance. View your hardening compliance score, discover graphical trends, analyze the top non-compliant hardening settings, and see the results of your security scans.\n      - [Security hardening](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sc-hardening.md) -- View your hardening compliance score, compare it with previous scores, and change settings to improve your compliance score and security posture in the security hardening page.\n        - [All settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/all-settings.md) -- Review all of your instance hardening settings available from a single page.\n          - [Hardening settings details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/hardening-settings-overview.md) -- Analyze the details of a hardening setting by selecting its link within the Security Center app.\n          - [Filter hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/ssc-working-list.md) -- Simplify your hardening review process using filters. These filters can create a working list of hardening settings for review, which restored for later use and shared with other users.\n        - [Hardening compliance score trend](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/score-trend.md) -- View the trends of your hardening compliance score over time in a chart or table.\n          - [Increase score](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/increase-hardening-comp-score.md) -- Increase your hardening compliance score by ensuring that the hardening settings are compliant with the system's recommendations.\n        - [Hardening score comparison](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/hardening-score-comparison.md) -- Gain visibility to the health of your hardening settings and use this data to improve the security posture of your instance.\n      - [Security scanner](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sc-scanning.md) -- Scan your instance against a set of security checks to identify misconfiguration. The scanner tool simplifies the process of creating different suites of checks for different use cases so that you can analyze the results over time.\n        - [Scan findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/scan-findings.md) -- A finding is a reference to a record that has violated a rule from a check on the instance. You can find the source record and additional information about the triggered rules, and how to resolve the finding.\n        - [Security scan comparison](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/score-comparison.md) -- Compare two scans of the same security suite to gain visibility to the health of your hardening settings and improve the security posture of your instance.\n        - [Scan findings trend](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sc-auditor-finding.md) -- Review Security Center scan findings over time.\n        - [Scan checks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/scan-checks.md) -- Use checks to detect anomalies within an instance, running against tables, records, or metadata.\n        - [Scan suites](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sec-center-suites.md) -- Review details on the scan suites available on your instance.\n          - [Access Controls Auditor checks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/auditor-control-checks.md) -- Learn about the checks available in the default Access Controls Auditor Suites, what criteria they evaluate, and how they can be used to improve the security of your instance.\n          - [Security Center Scan Suites](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/auditor.md) -- Use the Auditor suite to SecureCheck to detect misconfiguration that can impact the security posture of your instance.\n          - [Create a scan suite](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/create-new-suite.md) -- Create and schedule a custom suite so that you can analyze the security of your instance for your organization.\n            - [Clone the access controls auditor suite](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/clone-the-auditor-suite.md) -- Clone and customize the default access controls auditor suite in your instance to create a new suite tailored to your organization's security practices.\n            - [View the Access Controls Auditor Suite](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/view-access-controls-auditor-suites.md) -- View the checks available in the default Access Controls Auditor Suites to understand which checks are executed when this suite runs.\n          - [Reschedule a scan suite](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/reschedule-suite-scan.md) -- Change the schedule of your scan suites to suit your needs.\n        - [Scan results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/scan-results.md) -- View data related to your scan results from a single view.\n      - [Customer Actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/critical-updates.md) -- Use the Customer Actions tool to implement important security updates based on your instance and the configuration of plugins.\n        - [Implement Customer Actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/implement-steps-for-critical-updates.md) -- Learn how to implement Customer Actions on your instance to increase its security posture.\n        - [View Customer Actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/view-activity-of-critical-updates.md) -- See details of all of the activity related to your Customer Actions.\n    - [Security monitoring console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sc-monitor-console.md) -- Supervise security notifications and metrics to stay informed about potential security risks on your instance.\n      - [Security Event Notifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/security-policies.md) -- View, manage, and analyze the default security event notification policies on your ServiceNow instance, as well as access the functionality to create custom policies.\n        - [Create custom policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/create-a-policy.md) -- Create custom security event notifications for your organization to monitor user and group actions and generate alerts for potential security risks.\n        - [Modify policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/modify-security-event-notification-policies.md) -- Modify the settings of your security event notification policies to align with your organization's requirements.\n        - [Configure policy preferences](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/configure-preferences-for-security-event-notifications.md) -- Discover how to customize security event notification policies in Security Center to align with your organization's specific needs.\n          - [Create custom email](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/create-custom-email-for-security-event-notifications.md) -- Create a custom email for security event notifications to configure triggers, define recipients, and craft email content with dynamic event fields.\n        - [Security Event Notifications history](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/security-event-notifications-history.md) -- Explore the complete history of security event notifications on your instance.\n      - [Security metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sc-metrics.md) -- Monitor over 50 different Security Metrics to identify potential security threats or insecure behaviors. Set thresholds for email notifications, visualize, and analyze the data in multiple ways. Export the data, or create dashboards with the metrics that are most important to your organization.\n        - [Customize the dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/customize-my-security-metrics-dashboard.md) -- Customize the My security metrics dashboard with metrics from various sources like graphs and charts to suit your organization's specific requirements.\n        - [Configure email notifications on threshold triggers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/configure-security-metrics-to-send-emails-for-thresholds.md) -- Learn how to configure Security Metrics so that your instance generates an email notification when a threshold is triggered.\n        - [All Security Metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/all-security-metrics.md) -- Navigate to All Security Metrics to view a table with the data related to the Security Metrics of your instance.\n        - [Active Sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sc-active-sessions.md) -- View the trend line of the active users on the ServiceNow AI Platform.\n        - [Adaptive authentication Security Metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sc-adaptive-authentication.md) -- Use authentication policies to evaluate authentication requests and deny or allow access to your instance based on the specified policy conditions.\n        - [Antivirus](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/antivirus.md) -- Displays the trend of when events occur on potentially infected files. See when they are discovered, placed into quarantine, restored, or deleted.\n        - [Authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/sc-metrics-authentication.md) -- View trends for metrics related to authentication schemes, such as Multi-Factor Authentication(MFA) use, web service accounts, and biometric scanner usage.\n        - [Data Classification](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/data-classification-security-metrics.md) -- Access the Security Metrics for data classification on your ServiceNow instance.\n        - [Authentication metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/authentication.md) -- View metrics related to authentication on your instance from a dashboard.\n        - [Email](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/email.md) -- Displays data related to spam emails that are being received externally.\n        - [Export](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/export.md) -- Discover the data that is commonly exported, and which users do the exporting.\n        - [Integration Accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/integration-accounts.md) -- View the trends about the integration accounts that are created on the ServiceNow AI Platform.\n        - [Privileged Identity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/privileged-identity.md) -- Analyze data related to metrics for users with privileged identity.\n        - [Privileged Users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/privileged-users.md) -- View the trend line for the privileged users (active and inactive) and their activity on the ServiceNow AI Platform.\n        - [Session management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/session-management.md) -- View metrics related to user sessions and the frequency of lockouts of the sessions.\n        - [Users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/users.md) -- View the trend line for total users (active and inactive) and their activity on the ServiceNow AI Platform.\n    - [Security learning](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/learning.md) -- Access security learning materials from a single page.\n    - [ServiceNow Security Center announcements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/scc-banner.md) -- Enable security banner announcements and notifications to stay informed about urgent and critical security alerts using high visibility banners visible to administrators within the instance UI.\n    - [Granular roles for Security Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-center/granular-sc-roles.md) -- Use the new Security Center admin role to grant users security center administrative capability without using the admin role.\n  - [Hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/security-hardening-settings.md) -- The ServiceNow Security Center (SSC) hardening settings content contains detailed descriptions and compliance values for the security-related system properties and plugins in the ServiceNow AI Platform. You can set these properties using the hardening settings app in the Security Center.\n    - [Baseline versions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/hardening-settings-baseline.md) -- Explore how baseline versions for hardening settings align with family and store releases.\n      - [New hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/hardening-settings-new.md) -- New hardening settings are broken out by baseline release.\n        - [Baseline version 8.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/new-hardening-settings-for-baseline-eight.md) -- New hardening settings have been released with Security Center baseline version 7.0.\n        - [Baseline version 7.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/new-hardening-settings-for-baseline-seven.md) -- New hardening settings have been released with Security Center baseline version 7.0.\n        - [Baseline version 6.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/new-hardening-settings-for-baseline-six.md) -- New hardening settings have been released with Security Center baseline version 6.0.\n        - [Baseline version 5.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/new-hardening-settings-for-baseline-five.md) -- New hardening settings have been released with Security Center baseline version 5.0.\n        - [Baseline version 4.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/new-hardening-settings-for-baseline-four.md) -- New hardening settings have been released with Security Center baseline version 4.0.\n        - [Baseline version 2.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/new-hardening-settings.md) -- New hardening settings have been released with Security Center baseline version 2.0.\n      - [Updated hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/hardening-settings-updated.md) -- Updated hardening settings are broken out for each baseline release.\n        - [Baseline version 8.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/updated-hardening-settings-for-baseline-version-eight.md) -- Some hardening settings have been updated with the release of Security Center baseline version 8.0.\n        - [Baseline version 7.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/updated-hardening-settings-for-baseline-version-seven.md) -- Some hardening settings have been updated with the release of Security Center baseline version 7.0.\n        - [Baseline version 6.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/updated-hardening-settings-for-baseline-version-six.md) -- Some hardening settings have been updated with the release of Security Center baseline version 6.0.\n        - [Baseline version 5.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/updated-hardening-settings-for-baseline-version-five.md) -- Some hardening settings have been updated with the release of Security Center baseline version 5.0.\n        - [Baseline version 4.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/updated-hardening-settings-for-baseline-version-four.md) -- Some hardening settings have been updated with the release of Security Center baseline version 4.0.\n        - [Baseline version 2.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/updated-hardening-settings.md) -- Some hardening settings have been updated with the release of Security Center baseline version 2.0.\n      - [Deleted hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/hardening-settings-deleted.md) -- Some hardening settings are removed from Security Center baselines.\n        - [Baseline version 8.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/deleted-hardening-settings-for-baseline-version-eight.md) -- Some hardening settings have been removed with the release of Security Center baseline version 8.0.\n        - [Baseline version 7.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/deleted-hardening-settings-for-baseline-version-seven.md) -- Some hardening settings have been removed with the release of Security Center baseline version 7.0.\n        - [Baseline version 6.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/deleted-hardening-settings-for-baseline-version-six.md) -- Some hardening settings have been removed with the release of Security Center baseline version 6.0.\n        - [Baseline version 5.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/deleted-hardening-settings-for-baseline-version-five.md) -- Some hardening settings have been removed with the release of Security Center baseline version 5.0.\n        - [Baseline version 4.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/deleted-hardening-settings-for-version-four.md) -- Some hardening settings have been removed with the release of Security Center baseline version 4.0.\n        - [Baseline version 2.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/deleted-hardening-settings.md) -- Some hardening settings have been removed with the release of Security Center baseline version 2.0.\n    - [Access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-access-control.md) -- The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.\n      - [Anti-CSRF token validation time](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-anti-csrf-token-validation-time.md) -- The glide.security.csrf_previous.time_limit property specifies the time in seconds for a secure token to expire.\n      - [Apply domain separation on dot walked fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-apply-domain-separation.md) -- The glide.sys.domain.include_domain_condition_on_join property controls whether join queries are given domain separated conditions or not in order to ensure they apply domain separation functionality for dot walked fields.\n      - [Block access for delegated developers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-block-access-for-delegated-developers.md) -- This configuration affects access for delegated developers that are updating user roles through script. When the configuration is compliant, the developer will not be able to update or insert records into the sys_user_has_role table without also having the user_admin role.\n      - [Block Expired Anti-CSRF Tokens](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-block-expired-csrf-tokens.md) -- Block expired CSRF tokens to prevent cross-site request forgery attacks.\n      - [Check UI action conditions before execution](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-check-ui-action-conditions-before-execution.md) -- Use the glide.security.strict.actions property to enable checking of UI actions conditions in forms and lists before they execute. When you set this property to true, it adds an extra layer of validation on the table UI actions before they are executed.\n      - [Configure event management assignment group admin roles [New in Security Center 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-configure-event-management-assignment-group-admin-roles.md) -- Use the evt_mgmt.connector_assignment_group_admin_roles property to set which roles are authorized for admin access over the assignment group field in connector instances.\n      - [Configure Service Portal Widgets Allow List](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-configure-service-portal-widgets-allow-list.md) -- Learn how to configure the glide.service_portal.widget.allow_list property securely so that the access control lists (ACLs) for the tables do not expose sensitive information.\n      - [Configure Service Portal Widgets Table Allow List](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-configure-service-portal-widgets-table-allow-list.md) -- Learn how the glide.service_portal.widget.table_allow_list property enhances security by listing tables accessible to unauthenticated users through Service Portal widgets, dependent on additional checks and specific glide property settings.\n      - [Configure Unique MID Server Users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-configure-unique-mid-server-users.md) -- Use unique user account for each of your MID Servers to promote auditability and security controls as well as least privilege access.\n      - [Deny internal access to explicit external roles [Updated in Security Center 1.3 and 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-explicit-roles-internal-denylist.md) -- Use system properties to determine whether external users can be assigned the snc_internal role.\n      - [Deny unauthorized access to request items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-deny-unauthorized-access-to-request-items.md) -- The glide.sc.req_for.roles.default property defines a default behavior for the retrieveAddress API.\n      - [Display recommendations for high risk UI pages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-display-recommendations-for-high-risk-ui-pages.md) -- Decrease the likelihood of authorization errors, and unintended information disclosure by displaying recommendations for high risk UI pages.\n      - [Disable Adding Default Roles to Skill ACLs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-adding-default-roles-to-skill-acls.md) -- Use system properties to control what roles are automatically added to generative AI skill ACLs.\n      - [Disable inbound emails for locked out users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-inbound-emails-locked-out-users.md) -- Use the glide.pop3.process_locked_out property to control inbound email actions for locked out, active users.\n      - [Disable Voice Chat Guest Impersonation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-voice-chat-guest-impersonation.md) -- Use a system property to ensure that voice interactions/conversations are recorded under the appropriate internal integration user.\n      - [Double check inbound transactions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-double-check-inbound-transactions.md) -- Use the glide.security.strict.updates property to enable double-checking of security on inbound transactions during form submission. When you set this property to true, it adds an extra layer of table validation before a form renders in the browser.\n      - [Enable scoped admin application ACLs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-administer-scoped-admin-application-acls.md) -- The glide.security.scoped_administration.honor_global_acl determines whether an application administration app can inherit global access control list (ACL) rules.\n      - [Enable work order management query rules for service organizations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-work-order-management-query-rules.md) -- Use the sn_fsm.use_query_rules property to apply rules and filters to the Field Service Management tables.\n      - [Enable ACLs to Control Live Profile Details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-acls-to-control-live-profile-details.md) -- Use the glide.live_profile.details property to designate whether a user should be able to view all detail fields, such as company name and phone numbers, in a live profile.\n      - [Enable ACLs for Encoded Query in Simple List Widget](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-acls-for-encoded-query-in-simple-list-widget.md) -- Learn how to set the glide.service_portal.enable_acls_for_encoded_query_in_list property to the secure value to prevent users from bypassing access control list (ACL) evaluations on a query condition in the Simple List Widget.\n      - [Enable Guardian for External Agents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-guardian-for-external-agents.md) -- Use a system property to protect your Language Learning Models (LLMs) with Guardian.\n      - [Enable Anti-CSRF token [New in Security Center 1.3, updated in 1.5, and removed in 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-anti-csrf-token.md) -- Use the glide.security.use_csrf_token property to ensure the use of a secure token to identify and validates incoming requests, which in turn are used to prevent these attacks.\n      - [Enforce credential alias usage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-credential-alias-usage.md) -- Learn how to secure your credentials from unauthorized use by configuring the MID Server property.\n      - [Enable contextual security plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-contextual-security-plugin.md) -- Activate the Contextual Security Plugin (com.glide.role_management) plugin to enable contextual security, which secures a record/information using create, read, write, and delete functionality.\n      - [Enforce credential alias usage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-credential-alias-usage.md) -- Learn how to secure your credentials from unauthorized use by configuring the MID Server property.\n      - [Enable Cross Scope Privilege Checks on Service Portal Form [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-cross-scope-privilege-checks-on-service-portal-form.md) -- Use a system property to enforce cross scope privilege checks on the Service Portal form widget and prevent unauthorized retrieval of forms and table data between scopes.\n      - [Enable policy based session access for mobile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-policy-based-session-access-for-mobile.md) -- Use the The Zero Trust- Policy Based Session Access plugin to control if users authenticating through a mobile app will have their roles reduced.\n      - [Enable Role Masking for Agents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-role-masking-for-agents.md) -- Use a system property to enable the role masking feature.\n      - [Enable multiple (permission policy and boundary) checks to ensure that the Role is privileged in AWS/Bedrock](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-multiple-permission.md) -- Use a system property to determine what checks are used to verify whether a role is allowed to perform a privileged operation.\n      - [Enable report view ACLs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-report-view-acls.md) -- Manage a check for report_view ACLs of published reports.\n      - [Enforce ACL on HR Lifecycle Events Data [New in Security Center 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-acl-on-hr-lifecycle-events-data.md) -- Learn how to prevent unauthorized access to data in the Human Resources Lifecycle Events application by verifying that the glide.enforce_security_scope.sn_hr_le property is set to the secured value.\n      - [Enforce ACL on HR Core Data [New in Security Center 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-acl-on-hr-core-data.md) -- Learn how to configure the glide.enforce_security_scope.sn_hr_core property so that the Human Resources Scoped App: Core (com.sn_hr_core) plugin does not expose sensitive data to access control lists (ACLs) from all other scopes.\n      - [Enforce ACL on HR Virtual Agent Data [New in Security Center 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-acl-on-hr-virtual-agent-data.md) -- Discover how to set the glide.enforce_security_scope.sn_hr_va property to a secure value, preventing data leakage from the Virtual Agent Conversations scoped application.\n      - [Enforce application specific ACLs only for application data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-application-specific-acls-only-for-application-data.md) -- Avoid unauthorized or undesired access to application data by enforcing application-specific access control lists (ACLs) only for application data.\n      - [Enforce application scope restrictions [New in Security Center 1.3 and removed in 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-application-scope-restrictions.md) -- Use the glide.record.legacy_cross_scope_access_policy_in_script property to control the permissions of scoped apps.\n      - [Enforce field-level ACLs on records created from the query string of the Filtered List view UI of a table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-field-level-acls-on.md) -- Use a system property to prevent list filters from affecting the initial values of created records.\n      - [Enforce Read Roles for Catalog Variable Search [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-read-roles-for-catalog-variable-search.md) -- Use system properties to ensure that only catalog variables with an empty read role are indexed for search.\n      - [Enforce security rules to sharing dashboards](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-security-rules-to-sharing-dashboards.md) -- Use the glide.cms.dashboards.sharing_with_secure_search property to control whether users can share dashboards.\n      - [Enforce scope security for public sector digital services [New in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-scope-security-for-public-sector-digital-services.md) -- Use the glide.enforce_security_scope.sn_gsm property to control how the application data from the Public Sector Digital Services application is accessed.\n      - [Enforce scoped ACL access for information request playbooks [New in Security Center 1.3 and updated in 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-scoped-acl-access-for-information-request-playbooks.md) -- Use the glide.enforce_security_scope.sn_gsm_info_req property to control access to playbook data for the Information Request playbooks feature.\n      - [Enforce strict elevate privilege](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-strict-elevate-privilege.md) -- Use the glide.security.strict_elevate_privilege property to control whether roles marked as privileged must be manually elevated for the user to be granted the role's capabilities.\n      - [Enforce security scope license and permit playbook [New in Security Center 1.5 and updated in 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-security-scope-license-and-permit-playbook.md) -- Use this property to determine if only the access control lists (ACLs) within the License and Permit plugin will be used in determining access to the scope, or if ACLs from all scopes will be considered.\n      - [Enforce Security Scope for Agent Workspace for HR Case Management [New in Security Center 1.5 and updated in 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-security-scope-for-agent-workspace-hr-case.md) -- Configure the Agent Workspace for HR Case Management plugin so that data in scope master tables can only be accessed by users with the correct permissions, enforcing the principle of least privilege.\n      - [Enforce Security Scope for Service Application Information [New in Security Center 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-security-scope-for-service-application-information.md) -- Use the glide.enforce_security_scope.sn_svc_appl property to ensure that the data in master scope tables is secured.\n      - [Enforce Scope Access Controls on New Tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-scope-access-controls-on-new-tables.md) -- Use a system property to enforce cross-scope access checks for newly created tables.\n      - [Enforce field level ACLs in GlideRecordSandbox](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-field-level-acls-in-gliderecordsandbox.md) -- Manage field level ACLs in GlideRecordSandbox on your instance.\n      - [Enforce GroupBy ACLs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-groupby-acls.md) -- Configure your instance to conduct ACL checks on groupby columns.\n      - [Ensure archive table ACLs are checked](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-ensure-archive-table-acls-are-checked.md) -- The glide.security.enable_archive_table_acls property controls whether access control lists (ACLs) of the original table, the table the archive table was created from, are evaluated to false.\n      - [Ensure dashboards creation/deletion requires access check [New in Security Center 1.3 and updated in 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-ensure-dashboards-creation-deletion-requires-access-check.md) -- The glide.processors.check_access_before_process system property enables access control list (ACL) enforcement for creating or deleting dashboards when a user is logged in.\n      - [Ensure MID Server Users Have Appropriate Access Levels](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-ensure-mid-server-users-have-appropriate-access-levels.md) -- Verify that your MID Server user accounts does not have more the necessary granted permissions.\n      - [Exclude Sensitive Tables and Fields from Data Generation [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-exclude-sensitive-tables-and-fields-from-data-generation.md) -- Use system properties to exclude tables and fields from Data Generation, which is used to generate fake data sets based on existing data. Tables and fields that are added to these exclusion lists can't be used for Data Generation feature.\n      - [Prevent Users From Accepting Warning To Bypass CSRF Validation [Updated in Security Center 1.3 and 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-csrf-strict-validation.md) -- Use the glide.security.csrf.strict.validation.mode property to enable CSRF token strict validation. If the CSRF token doesn't match, it prevents resubmission of the request.\n      - [Restrict allowed domains for cross-origin iframe communication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-url-allowlist-for-cross-origin-iframe-communication.md) -- Use a system property to enable cross-origin communication between iframes.\n      - [Restrict delegated developers read access [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-delegated-developers-read-access-allowlist.md) -- If com.glide.dd_allow_global_access_tables does not contain the recommended value of wf_activity, wf_activity_definition, wf_workflow, wf_workflow_version, sp_portal, sp_widget, and sp_page, then those tables could be read by a delegated developer. This could provide the delegated developer read access to sensitive information.\n      - [Require AJAXGlideRecord ACL checking](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enabling-ajaxgliderecord-acl-checking.md) -- Use the glide.script.secure.ajaxgliderecord property to perform access control rule (ACL) validation when server-side records, such as tables, are accessed using GlideAjax APIs within a client script.\n      - [Restrict write access on system fields to admin users [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-write-access-on-system-fields-to-admin-users.md) -- Use the glide.rest.table_api.admin_only_sys_fields system property to control write access the fields generated by the system.\n      - [Require Multi-Factor Authentication for AI Voice Agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-require-multi-factor-authentication-for-ai-voice-agent.md) -- Use a system property to control whether Multi-Factor Authentication (MFA) is required for the AI voice agent authentication feature.\n      - [Require approval for agent-based Office 365 group membership changes [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-require-approval-for-agent-based-office-365-group-membership-changes.md) -- Enable the approval flow for adding or removing Office 365 group members through the Microsoft 365 group membership AI Agent using a system property.\n      - [Prevent impersonating user from viewing application data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-prevent-impersonating-user-from-viewing-application-data.md) -- Use system properties to prevent an impersonating user from viewing application data.\n      - [Enforce oauth state parameter validation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-oauth-state-parameter-validation.md) -- Configure the glide.oauth.state.parameter.required property to prevent your instance from cross-site request forgery (CSRF) attacks.\n      - [Enforce Strict User Image Upload](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-strict-user-image-upload.md) -- Use the glide.security.strict.user_image_upload property to enable Access Control for the upload/update of a profile picture when performed on a user record.\n      - [Restrict email domains for external user registration [Updated in Security Center 1.3, 1.5, and 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-external-user-registration-email-domain-allowlist.md) -- Use the sn_ext_usr_reg.allowed_email_domains property to list acceptable external email domains.\n      - [Enable High Security Plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-high-security-plugin.md) -- When you activate the High Security plugin, it creates or updates hundreds of different configurations to control the level of security on your instance. These configurations mitigate many of the top OWASP attacks by enabling strict access control, input validation, and output encoding.\n      - [Honor admin override ACLs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-honor-admin-override-acls.md) -- The glide.security.admin.override.accessterm property controls whether an administrator can bypass an access rule when a resource (a table or a field) has multiple access rules.\n      - [Prevent inactive users from logging in](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-prevent-inactive-users-from-logging-in.md) -- Configure this property to control if inactive users can authenticate on your instance.\n      - [Prevent Unauthenticated Access to Virtual Agent Embedded Web Client](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-publicly-exposed-virtual-agent-embedded-web-client.md) -- Learn how to configure the sn_va_web_client_app_embed table to block unauthenticated users from accessing embedded web clients.\n      - [Restrict JSONP Requests to Trusted URLs [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-jsonp-requests-to-trusted-urls.md) -- Specify trusted URLs for the AngularJS $http service to allow or reject JSONP requests.\n      - [Prevent users from accepting warning to bypass CSRF validation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-prevent-users-from-accepting-warning-to-bypass-csrf-validation.md) -- Reduce the risk of Cross-Site Request Forgery (CSRF) by preventing users from accepting warning to bypass CSRF validation.\n      - [Disable raw database query execution [Updated in Security Center 1.3 and removed in 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-operation-level-access-control-requirements.md) -- Control whether a user can perform raw SQL queries on the database.\n      - [Hide user comments on articles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-hide-user-comments-on-articles.md) -- Use the glide.knowman.show_user_feedback property to control whether feedback comments are visible.\n      - [Require authentication by default for client-callable script includes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-privacy-on-client-callable-script-includes.md) -- By default, client-callable script includes that do not explicitly set visibility, are public. If needed, add the glide.script.ccsi.ispublic property to enable privacy control over all client-callable script includes accessed by public pages.\n      - [Enforce production instance behavior](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-production-instance-behavior.md) -- Configure whether your instance should be handled like a production or non-production instance.\n      - [Restrict access to background script](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-access-to-background-script.md) -- Use a system property to set a role requirement for accessing the Script Background module.\n      - [Restrict access to emails with empty target table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-access-to-emails-with-empty-target-table.md) -- Activate the glide.email.email_with_no_target_visible_to_all property to restrict user access to emails, unless they were the one who sent the email or have an admin role.\n      - [Restrict MID Server Users from Authenticating via the UI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/restrict-mid-server-users-from-authenticating-via-the-ui.md) -- Reduce risk from a compromised MID Server account by disallowing UI authentication\n      - [Restrict access to specific IP ranges plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-access-to-specific-ip-ranges-plugin.md) -- Use the com.snc.ipauthenticator plugin to restrict access to specific IP ranges. Unless public access is intended for the instance, administrators should limit access to their assigned IP net blocks.\n      - [Restrict knowledge bases access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-knowledge-bases-access.md) -- The glide.knowman.block_access_with_no_user_criteria property is used to control the read/write access of users on knowledge based articles.\n      - [Restrict permissions for CMDB model](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-permissions-cmdb-model.md) -- Use the csm_cmdb_model.customer_visible_flag system property to limit customer access to data in the Product Models table as an additional access control to the CMDB model.\n      - [Restrict unauthenticated access to attachments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-unauthenticated-access-attachments.md) -- Restrict unauthenticated access to image attachments using a system property.\n      - [Restrict access to custom journal entries [Updated in Security Center 1.3 and removed in 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-secure-custom-journal-entries.md) -- Use the glide.live_feed.custom_journal.acl_check_enabled property to respect ACL's on custom journal fields.\n      - [Restrict flow context read access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-flow-context-read-access.md) -- Use the com.snc.process_flow.reporting.require_flow_access property to enforce if an additional access check is required for a user to read a flow check.\n      - [Restrict Impersonation to Admin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-impersonation-to-admin.md) -- The glide.sys.permissive.impersonate property can be used to prevent non-admin roles from impersonating other users.\n      - [Enable security jump start plugin (ACL Rules)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-security-jump-start-plugin-acl-rules.md) -- Activate the Security Jump Start (ACL Rules) (com.snc.system_security) plugin to create several important ACLs that validate the Access Controls on some of the key system tables within the ServiceNow AI Platform.\n      - [Use of secure insert multiple operation within import set API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-use-of-secure-insert-multiple-operation-within-import-set-api.md) -- Use the com.glide.import_set_api.insert_multiple_optimize property to control whether GlideRecordSecure or GlideRecord is used for the Insert Multiple operation within the Import Set API.\n      - [Enforce SOAP request strict security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-soap-request-strict-security.md) -- Use the glide.soap.strict_security property to enforces web service security.\n      - [Required JMS connection factories](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-required-jms-connection-factories-plugin-applicability-mid-server.md) -- The mid.property.jms.command.allowed_factory_names property controls the Java Messaging Service (JMS) connection factories that the MID Server can use.\n      - [Restrict Global App Development by Role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-global-app-development-by-role.md) -- Use the sn_g_app_creator.allow_global property to control which users can create applications in the global scope using the Guided Application Creator.\n      - [Review extraneous explicit role access control conditions [Removed in Security Center 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-review-extraneous-explicit-role-access-control-conditions.md) -- The Explicit Roles plugin is recommended to mandate that all users have either the snc_internal role to access internal resources, or the snc_external role to access external resources.\n      - [Specify URL allow list for cross-origin iframe communication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-specify-url-allow-list-for-cross-origin-iframe-communication.md) -- Use a system property to specify which domains you trust for cross-origin communication.\n      - [Set guest user for soap requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-set-guest-user-for-soap-requests.md) -- Configure this property to control the level of access of unauthenticated SOAP requests.\n      - [Disable public access to favorites [Updated in Security Center 1.3 and 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/public-access-favorites.md) -- Use the glide.ui.magellan.favorites.allow_public to specify whether unauthenticated users are allowed to see Favorites in the navigator.\n      - [Enable SNC access control plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-snc-access-control-plugin.md) -- Activate the SNC Access Control (com.snc.snc_access_control) plugin to control access to your instances by Customer Service and Support personnel.\n      - [Use Document Classification to limit publicly accessible documents [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-use-document-classification-to-limit-publicly-accessible-documents.md) -- Control public access to permalinked documents using system properties.\n      - [Validate query ACLs on Glide DB functions [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/validate-query-acls-on-glide-db-functions.md) -- Control whether query ACLs are applied to Glide DB functions using system properties.\n    - [API and web service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-api-web-service.md) -- The API and Web Service category ensures that applications have appropriate authentication, authorization and session management, validate all input that traverses a trust boundary and include security controls for all API types.\n      - [Validate SOAP content type](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-soap-content-type-checking.md) -- Use the glide.soap.require_content_type_xml property to enable validation of a content type as text/xml and protect against invalid SOAP requests.\n      - [Prevent OAuth Clients from Using Implicit Grant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-prevent-oauth-clients-from-using-implicit-grant.md) -- Use a system property to avoid the use of the implicit grant type.\n      - [Require authorization for PDF requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-require-authorization-for-pdf-requests.md) -- Use the glide.basicauth.required.pdf property to designate if incoming PDF requests should require basic authentication.\n      - [Require Authentication on Event Management HTTP Processor [New in Security Center 1.3, Updated in 1.5, and removed in 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-require-authentication-on-event-management-http-processor.md) -- Learn how to establish secure basic authentication for inbound Amazon Simple Notification Service (SNS) requests when the Event Management plugin (com.glideapp.itom.snac) is enabled.\n      - [Require authorization for SOAP requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-soap-request-authorization.md) -- Use the glide.basicauth.required.soap property to designate if incoming SOAP requests should require basic authorization.\n      - [Require authorization for unload requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-require-authorization-for-unload-requests.md) -- Use the glide.basicauth.required.unl (useUnloadFormat) property to designate if incoming unload requests should require basic authentication.\n      - [Require authorization for csv requests [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-require-authorization-for-csv-requests.md) -- Use the glide.basicauth.required.csv property to designate if incoming CSV (Comma-Separated Values) requests should require basic authentication.\n      - [Require authorization for excel requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-excel-request-authorization.md) -- Use the glide.basicauth.required.excel property to designate if incoming Excel requests should require basic authentication.\n      - [Require authorization for import requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-import-request-authorization.md) -- Use the glide.basicauth.required.importprocessor property to designate if incoming import requests should require basic authentication.\n      - [Require authorization for JSONv2 request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-jsonv2-request-authorization.md) -- Use the glide.basicauth.required.jsonv2 property to designate if incoming JSONv2 requests should require basic authorization.\n      - [Require authorization for WSDL request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-wsdl-request-authorization.md) -- Use the glide.basicauth.required.wsdl property to designate if incoming WSDL (Web Services Description Language) requests should require basic authentication.\n      - [Require authorization for XML requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-xml-request-authorization.md) -- Use the glide.basicauth.required.xml property to designate if incoming XML requests should require basic authentication.\n      - [Require authorization for XML output requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-xml-output-authorization.md) -- Configure this property so that basic authorization is required for all inbound XMLOutputProcessor requests.\n      - [Require Authorization for XSD Requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-xsd-request-authorization.md) -- Use the glide.basicauth.required.xsd property to designate if incoming XSD (XML Schema Definition) requests should require basic authentication.\n      - [Require authorization for script requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-script-request-authorization.md) -- Use the glide.basicauth.required.scriptedprocessor property to designate if incoming script requests should require basic authentication.\n      - [Require authorization for SCHEMA requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-schema-request-authorization.md) -- Use the glide.basicauth.required.schema property to require basic authorization for all Inbound Table Schema Processor requests.\n      - [Require authorization for RSS requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-rss-request-authorization.md) -- Use the glide.basicauth.required.rss property to designate if incoming RSS requests should require basic authentication.\n      - [Require authorization for API requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-api-request-authorization.md) -- Use the glide.basicauth.required.api property to enhance security for basic authorization for incoming REST requests.\n    - [Architecture, design, and threat modeling](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-architecture-design-threat-molding.md) -- This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.\n      - [Check impersonation on ACL evaluation in HR App [New in Security Center 1.3 and updated in 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-check-impersonation-on-acl.md) -- Use the sn_hr_core.impersonateCheck property to prevent a user from impersonating another user and accessing their HR information.\n      - [Reduce the Scope of the IP Allow List for an Instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-ip-addresses-access-allowlist.md) -- Use the glide.ip.authenticate.strict property to specify IP ranges that can make inbound connections on an instance.\n      - [Disable legacy JQuery behavior](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-legacy-jquery-behavior.md) -- The glide.jquery.legacy is used to prevent older prepatched JQuery versions from being used which will introduce unpatched vulnerabilities in the library.\n      - [Disable GlideRecord Scope Fencing Legacy Behavior](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-gliderecord-scope-fencing-legacy-behavior.md) -- The glide.record.legacy_cross_scope_access_policy_in_script property disables scope fencing allowing scoped apps to access global script interfaces. It was created as a patch to GlideRecord's cross scope access.\n      - [Disable legacy AngularJS behavior [Removed in Security Center 2.2]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-legacy-angularjs-behavior.md) -- Use the glide.angular.legacy property to protect from potential security risks arising from attacks on vulnerabilities discovered in outdated AngularJS library versions.\n      - [Disable local login for users with Single Sign-On (SSO) enabled](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-local-login-for-users-with-single-sign-on-sso-enabled.md) -- Update user records to disable local login for users with Single Sign-On (SSO) enabled.\n      - [Disable unauthenticated published reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-unauthenticated-published-reports.md) -- Deactivate this property to prevent the user from publishing or accessing reports. This property disables the published reports feature in reporting.\n      - [Disable public access to favorites](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-public-access-to-favorites.md) -- Use the glide.ui.magellan.favorites.allow_public to specify whether unauthenticated users are allowed to see Favorites in the navigator.\n      - [Enforce field ACLs for inbound query requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-field-acls-for-inbound-query-requests.md) -- Manage how incoming queries are validated on your instance.\n      - [Enforce read ACLs on report views](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-read-acls-on-report-views.md) -- Manage how Read ACLs are enforced on your instance.\n      - [Enable Anti-CSRF Token for Userperf](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-anti-csrf-token-for-userperf.md) -- Use a system property to ensure CSRF (Cross-Site Request Forgery) protection is enforced when setting user preferences.\n      - [Enforce Query ACLs for Knowledge Quick Links](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-query-acls-for-knowledge-quick-links.md) -- Enforce query ACLs for Knowledge Quick Links using a system property.\n      - [Enforce Query ACLs for SubLists, List Counts and Widget Data Tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-query-acls-for-sublists-list-counts-and-widget-data-tables.md) -- Enforce query ACLs on sublist, list count, and widget data table queries using system properties.\n      - [Enforce valid query string choice [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-valid-query-string-choice.md) -- Use a system property to ensure that any choice field value, when passed via a URL query string, is a valid active choice when a record is created.\n      - [Ensure An Instance is Allowed to Connect to Only Trusted IP Addresses](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-ensure-an-instance-is-allowed-to-connect-to-only-trusted-ip-addresses.md) -- Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.\n      - [Ensure only Trusted IP Addresses are Allowed to Connect to An Instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/performance-monitoring-ip-restriction.md) -- Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.\n      - [For Self-Hosted Instance, Ensure only Trusted IP Addresses are Allowed to Connect to An Instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-for-self-hosted-instance-en.md) -- Use system properties to control which inbound IP addresses can connect to self-hosted instances.\n      - [Require authorization for data broker rest API [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-data-broker-rest-api-authorization.md) -- Use the glide.basicauth.required.databrokerrestapiprocessor property to require basic authorization for all inbound Data Broker Rest API requests.\n      - [Restricted Binding functionality in case Bearer Authorization [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restricted-binding-functionality-in-case-bearer-authorization.md) -- Use a system property and restricted binding to ensure that an access token generated using that entity can’t be used for UI calls.\n      - [Deny by default with empty ACLs [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-security-manager-default-deny.md) -- Use the glide.sm.default_mode property to control the default behavior of security manager when it finds that existing Access Control List (ACL) rules are a part of wildcard table ACL rules.\n      - [Set Automatic Token Cleanup for Token Credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-set-automatic-token-cleanup-for-token-credentials.md) -- Use the com.snc.platform.security.token.auth.cleanup property to ensure that expired API keys and HMAC secrets are deleted, thereby limiting the potential for token reuse.\n    - [Authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-authentication.md) -- The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.\n      - [Activate role-based multi-factor authentication [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-activate-role-based-multi-factor-authentication.md) -- Use the glide.authenticate.multifactor property to enforce role-based multi-factor authentication (MFA) for all users assigned to specific roles.\n      - [Activate role based multi-factor authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-role-based-multi-factor-authentication.md) -- Use the glide.authenticate.multifactor property to enforce role-based multi-factor authentication (MFA) for all users assigned to specific roles.\n      - [Anti-CSRF token (instance security hardening)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/anti-csrf-token.md) -- Use the glide.security.use_csrf_token property to ensure the use of a secure token to identify and validates incoming requests, which in turn are used to prevent these attacks.\n      - [Control Lockout Time for Invalid Password Reset Attempts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-request-max-attempts-window.md) -- The password_reset.request.max_attempt_window property controls the number of minutes a user must wait to reset or change their password after exceeding the maximum number of unsuccessful attempts that is set with the password_reset.request.max_attempt property.\n      - [Disable creating users from incoming emails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-emails-by-domain.md) -- Use the glide.user.trusted_domain property to specify the comma-separated list of trusted domains used in the creation of users from incoming emails.\n      - [Disable resource owner password credentials (ROPC) in OAuth 2 token grants [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-resource-owner-password-credentials-ropc-in-oauth-2-token-grants.md) -- Prevent Resource Owner Password Credentials (ROPC) from granting OAuth 2 tokens.\n      - [Do not apply password policy at login [Updated in Security Center 1.5 and removed in 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-do-not-apply-password-policy-at-login.md) -- Manage how password complexity is handled in your instance.\n      - [Enable account recovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-account-recovery.md) -- The glide.sso.acr.enabled property controls the account recovery feature.\n      - [Enable CAPTCHA for customer registration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-captcha-for-customer-registration.md) -- Reduce the risk of requests by malicious bots by enabling CAPTCHA for customer registration.\n      - [Enable a deny-list password validation check](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-blacklisted-passwords-validation-check.md) -- Manage the deny-list passwords in the Excluded Password table.\n      - [Enable CAPTCHA for External User Registration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-captcha-external-user-registration.md) -- The sn_ext_usr_reg.captchaEnabled controls if CAPTCHA will be validated for external user registration.\n      - [Enable CAPTCHA in password reset](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-captcha-in-password-reset.md) -- Use the password_reset.captcha.ignore property to enable or disable requiring a CAPTCHA challenge when a user resets their password.\n      - [Enable email OTP for multi-factor authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-email-otp-for-multi-factor-authentication.md) -- Manage how two-factor authentication is applied on your instance.\n      - [Enable password reset policy checks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-password-reset-policy-checks.md) -- Use the glide.enable.password_policy property to enable password policy checks whenever a user changes their password using the user interface.\n      - [Enable relay state in SAML requests to prevent replay attacks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-relay-state-in-saml-requests-to-prevent-replay-attacks.md) -- Reduce the risk of replay attacks by enabling relay state in SAML requests to help prevent replay attacks.\n      - [Enable SMS code notification for enrollment and verification](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-sms-code-notification-for-enrollment-and-verification.md) -- The password_reset.sms.use_notify property controls the usage of SMS code notifications for password reset.\n      - [Enable SSL in LDAP authentication [Updated in Security Center 1.5 and 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-ssl-in-ldap-authentication.md) -- Manage the encryption of LDAP authentication requests on your instance.\n      - [Enforce current password policy compliance requirements on login](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-current-password-policy-compliance-requirements-on-login.md) -- Reduce the risk of brute force account login by enforcing current password policy compliance requirements on login.\n      - [Enforce device encryption and passcode requirements [New in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-device-encryption-and-passcode-requirements.md) -- The glide.sg.device_encryption_enabled property enforces the Federal Information Processing Standard (FIPS 140-2) Encryption. Mobile device encryption and passcode ensure that an unauthorized user cannot access the content of a device even if the device is physically obtained.\n      - [Limit Invalid Password Reset Attempts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-request-max-attempts.md) -- The password_reset.request.max_attempt is used to control the maximum number of unsuccessful attempts that a user can reset or change their password before being locked out for a specified period of time.\n      - [Limit Allowed Number of Failed Login Attempts Before Lockout](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-managing-failed-login-attempts.md) -- Two script actions are available that enable a site administrator to manage the number of times a user can provide an incorrect password before being locked out from the ServiceNow AI Platform. You can enable either of these script actions to manage failed login attempts.\n      - [Maximize failed login unlock timeout duration [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-managing-unlock-timeout-after-failed-logins.md) -- A script action is available that enables site administrators to manage the number of times a user can provide an incorrect password before being locked out from the ServiceNow AI Platform. You can enable this script action to manage failed login attempts.\n      - [Maximize reset password request retry window duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-request-retry-window.md) -- The password_reset.request.retry_window property controls the number of minutes before the count for password reset attempts refreshes.\n      - [Maximize reset password request unlock window duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-request-unlock-window.md) -- The password_reset.request.unlock_window property controls the number of minutes a user must wait to start a reset request after the last successful unlock account action.\n      - [Maximize reset password SMS complexity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-sms-complexity.md) -- The password_reset.sms.default_complexity property controls the minimum required SMS code verification size required during password reset.\n      - [Maximize reset password SMS pause window duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-sms-pause-window.md) -- Manage the time duration in minutes that a user must wait before they can request a new password reset code.\n      - [Maximize reset password verification delay duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-verification-delay.md) -- Configure the delay, in milliseconds, that a user must wait before submitting a new password reset request.\n      - [Minimize external user registration link expiration duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-external-user-registration-link-expiration.md) -- Manage the number of days that a registration link can be accessed.\n      - [Minimize reset password max SMS per day](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-max-sms-per-day.md) -- Manage the maximum number of SMS codes sent for verification per day by user.\n      - [Minimize failed login attempts for high assurance sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-minimize-failed-login-attempts-for-high-assurance-sessions.md) -- Decrease the likelihood of a brute force attack by minimizing failed login attempts for high assurance sessions.\n      - [Minimize reset password request expiration duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-request-expiration.md) -- The password_reset.request.expiry denotes the time period in minutes during which a user must perform the password reset process.\n      - [Minimize reset password request success window duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-request-success-window.md) -- The password_reset.request.success_window property controls the number of minutes a user must wait to reset or change their password again after successfully resetting the password. The user will be blocked to reset the password again for the specified duration.\n      - [Minimize reset password SMS expiry duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reset-password-sms-expiracy.md) -- Control the number of minutes remaining before the SMS code expires.\n      - [Minimize one-time out of band verifier lifetime duration [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-short-one-time-out-of-band-verifier-lifetime.md) -- Manage the time duration for out-of-band verifiers.\n      - [Minimize SAML notBefore or notOnOrAfter constraint duration [Updated in Security Center 1.3 and 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-saml-notbefore-or-notonorafter-constraint.md) -- Configure this property to add a grace period in which SAML requests and responses are considered valid.\n      - [Notify users during password reset/change process [Removed in Security Center 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-password-reset-change-notification-process.md) -- Use this property to enable end users to reset or change passwords using a self-service process.\n      - [Prohibit Use of KBA as Single Factor for AI Voice](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-prohibit-use-of-kba-as-single-factor-for-ai-voice.md) -- Use a system property to prevent Knowledge Based Authentication (KBA) from being the only factor of authentication required to authenticate to the platform for AI voice.\n      - [Reduce allowed bypasses for multifactor setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-reduce-allowed-bypasses-for-multifactor-setup.md) -- Decrease the window of time an account is at risk of compromise by reducing allowed bypasses for multifactor setup.\n      - [Remove credentials from Welcome page](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-remove-credentials-welcome-page.md) -- Modify the default content on the Welcome page to remove the default credentials.\n      - [Require CAPTCHA for guest walk-up experience in customer service application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-require-captcha-for-guest.md) -- The CAPTCHA for the Guest Walk-up experience prevents unauthenticated guest users to create bookings by requiring users to complete a CAPTCHA verification.\n      - [Require obfuscation of classic mobile app UI [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-classic-mobile-app-ui-obfuscation.md) -- Use the glide.ui.m.blur_ui_when_backgrounded property to obfuscate all fields from the snapshot as the image is saved during the backgrounding process.\n      - [Require obfuscation of mobile app UI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-mobile-app-ui-obfuscation.md) -- Configure the glide.sg.blur_ui_when_backgrounded property so that the UI of the app is blurred when the app is running in the background.\n      - [Require Minimum and Maximum Password Length](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-set-minimal-password-length.md) -- Set minimum and maximum password lengths to avoid compliance issues and reduce the risk of a successful brute force attack\n      - [Set OTP lifetime for password reset to 1 hour [Updated in Security Center 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-set-otp-lifetime-for-password-reset-to-12-hours-or-less.md) -- Control the time duration of the link in the password reset email.\n    - [Business Logic](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-business-logic.md) -- This category looks at the logic and flow unique to each application with general secure principles. Specifically ensure that the intended sequence of business logic flow cannot by bypassed, that limits exist to detect and prevent automated attacks, and that protections against spoofing, tampering, information disclosure and elevation of privilege attacks exist.\n      - [Limit max comments per user per day](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-max-comments-per-user-per-day.md) -- Configure the sn_kb_social_qa.max_comments_per_user_daily property to restrict the number of QA comments per day.\n      - [Limit max subscriptions per user per day](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-max-subscriptions-per-user-per-day.md) -- Configure the sn_kb_social_qa.max_subscriptions_per_user_daily property to limit the max number subscriptions a user can subscribe to in a day.\n      - [Minimize SMTP Recipient Quantity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-max-smtp-recipients.md) -- The glide.email.smtp.max_recipients specifies the maximum number of recipients the instance can list in the To: line for a single email notification.\n      - [Timeout Guest Sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-timeout-guest-sessions.md) -- Use a system property to control the inactive session timeout for unauthenticated users.\n      - [Validate remote host](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-validate-remote-host.md) -- Set the property to true to prevent bad actors from using internal port scanning in your network.\n    - [Communications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-communications.md) -- This control ensures proper encryption using strong algorithms and ciphers. This includes ensuring the recommended version of TLS is used for client connectivity, use of strong cipher suites, use of trusted and signed certificates, ensuring connections are encrypted between components and logging of connection failures.\n      - [Enforce certificate trust [Updated in Security Center 1.3, removed in 2.0, added in 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-certificate-trust.md) -- Use system properties to ensure that certificate expiration and trust are checked for certificates received from outbound HTTPS call endpoints when host verification is not performed.\n      - [Disable outbound SSLv2/SSLv3 connections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disabling-sslv2-sslv3.md) -- Use the glide.outbound.sslv3.disabled property to force the MID Server to use TLS when making outbound connections, such as REST and SOAP requests. Normally, outbound connections from an instance are forced to use TLS instead of SSL.\n      - [Do not use demo certificates for active SAML configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-do-not-use-demo-certificates-active-saml-configurations-plugin.md) -- Control whether demo certificates are used in production SAML configurations.\n      - [Disable deprecated TLS versions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-deprecated-tls-versions.md) -- Avoid loss or leakage of sensitive data by disabling deprecated TLS versions.\n      - [Enforce OCSP check on network error](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-ocsp-check-on-network-error.md) -- Learn how to configure the com.glide.communications.httpclient.ocsp_allow_network_error property to prevent bad actors from bypassing Online Certificate Status Protocol (OCSP) checks.\n      - [Verify certificate chain and hostname](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-verify-certificate-chain-and-hostname.md) -- Configure the com.glide.communications.httpclient.verify_hostname property to prevent man-in-the-middle-attacks by ensuring that the certification verification process is executed.\n      - [Verify certificate revocation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-verify-certificate-revocation.md) -- The com.glide.communications.httpclient.verify_revoked_certificate property checks certificate revocation during the Transport Layer Security (TLS) handshake to ensure that security checks are not bypassed.\n    - [Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-configuration.md) -- The Configuration category ensures applications have a secure build environment and hardened third party library components. Specifically, ensuring a build and deploy pipeline is repeatable and includes automated testing and prevents known security issues from being deployed. This includes keeping dependencies up to date and free from known vulnerabilities.\n      - [Allow CORS Origins for OAuth Endpoints](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-allow-cors-origins-for-oauth-endpoints.md) -- Use a system property to configure to specify which domains are allowed to make cross-origin requests.\n      - [Auto set content type options [Removed in Security Center 1.3.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-auto-set-content-type-options.md) -- Configure the Auto set content type options property on your instance to prevent MIME confusion attacks.\n      - [Cache-Control HTTP Header Value [Updated in Security Center 1.3 and removed in 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-cache-control-http-header-value.md) -- Use the glide.http.cache_control property to set the default cache-control value in the HTTP response headers that the ServiceNow AI Platform sends when requesting static content data for a page. Examples of static content include images, CSS, and JavaScript rendered from within, for a page.\n      - [Enable HTTP response headers configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-http-response-headers-configuration.md) -- Reduce the risk of cookie/session-related hijacking of web apps using a system property.\n      - [sc-disable-chat-server-debugging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-chat-server-debugging.md) -- \n      - [Disable legacy JQuery UI usage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-legacy-jquery-ui-usage.md) -- Avoid the introduction of unpatched vulnerabilities in the library by disabling legacy JQuery UI usage.\n      - [Disable locked form elements debugging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-locked-form-elements-debugging.md) -- Use a system property to prevent the display of explanation of locked form elements.\n      - [Disable MultiSSO Debugging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-multisso-debugging.md) -- The glide.authenticate.multisso.debug property controls debug logging for Multi-SSO.\n      - [Disallow target cloning [New in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disallow-target-cloning.md) -- Configure the glide.db.clone.allow_clone_target property to prevent your instance from being used as a clone target.\n      - [Disable soap fault stack trace display](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-soap-fault-stack-trace-display.md) -- Manage how stack traces are displayed in your instance.\n      - [Restrict performance monitoring access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-performance-monitoring-acl.md) -- Use the glide.security.diag_txns_acl property to control stats.do, threads.do, thread_pool_stats, and replication.do access from an unauthenticated connection.\n      - [Enforce secure referrer policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-secure-referrer-policy.md) -- Use the com.glide.security.referrerpolicy property to ensure that the Referrer-Policy HTTP header sends the appropriate level of data to each ServiceNow page to help prevent data leaks.\n      - [Ensure minimum private key size](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-ensure-minimum-private-key-size.md) -- Use a system property to determine the minimum size of the private key used for Certificate Signing Request (CSR) generation with the Certificate Inventory Management application.\n      - [Implement the x-frame-options: SAMEORIGIN security header](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-x-frame-options-sameorigin.md) -- Use the glide.set_x_frame_options property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages.\n      - [Require write access to access service catalog add item page](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-require-write-access-to-access-service-catalog-add-item-page.md) -- Use the glide.sc.request.add_item_write_access property to prevent unauthorized operations from being performed on catalog items.\n      - [Set Xframe options to prevent embedding third-party websites](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-xframe-options.md) -- Configure this property to prevent the content of a web-application from being embedded in a third-party site.\n    - [Data protection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-data-protection.md) -- The data protection category addresses the elements of confidentiality, integrity and availability (CIA) of data.\n      - [Remove remember me](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-remove-remember-me.md) -- Use the glide.ui.forgetme property to remove the Remember Me check box from the login page to prevent login information from being cached.\n      - [Require clearing pasteboard when backgrounding mobile application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-require-clearing-pasteboard-when-backgrounding-mobile-application.md) -- The glide.sg.clear_pasteboard_when_backgrounded property controls if text copied from ServiceNow mobile app is kept in the clipboard and pasteboard after the app is in background mode. If it is not set to the recommended value of true, then sensitive information may be disclosed to the Android or iOS clipboard where it can be exposed to other applications on the device.\n      - [Restrict HR case updates from personal emails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-hr-case-updates-from.md) -- Use the sn_hr_core.restrict_guest_email property to control whether a user can respond back to a HR case with their personal email.\n      - [Restrict oauth parameters to POST body [New in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-restrict-oauth-parameters-to-post-body.md) -- Use the glide.oauth.allow.parameters.in.post.body.only property to control the inbound OAuth authentication's acceptance of access tokens. Access tokens are sensitive and should only be accepted when located within a POST request body.\n    - [Error handling and logging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-error-handling-logging.md) -- The error handling and logging category addresses the quality and verbosity of logged information exposed to stakeholders.\n      - [Disable logger for low privilege users in script sandbox](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-glide-security-logger-no-loggining-for-sandbox.md) -- Manage Glide System's ability to log scripts being executed in the sandbox environment.\n      - [Disable secure cookie debugging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-secure-cookie-debugging.md) -- Manage the log messages related to cookies in your instance.\n      - [Disable SQL error messages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disabling-sql-error-messages.md) -- Use the glide.db.loguser property to disable SQL error messages from rendering in a browser.\n      - [Enable Identity and Access Audit Tool](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-identity-and-access-audit-tool.md) -- Use Identity and Access Audit to track changes to user accounts, groups, and roles.\n      - [Enable MID audit log](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-mid-audit-log-plugin-applicability-mid-server.md) -- The MID Server command audit log records details such as the command name, command hash, name of credential used, and execution status.\n      - [Enable protected tables plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-protected-tables-plugin.md) -- Use the com.glide.security.protected_table.enabled property to prevent higher privilege users from tampering with log tables.\n      - [Log all outbound http request fields [Removed in Security Center v1.3.2]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-log-all-outbound-http-request-fields.md) -- Configure the glide.outbound_http.security.log.allow.all.fields property to false to prevent sensitive Outbound HTTP fields from being logged in plain text.\n      - [Log html sanitization [Removed in Security Center 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-log-html-sanitization.md) -- Configure glide.html_sanitize.discarded_log.enable property to determine if HTML sanitization events will be logged in your instance.\n      - [Log Impersonation History](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-log-impersonation-history.md) -- Enable impersonation history logging using a system property.\n      - [Log session audit events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-log-session-audit-events.md) -- Use a system property to enable creations of session audit events\n      - [Log user impersonation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-log-user-impersonation.md) -- Configure glide.sys.log_impersonation to control if user-impersonating events are logged in your instance.\n      - [Prevent verbose HTTP request logging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-prevent-verbose-http-request-logging.md) -- Help prevent access to sensitive information by reducing verbose HTTP request logging.\n      - [Track Impersonation Events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-track-impersonation-events.md) -- Enable impersonation event tracking using a system property.\n      - [Turn off verbose SQL error messages for import processor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-turn-off-verbose-sql-error-messages-for-import-processor.md) -- Configure this property to control whether verbose SQL error messages are displayed.\n    - [File and resources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-file-resources.md) -- The file and resources category ensures applications handle untrusted file data securely and store untrusted data from untrusted sources with limited permissions in an appropriate location.\n      - [Disallow infected file download](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disallow-infected-files-download.md) -- Control whether users can download non-scanned attachments if the antivirus service is down or unreachable.\n      - [Enable email spam scoring and filtering](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-email-spam-scoring-and-filtering.md) -- Install the Email Filter (com.glide.email_filter) plugin to install email filtering within the instance. This filtering identifies existing headers, which enables you to decide what to do with the email based on the associated header. Alternatively, set com.glide.email_filter to false.\n      - [Enable antivirus scan](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-antivirus-scan.md) -- The com.glide.snap.enable_scan property activates the antivirus scan functionality.\n      - [Restrict downloadable files types in static content [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-files-types-download-restrictions-from-static-content.md) -- Use the glide.ui.strict_customer_uploaded_static_content property to enable restrictions on the file types that can be downloaded when they have been uploaded using the Upload File functionality.\n      - [Limit attachment size in training and prediction flows for GraphQL endpoints [New in Security Center 1.3 and updated in 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-attachment-size-in-training-and-prediction-flows-for-graphql-enpoints-plugin-applicability-platform-document-intelligence.md) -- The glide.platform_ml_di.max_attachment_size_graphql property controls the maximum allowed size limit for returning attachments in GraphQL endpoints of training or prediction flows.\n      - [Limit attachment size in training and prediction flows [New in Security Center 1.3 and updated in 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-attachment-size-in-tr.md) -- The glide.platform_ml_di.max_attachment_size property controls the maximum allowed size limit for returning attachments in training and prediction flows.\n      - [Limit HTTP response body size [New in Security Center 1.3 and updated in 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-http-response-body-size.md) -- Configure the glide.http.response.get_body.limit.enabled and glide.http.response.get_body.limit properties to protect your instance against OutOfMemoryExceptions.\n      - [Limit maximum number of attachments in email](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-maximum-number-of-attachments-in-email.md) -- Configure the number of inbound email attachments allowed per Email [sys_email] record on your instance.\n      - [Maximum allowed attachment size](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-max-allowed-attachment-size.md) -- Configure the com.glide.attachment.max_size property to control the maximum size (in megabytes) permitted for an uploaded attachment.\n      - [Validate file mime type in AttachmentCreator soap web service [New in Security Center 1.3 and updated in 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-validate-file-mime-type-in-attachmentcreator.md) -- The glide.attachment.enforce_security_validation property determines whether Multipurpose internet Mail Extensions (MIME) files undergo validation.\n      - [Validate MIME Type of Attachments from Inbound Emails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-validate-mime-type-of-attachments-from-inbound-emails.md) -- Use a system property to validate attachments uploaded from inbound emails.\n    - [Malicious code](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-malicious-code.md) -- The Malicious Code category ensures that best efforts are made to confirm that your code is free of vulnerabilities and unwanted functionality.\n      - [Block rooted or jailbroken mobile devices](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-block-rooted-or-jailbroken-mobile-devices.md) -- Secure your instance by preventing unauthorized access from jailbroken devices.\n      - [Enable Code Signing for application configuration data and scripts [Removed in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-code-signing-for-application-configuration-data-and-scripts.md) -- Manage Code Signing for application configuration data and scripts on your instance.\n    - [Session management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-session-management.md) -- This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.\n      - [Apply continuous authentication policies to mobile sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-apply-continuous-authentication-policies-to-mobile-sessions.md) -- Reduce the risk of session hijacking by applying continuous authentication policies to mobile sessions.\n      - [Minimize absolute session timeout duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-absolute-session-timeout.md) -- Use the glide.ui.user_cookie.max_life_span_in_days property to set a maximum life span for user cookies created when users log in with the Remember Me checkbox selected. When the cookie expires, users who have selected the Remember Me checkbox are forced to reauthenticate into the instance.\n      - [Define active session timeout exception roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-define-active-session-timeout-exception-roles.md) -- Use a system property to exempt roles from active session timeout limits.\n      - [Enable UserCookie version 3.1](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-usercookie-version-3-1.md) -- Manage the version of UserCookie that is enabled on your instance to secure the storage of the secret key in the source code.\n      - [Enforce password reset on api requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-password-reset-on-api-requests.md) -- Manage how the password reset functionality operates on your instance.\n      - [Enable HTTP Only Cookie Flag](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-http-only-cookie-flag.md) -- Use the glide.cookies.http_only property to enable the HTTPOnly attribute for sensitive cookies.\n      - [Enable MID Server Governance Checks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-mid-server-governance-checks.md) -- Use an inactivity timeout on your MID Servers to reduce exposure to potential attackers.\n      - [Invalidate Session After OAuth Token Expiration [New in Security Center 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-invalidate-session-after-oauth-token-expiration.md) -- Use a system property to the secure value to prevent users from continuing to use a session via cookies after the OAuth token used to create the session expires.\n      - [Minimize concurrent interactive session quantity [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-glide-authenticate-max-concurrent-interactive-sessions.md) -- Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user.\n      - [Limit concurrent sessions across all nodes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-concurrent-sessions-across-all-nodes.md) -- Use the glide.authenticate.limit.concurrent.sessions.across.all.nodes property with the Limit Concurrent Sessions plugin to manage the number of sessions tracked across all nodes.\n      - [Activate Limit Concurrent Sessions Plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-concurrent-sessions-plugin.md) -- Configure the com.glide.limit.concurrent.sessions plugin to reduce the chance of session hijacking on your instance.\n      - [Limit guest's active session life span](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-guests-active-session-life-span.md) -- Use the glide.guest.active.session.life_span property to control the duration of an active guest's HTTP sessions.\n      - [Minimize Concurrent Interactive Sessions with Limit Concurrent Sessions Plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-glide-authenticate-limit-concurrent-interactive-sessions.md) -- Manage the number of interactive sessions on your instance.\n      - [Limit integrations' active session life span](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-integrations-active-session-life-span.md) -- The glide.integrations.active.session.life_span property enforces max lifespan on active guest HTTP sessions irrespective of inactive timeout. The configured value is in minutes. A value of zero will disable timing out the active sessions.\n      - [Limit policy based session access mobile refresh token interval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-policy-based-session-access-mobile-refresh.md) -- Use the glide.authenticate.session_access.mobile.refresh_token_interval property to govern the length of time that must elapse before a mobile device user will be forced to re-authenticate.\n      - [Limit UI active session life span](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-ui-active-session-life-span.md) -- The glide.ui.active.session.life_span property enforces max lifespan on active authenticated HTTP sessions irrespective of inactive timeout.\n      - [Limit session length for high assurance sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-limit-session-length-for-high-assurance-sessions.md) -- Reduce the risk of account takeover in high assurance sessions by limiting session length\n      - [Proactively Invalidate Sessions After Defined Durations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-proactively-invalidate-inactive-sessions.md) -- The glide.active.session.timeout.invalidate.session property controls whether a timeout session is proactively invalidated before the Tomcat server.\n      - [Rotate HTTP session identifiers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-rotate-http-session-identifiers.md) -- Use the glide.ui.rotate_sessions property to enable rotation of the HTTP session identifiers to reduce security vulnerabilities.\n      - [Minimize concurrent interactive session quantity [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-minimize-concurrent-interactive-session-quantity.md) -- Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user.\n      - [Minimize session activity timeout duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-session-activity-timeout.md) -- Use the glide.ui.session_timeout property to designate, in minutes, activity timeout value.\n      - [Minimize session window timeout duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-session-window-timeout.md) -- Use the glide.ui.user_cookie.life_span_in_days property to set the expiration time period for the Remember Me cookie. The default value is 15 days and the maximum cap is at 30 days.\n    - [Stored cryptography](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-stored-cryptography.md) -- This category focuses on the encryption of stored data. It encompasses several key aspects, such as employing established algorithms and cryptographic modules, ensuring the proper generation of pseudo-random values, implementing encryption based on data classification, and securely storing and isolating key material.\n      - [Enable glide KMF encrypter [Removed in Security Center 1.3.2]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-glide-kmf-encrypter.md) -- Manage the encrypters used for Password2 fields on your instance.\n      - [Disable use of TripleDES/3DES encryption algorithm](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-use-of-tripledes-3des-encryption-algorithm.md) -- Avoid the security risks of outdated encryption methods by disabling the use of the TripleDES/3DES encryption algorithm.\n      - [Prevent usage of 3DES keys [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-prevent-usage-of-3des-keys.md) -- Disable the use of 3DES static keys on your instance with a system property.\n    - [Validation, sanitization, and encoding](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/validation-sanitization-encoding.md) -- Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.\n      - [Allow HTML Links to Trusted Domains in the Description Fields of the Impact Workspace Module [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-allow-html-links-to-trusted.md) -- Use a system property to help sanitize the HTML allowed in the descriptions fields. This property limits the allowed links to only those from the trusted domains listed in the property.\n      - [Enable the hardened java security manager](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-the-hardened-java-security-manager.md) -- The glide.security.manager property contains the Java classname of the current Java security manager.\n      - [Enable HTML Sanitizer [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-html-sanitizer.md) -- Use the glide.html.sanitize_all_fields property to enable the HTMLSanitizer script include, which sanitizes HTML input based on exclusion listed and inclusion listed attributes configured in a script.\n      - [Enable script sandbox [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-client-generated-scripts-sandbox.md) -- Use the glide.script.use.sandbox property to enable script sandboxing.\n      - [Enforce HTML Sanitization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-check-unsanitized-html.md) -- Use the com.glide.security.check_unsanitized_html property to enforce sanitization behavior of translated_html fields on a global level for field assignments.\n      - [Ensure Contextual Search Do Not Contain An Unvalidated Redirect [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-ensure-contextual-search-do-not-contain-an-unvalidated-redirect.md) -- Prevent Contextual Search results from containing referral links outside the current domain with a system property.\n      - [Disable AJAXEvaluate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-ajaxevaluate.md) -- Use the glide.script.allow.ajaxevaluate to protect the system API from vulnerabilities of Client script execution through AJAX calls.\n      - [Disable Entity Expansion within the XMLDocument2 Streaming Parser](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-entity-expansion.md) -- If customizations do not require entity expansion, use the glide.stax.allow_entity_resolution property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities.\n      - [Disable external content URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-disable-external-content-url.md) -- Manage how external link metadata is used in your instance with Connect Chat.\n      - [Disable JavaScript tags in embedded HTML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-allow-javascript-tags-in-embedded-html.md) -- Use the glide.ui.security.codetag.allow_script property to disable support for embedding HTML JavaScript code created using of the [code] tag.\n      - [Disable embedded HTML code [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-allow-embedded-html-code.md) -- Use the glide.ui.security.allow_codetag property to disable support for embedding HTML code created using the [code] tag.\n      - [Restrict downloadable MIME types](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-downloadable-mime-type-denylist.md) -- The glide.ui.attachment.download_mime_types property will force the specified list of dangerous file types to be downloaded to the client and not viewed inline in the browser.\n      - [Enable HTML Sanitizer within Virtual Agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-html-sanitizer.md) -- Use the com.glide.cs.html.sanitizer.enabled property to enable HTMLSanitizerService.\n      - [Enable Jelly JS Interpolation Protection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-jelly-js-interpolation-protection.md) -- Use the glide.ui.jelly.js_interpolation.protect property to ensure that any JavaScript about to be executed on a Jelly page is protected from injection with the help of Jelly interpolation.\n      - [Enable Jelly JS interpolation protection for nested expressions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enable-jelly-js-interpolation-protection-for-nested-expressions.md) -- Manage the interpolation protection on your instance.\n      - [Enforce relative links](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-relative-links.md) -- Use the glide.cms.catalog_uri_relative property to enforce relative links from the URI parameter on /ess/catalog.do.\n      - [Enforce URL allowlist check](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-enforce-url-allowlist-check.md) -- Use the glide.security.url.whitelist system property to add extra layer of validation to ensure whether any external URL introduced should be a part of inclusion listed URLs.\n      - [Escape Excel formulas [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-escape-excel-formula.md) -- Use the glide.export.escape_formulas property to prevent Excel Injection, also, known as formula injection.\n      - [Escape HTML in list views [Updated in Security Center 1.3 and 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-escape-html.md) -- Use the glide.ui.escape_html_list_field property to force HTML escapes for HTML fields in a list view.\n      - [Escape JavaScript [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-escape-javascript.md) -- Use the glide.html.escape_script property to force escape from JavaScript (<script></script>) tags in HTML fields during list views.\n      - [Escape jelly script [Updated in Security Center 1.3 and 1.5]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-escape-jelly.md) -- Use the glide.ui.escape_all_script property to force escape of all scripts injected into Jelly.\n      - [Escape scripts in scratchpad](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-escape-scratchpad.md) -- Learn how scratchpad factors into the security posture of your instance and how to manage it so that malicious scripts can't be executed on it.\n      - [Escape XML markup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-escape-xml.md) -- Use the glide.ui.escape_text property to force escape of XML values at the parser level before transmitting them to the client's browser.\n      - [Escape xml response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-escape-xml-response.md) -- Manage how XML escapes are handled on your instance.\n      - [Restrict access to GlideSystemUserSession scriptable API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-access-glidesystemusersession-scriptable-api.md) -- The client callable GlideSystemUserSessionSandbox scriptable API exposes GlideSystemUserSession's addErrorMessageNoSanitization and addInfoMessageNoSanitization methods to the JavaScript sandbox. This allows all users to call this method via script.\n      - [Restrict allowed Java packages [Updated in Security Center 1.3]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-java-packages-allowlist.md) -- Configuring these properties protect from dangerous APIs being exposed to the scripting engine.\n        - [Packages call removal tool](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-packages-call-removal-tool.md) -- Activate and run the Packages Call Removal Tool (com.glide.script.packages_call_removal) plugin, and then consider whether each of the proposed changes should be completed or rejected.\n      - [Unset LDAP Initial distinguished name [Updated in Security Center 1.3 and removed in 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-ldap-initial-distinguished-name.md) -- Use this property to manage the distinguished name of a LDAP Server record.\n      - [Enforce strict security of session cookies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-secure-session-cookies.md) -- Use the glide.ui.secure_cookies property to require properly formatted cookies\n      - [Minimize Entity Expansion Threshold for GlideXMLUtil Scriptable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-setting-entity-expansion-threshold.md) -- Use the glide.xmlutil.max_entity_expansion property to change the maximum entity expansion limit to a smaller number.\n      - [Prevent Empty ACL Creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-prevent-empty-acl-creation.md) -- Set the glide.security.empty_acl.popup_window.enabled property to the secure value of true to block attempts to create, update, or save an invalid ACL. This setting will also provide a client-side model to configure a role or security attribute for the ACL.\n      - [Prevent Reuse of REST API Sessions in UI/Web](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-prevent-reuse-of-rest-api-sessions-in-ui-web.md) -- Prevent REST API session cookies from bypassing Single Sign-On (SSO) and Multi-Factor Authentication (MFA) controls using a system property.\n      - [Define restricted downloadable MIME types [Updated in Security Center 1.3, 1.5, and 2.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-downloadable-mime-types.md) -- Use the glide.ui.attachment.force_download_all_mime_types property to download MIME types and not to render inline in the browser.\n      - [Restrict uploaded MIME types](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-upload-mime-type-restriction.md) -- Use the glide.security.file.mime_type.validation property to activate MIME type checking for uploads. You can enable (set the property to true) or disable (set it to false) MIME type validation for file attachments.\n      - [Restrict XML external entities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-xml-entity-validation-url-allowlist.md) -- Configure system properties to ensure that your instance only processes XML from trusted sources to help prevent XML external entity (XXE) attacks.\n      - [Require XMLdoc2 entity validation with allowlist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-xmldoc2-entity-validation-with-entity-expansion.md) -- If customizations do not require entity expansion, use the glide.xmlutil.max_entity_expansion property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities.\n      - [Sanitize All Translated HTML Fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-sanitize-all-translated-html-fields.md) -- Learn how to configure the glide.translated_html.sanitize_all_fields property to the secure value to ensure that all translated_html elements are sanitized with an HTML sanitizer.\n      - [Sanitize HTML in the Description Fields of the Impact Workspace Module [New in Security Center 7.0]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sanitize-html-in-the-description-fields-of-the-impact-workspace-module.md) -- Sanitize the HTML in the description fields by removing HTML tags that are sources of HTML injection attacks with the sn_impact_common.blacklist_tags_HTML_injection property.\n      - [Set safe content security policy for SVG files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-set-safe-content-security-policy-for-svg-files.md) -- The com.glide.csp.self_script_src_svg property adds the script-src none directive to the HTTP Content-Security-Policy header when Scalable Vector Graphics (SVGs) are accessed through the Translation Memory Index (IIX) file extension.\n      - [Validate MIME Type for Multi-Extension Filenames, Polyglot Files, and Null-Byte Injection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/instance-security-hardening-settings/sc-validate-mime-type-for-multi.md) -- Use a system property to prevent attachments from bypassing MIME-type restrictions.\n  - [Log Export Service (LES)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-intro.md) -- Log Export Service (LES) lets you seamlessly export your instance system and application logs into your enterprise security analytic tools.\n    - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-landing-page.md) -- The LES service provides a highly scalable and near real-time integration with your analytic tools that is easy to set up and maintain. If you're new to LES, read this overview section to learn what the tool can do.\n      - [Log sources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-log-sources-export.md) -- Log Export Service (LES) can export log sources from some System Log Tables, the Audit Table, and Application Node Log Files.\n    - [Administer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-administer.md) -- Use LES to create log source configuration and multi-topics for each source type.\n      - [Create a log source configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-create-source-configuration.md) -- Regulate and set filters on the logs to be forwarded by creating a log source configuration.\n        - [Create source type and multi topics in the LES source table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-multi-topics-v2.md) -- Consume logs for each source type by creating multiple topics per source type. You can now leverage the option of customized selection of specific topics for different log sources during the debugging process, without impacting the other log tables.\n      - [Update system property](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/update-system-property.md) -- Update the glide.les.disable_logs_forwarding system property within the Log Export Service application to control log forwarding during migration or database reseeding operations.\n    - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-configure.md) -- Use guided setup to step through the initial configuration of LES. Guided setup assists you with planning the roll-out of the product and performing the basic configuration to go live.\n      - [Kafka consumer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-kafka-consumer.md) -- Use guided setup to step through the initial configuration of LES for Kafka consumers.\n        - [Guided setup for Kafka consumers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-guided-setup-kafka.md) -- Implement the following steps for a complete guided setup for Kafka consumers.\n      - [MID server consumer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-mid-server-consumer.md) -- Use guided setup to step through the initial configuration of LES for MID server consumer.\n        - [Guided setup for MID Server consumers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-guided-setup-mid-server.md) -- Implement the following steps for a complete guided setup for MID Server consumers.\n        - [Multi-consumer support using unique mid servers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-multi-consumer.md) -- You can now precisely manage log consumption with a new multi-consumer system, enabling dedicated consumers and MID servers for each specific log stream.\n      - [Secure Hermes LES connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-hermes-cert.md) -- Secure your Kafka topics by generating a ServiceNow instance-signed certificate.\n    - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-use.md) -- Use LES to review the log report dashboard.\n      - [Review log report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-use.md) -- Use LES to review the log report dashboard.\n    - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-references.md) -- Find all the miscellaneous information about LES in the reference section.\n      - [Log Export Service roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-roles.md) -- Log Export Service is installed with these roles.\n      - [Actions and roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/les-actions-roles.md) -- Log Export Service uses role-based access control to restrict actions to authorized users.\n  - [Logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/logs.md) -- Logs module provides a variety of logs that you can use to troubleshoot and debug transactions and events that take place within the instance.\n    - [System logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/system-logs.md) -- The System Logs module provides a variety of logs that you can use to troubleshoot and debug transactions and events that take place within the instance.\n      - [System log](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_SystemLogs.md) -- View warnings and errors for instance processes, records, and non-critical events, such as memory usage on the server machine.\n      - [Disable stack trace formatting in system logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/diable-system-log-display.md) -- Enable viewing original unformatted log messages by disabling the collapsible stack trace formatting in system logs.\n      - [Transaction logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_TransactionLogs.md) -- The transaction log records browser activity for an instance. To aid in debugging of system issues, you can filter transaction logs by application scope, limiting transactions that appear to only those transactions originating in specific scopes.\n        - [Client transaction timings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_ClientTransactionTimings.md) -- The Client Transaction Timings plugin enhances the system logs by providing additional information about the durations of transactions taking place between the client and the server.\n      - [Push logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/push-log.md) -- Consult the push log to track the status of push notifications that are queued to send from your system.\n      - [System email log](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_EmailLogs.md) -- The system email log records all emails that the instance creates or receives. System mailboxes are filtered views of this log.\n      - [Event logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_EventLogs.md) -- The event log records all system events that occur within the ServiceNow AI Platform.\n      - [Import logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_ImportLogs.md) -- The import log displays information in a verbose format about any data import activity within the platform.\n      - [System Diagnostics module](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_SystemDiagnosticsApplication.md) -- The System Diagnostics application provides logs that relate to the platform.\n      - [Customer Updates table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_CustomerUpdatesTable.md) -- Changes made in the system are recorded on the Customer Updates [sys_update_xml] table chronologically. There are a few exceptions, as noted below.\n      - [Log history](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_LogHistory.md) -- The system uses table rotation and table extension to archive older logs.\n      - [Use the log file browser](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_LogUtilities.md) -- The instance provides the utilities log file browser and log file download.\n      - [Enhanced logging security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/enhanced-log-security.md) -- Explore the Attribution field in the node log lines to identify the script or component that generated the log message. Transaction start lines include the new field to identify the type of request made.\n      - [Avoid log tampering](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/avoid-log-tampering.md) -- Configure system log table protection rules to limit the scope of modification and deletion of application log records. The rules enable you to determine the logging of changes or attempts to changes in these tables.\n        - [Configuring the log protection plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/accept-log-protection.md) -- Configure the protection rules for each table and operation to complete the configuration of the log protection plugin.\n        - [Create log protection property](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/log-protection-property.md) -- Create a log protection property to avoid the risk of log tampering.\n    - [Logging, auditing, and errors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/logging-auditing-errors-instance-security-hardening.md) -- Apply a logging and auditing strategy so that you can identify and act on suspicious activity in a timely manner.\n      - [Disabling SQL error messages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/disabling-sql-error-messages.md) -- Use the glide.db.loguser property to disable SQL error messages from rendering in a browser.\n    - [Granular admin roles for Logging tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/granular-admin-roles-logging.md) -- Granular admin roles replace broad admin access with targeted, feature-specific permissions. Use these roles to grant the administrative capabilities needed for specific tasks without assigning the admin role.\n  - [Secrets Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/secrets-management.md) -- Secrets Management lets you control which applications and users can access sensitive credentials stored on your instance.\n    - [Exploring Secrets Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-secrets-management.md) -- Use ServiceNow Secrets Management for granular management of access to your passwords to fit your business needs.\n      - [About client-side Secrets Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/understand-sec-man.md) -- Learn how use Secrets Management to manage access to secrets and groups.\n    - [Configuring client accessible secrets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/client-access-secret-landing.md) -- Learn how to configure your instance to use client accessible secrets.\n      - [Create encryption keys and certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/client-access-example-1.md) -- Create encryption keys and a certificate using terminal commands on your local environment.\n      - [Add your certificate to the ServiceNow Trusted Key Store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/client-access-example-2.md) -- Upload your key and certificate to the ServiceNow Trusted Key Store.\n      - [Create a secret group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/client-access-example-3.md) -- Secret groups organize secrets and apply access policies at the group level. Associate a secret group with an identity group to control MID Server access.\n      - [Upload the public/private keypair to the MID Server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/client-access-example-5.md) -- Upload your public/private keypair to your MID Server. This keypair enables the MID Server to handle authentication requests from your instance.\n      - [Create credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/client-access-example-4.md) -- Create a credential to authenticate into a third-party system.\n      - [Configure Flow Designer to manage the integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/client-access-example-6.md) -- On your instance, use Workflow Studio to manage an integration between your local network and your instance.\n      - [Test the end-to-end client-side encrypted secrets integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/client-access-example-7.md) -- Test your integration, and review the execution details to confirm your configuration is working.\n      - [Test a Windows Management Instrumentation credential encrypted with Secrets Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/client-access-example-8.md) -- Verify that your Windows Management Instrumentation (WMI) credential is encrypted with Secrets Management and use an Integration Hub workflow to complete end-to-end testing.\n      - [Cloning and Secrets Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloning-and-secrets-mgmt.md) -- Learn how to reconfigure secrets groups and client secrets groups after a clone.\n    - [Secrets Management dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/secrets-dashboard.md) -- Use the Secrets Management dashboard to review the secret groups configured on your instance and learn about any security issues.\n      - [Secrets Management roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/roles-sec-man.md) -- Secrets Management adds these roles.\n        - [Secrets administrator [sn_secrets.admin]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/roles-sec-man.md) -- Secrets Management adds these roles.\n        - [Secrets Management [sn_secrets.secret_manager]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/roles-sec-man.md) -- Secrets Management adds these roles.\n        - [Secrets viewer [sn_secrets.viewer]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/roles-sec-man.md) -- Secrets Management adds these roles.\n      - [Create a secret group cryptographic module](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-sm-crypto-module.md) -- Create a secret group cryptographic module to perform encryption and decryption.\n      - [Create a basic secret group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/sm-create-basic-group.md) -- Create a basic secret group to group any secrets, regardless of their criteria.\n      - [Create a secret group with criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/sm-create-criteria-group.md) -- Create a secret group with criteria to organize secrets entered in Password2 fields automatically when they share a common criteria, such as table, scope, or application.\n      - [Upload a public key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/sm-upload-key.md) -- Upload a public key to encrypt your secrets in Secrets Management.\n      - [Run jobs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/sm-security-jobs.md) -- Schedule a Secrets Management job to perform encryption tasks on secrets fields on your instance.\n  - [Code Signing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/code-signing-landing.md) -- Use Code Signing to create digital signatures that prevent unauthorized or tampered External Communication Channel (ECC) queue records from being processed by MID Servers. This cryptographic verification helps maintain the integrity of integrations between ServiceNow and external systems.\n    - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/explore-code-signing.md) -- Code Signing provides cryptographic verification to ensure that only authorized scripts can execute on MID Servers. Code Signing prevents unauthorized or tampered External Communication Channel (ECC) queue records from being processed by MID Servers, maintaining the integrity of integrations between ServiceNow and external systems.\n    - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/config-code-signing.md) -- Activate and configure Code Signing to verify the authenticity and integrity of your data.\n      - [Assign the Administrator Role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cse-assign-roles.md) -- Assign the Code Signing Administrator role to a user to access the Code Signing configuration experience.\n      - [Trusted Instance Setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cse-turn-on-cse.md) -- Turn on and configure Code Signing on your trusted instance.\n      - [Upload configuration files to your protected instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cse-upload-cs-config.md) -- Upload the configuration file generated on your trusted instance.\n      - [Protected Instance Setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cse-ppi-config.md) -- Turn on and configure Code Signing on your protected instance.\n      - [Enable Certificate Validation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cse-turn-on-cert-validation.md) -- Protect your instance with certificate based validation.\n      - [Quorum Controlled Certificate Revocation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-revocation.md) -- The quorum-controlled certificate revocation for Code Signing certificates provides a secure mechanism for a Code Signing admin to revoke Code Signing certificates. The revocation process involves submitting a request that requires approval from multiple stakeholders. This workflow helps to prevent accidental or unauthorized revocations.\n        - [Export Request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/export_certificate.md) -- Start the certificate revocation process by selecting the certificate that you want to revoke. Provide the required configuration properties. Export this transaction as part of an update set, which is imported into the protected instance for approval and execution.\n        - [Import Request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/import-certificate.md) -- Import the update set into the protected instance to initiate the certificate revocation process. Approvers receive email notifications and they should complete the approval workflow before the certificate is revoked. The approval means that the revocations are confirmed, authorized, and traceable for security and compliance purposes.\n        - [Approve Request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cerificate-revocation-approval.md) -- Review and approve certificate revocation requests from the email approval notifications that are sent to your registered email address. Review the approval notification and select the Click here to approve or Click here to reject link to access the protected instance and act. You can also access the approval request and the code-signing quorum request directly from the email.\n      - [Disable Code Signing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cse-turn-off-cse.md) -- Disable code signing on your protected instance.\n      - [Load Key Pairs and Certificates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/circle-trust-setup.md) -- Establish the relationship in a designated trusted instance using Code Signing. This first step loads two cryptographic keys into the trusted environment to establish a trusted source for updates to the production instance.\n      - [Circle of Trust](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-updateset-nonprod.md) -- Create an update set in the trusted environment to export the trusted certificate to the production environment.\n      - [Manage Circle of Trust](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/retrieve-updateset-prod.md) -- Retrieve the update set in production to establish the trust relationship between the two instances. The certificates that have been created to represent trust in the trusted instance must be accepted into the protected instance.\n      - [Turn on Code Signing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/enable-codesiging.md) -- Turn on Code Signing in your trusted non-production instance to identify the trusted instances linking to your production instance.\n      - [Create Key Pairs and Certificates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-key-pairs-and-certs.md) -- Create two key pairs to signed certificates to establish trust between your protected and trusted instances.\n      - [Custom Firewall Rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/custom-yaml-conf.md) -- Configure the External Communication Channel (ECC) firewall in your MID Server by specifying the custom rules to selectively allow or reject the incoming message and override the Code Signing configuration.\n      - [Root of Trust Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/change-rot-overview.md) -- Trust and use your own certificates instead of relying on ServiceNow build certificates (default) by changing to use your Root of Trust (ROT). ServiceNow components like script includes, business rules, etc., are signed at build time using a ServiceNow build time key (verification certificate is the ServiceNow build certificate).\n        - [Migrate Signatures](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/migrate-sigs-customer-rot.md) -- Run a signing job to migrate your signatures to a customer Root of Trust (ROT).\n        - [Disable Root of Trust](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/disable-sn-rot.md) -- Run a scheduled job on your trusted instance to disable Root of Trust.\n    - [Using Code Signing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/using-code-signing.md) -- Learn how to sign records, messages, and attachments to help verify the authenticity and integrity of your data.\n      - [Standalone Signing Tool](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/sa-code-signing-tool.md) -- Use the standalone Signing Tool to sign supported records in ServiceNow applications using your own private key.\n        - [Use Signing Tool](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/use-sa-signing-tool.md) -- Learn how to use the Signing Tool to sign supported records in ServiceNow applications.\n        - [Tool Arguments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/sa-signing-tool-reference.md) -- Learn about the available arguments for the Signing Tool.\n      - [JDBC Signing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-jdbc.md) -- Use update sets to sign and validate the JDBC data sources by enabling the code signing in protected and trusted instances.\n        - [Sign Existing Sources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-jdbc.md) -- Use update sets to sign and validate the JDBC data sources by enabling the code signing in protected and trusted instances.\n        - [Sign New Sources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-jdbc.md) -- Use update sets to sign and validate the JDBC data sources by enabling the code signing in protected and trusted instances.\n      - [REST and SOAP Signing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-rest-soap.md) -- Use update sets to sign and validate the REST and SOAP messages by enabling the code signing in protected and trusted instances.\n        - [Sign the Existing Messages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/rest-soap-code-sign.md) -- Sign and validate the existing REST and SOAP messages by enabling the Code Signing in protected and trusted instances.\n        - [Sign the New Messages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-new-rest-soap.md) -- Sign and validate the new REST and SOAP messages from the trusted instance by enabling the Code Signing in protected and trusted instances.\n      - [Sign Records and Files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/sign-specific-records.md) -- Create a security job to sign specific records or attachments rather than all records or attachments on a table.\n        - [Create a Job on a Trusted Instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/sign-files-nonprod.md) -- Sign a specific record, or group of records you define on a trusted instance.\n      - [Sign Flows and Actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-fdih.md) -- Use update sets to sign and validate the flows, subflows, and actions by enabling the Code Signing in protected and trusted instances.\n        - [Sign Existing Flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-fdih.md) -- Use update sets to sign and validate the flows, subflows, and actions by enabling the Code Signing in protected and trusted instances.\n        - [Sign New Flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-fdih.md) -- Use update sets to sign and validate the flows, subflows, and actions by enabling the Code Signing in protected and trusted instances.\n      - [Signature Verification](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/signature-verification-in-code-signing.md) -- Signature verification helps confirm that records, scripts, and other signed content originate from trusted sources and remain unaltered.\n    - [Health and Status Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/code-signing-health-and-status-dashboard.md) -- The Code Signing Health and Status dashboard provides a centralized, user-friendly view of your Code Signing environment's health and configuration. Use it to identify issues, verify configuration accuracy, and support secure, uninterrupted code-signing operations.\n      - [Dashboard Summary](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/overview.md) -- The Overview dashboard provides a centralized view of your Code Signing environment, offering real-time insights into key components and their status.\n      - [Signature Status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/signature-verification-status.md) -- View the status of valid, invalid, and missing signatures across different applications to assess code signing coverage. Use this information to identify areas that may require additional attention or action.\n      - [MID Server Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/code-signing-mid-server-configuration.md) -- Manage and configure the trust relationships and certificate settings for MID Servers.\n      - [Key Pair and Certificates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/code-signing-certificates.md) -- The Key Pair and Certificates dashboard displays details about the cryptographic keys and digital certificates used for Code Signing. It includes information such as key type, certificate issuer, expiration date, and validity status. Use this dashboard to manage code signing certificate credentials, verify their validity, and help ensure secure and trusted Code Signing operations.\n      - [Configuration Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/code-signing-configuration.md) -- The Code Signing Configuration dashboard displays the system properties and key settings that control Code Signing in your environment, including flags and enforcement policies. These settings enable features, enforce signature validation, and define trusted sources.\n      - [Utilities Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/code-signing-utilities.md) -- The Utilities dashboard provides a unified workspace to monitor signature status, detect configuration issues and maintain the overall health of your Code Signing environment. It consolidates common Code Signing administrative tasks into a single interface, eliminating the need to navigate across multiple areas of the instance.\n        - [Batch Signature Generator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/batch-signature-generator.md) -- Automatically generate batch update sets for records with invalid or missing signatures on the trusted instance.\n    - [Administer and Troubleshoot](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/code-signing-reference.md) -- Reference topics provide additional information to administer and troubleshoot Code Signing.\n      - [Properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/code-sign-properties.md) -- Code Signing adds the following properties.\n      - [Roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-role-landing.md) -- Code Signing includes the following roles.\n        - [Admin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-role-landing.md) -- Code Signing includes the following roles.\n        - [Manager](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-role-landing.md) -- Code Signing includes the following roles.\n        - [Auditor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-role-landing.md) -- Code Signing includes the following roles.\n      - [Actions and roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-actions-roles.md) -- Reference table of Code Signing actions, their descriptions, and the roles required to perform them.\n      - [Logs and Errors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cs-logs.md) -- Access various logs to troubleshoot and identify the failure reasons.\n- [Antivirus Scanning](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/antivirus-protection.md) -- Use Antivirus Scanning to help protect your instance against virus infections that can be introduced by file attachments to your system records, such as incidents, problems, and stories.\n  - [Exploring Antivirus Scanning](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-antivirus-scanning.md) -- Use Antivirus Scanning to help protect your instance against virus infections that can be introduced by file attachments to your system records, such as incidents, problems, and stories.\n  - [Configuring Antivirus Scanning](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-antivirus-protection.md) -- Configure Antivirus Scanning across your instance and at the table level.\n  - [Reviewing quarantined files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/resolve-infected-file.md) -- Review quarantined file attachments and take further action as needed.\n    - [Review antivirus activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/generate-log-report-of-quarantined-files.md) -- Review the Antivirus Activities log that tracks all activities that occur on potentially-infected files from the point that they are discovered and placed into quarantine.\n  - [Understanding Dictionary attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/dictionary-attributes-antivirus-scan.md) -- Dictionary attributes alter the behavior of the table or element that the dictionary record describes. As an administrator, you can set the values of dictionary attributes to modify the behavior of the default Antivirus Scanning configuration.\n- [HTML sanitizer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_HTMLSanitizer.md) -- Remove unwanted code and protect against security concerns such as cross-site scripting attacks by sanitizing HTML markup in HTML fields and translated HTML fields.\n  - [Exploring HTML sanitizer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-html-sanitizer.md) -- Remove unwanted code and protect against security concerns such as cross-site scripting attacks by sanitizing HTML markup in HTML fields and translated HTML fields.\n  - [Configuring HTML sanitizer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ConfigureHTMLSanitizer.md) -- You must modify a script include to make configuration changes to the HTML sanitizer.\n  - [Enabling HTML sanitizer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ActivateHTMLSanitizer.md) -- The HTML sanitizer provides a property to enable or disable the sanitizer for all HTML fields in the system.\n    - [Enable sanitization on individual fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_EnSanitizIndFlds.md) -- You can use field attributes to enable or disable the sanitizer on individual fields.\n    - [Enable HTML Sanitizer logging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_EnableHTMLSanitizerLogging.md) -- When the HTML sanitizer removes elements or attributes, they are added to the system log.\n- [Auditing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_AuditedTables.md) -- Track record changes on auditing-enabled tables. By default, the system tracks changes to the incident, change, and problem tables, among others.\n  - [Exploring Auditing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-auditing.md) -- Track record changes on auditing-enabled tables. By default, the system tracks changes to the incident, change, and problem tables, among others.\n  - [Configuring auditing for a table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_EnableAuditingForATable.md) -- You can enable table auditing to track changes to all or some of the table's fields.\n    - [Enable inclusion list auditing for a table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/enable-whitelist-for-table.md) -- Enable a table to audit only those fields you explicitly designate. This is useful when you want to audit only a small number of fields in an audited table.\n    - [Enable impersonation tracking in audit logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/enable-impersonation-tracking-audit-logs.md) -- Track users who perform actions through impersonation in audit logs.\n    - [Exclude a field from being audited (exclusion listing)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ExcludeAFieldFromBeingAudited.md) -- Prevent the ServiceNow AI Platform from tracking a subset of fields in an audited table by excluding those fields from an audit.\n    - [Include a table field in auditing (inclusion listing)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-whitelist-audit-field.md) -- Track a subset of fields in an audited table by add those fields to an inclusion listing.\n    - [Enable auditing for a system table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ConSysTablDelAud.md) -- Deletions from tables with a sys_ prefix are not audited by default. To track deletions from these tables, add the table name to the glide.ui.audit_deleted_tables property. Enabling the Restore Deleted Records plugin adds several default values to this property.\n    - [Audit Management Console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/audit-mgmt-console.md) -- Use Audit Management Console module to experience a more enhanced way of defining and configuring the audit capability within your instance.\n      - [Setup your audit retention](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/setup-audit-retention.md) -- Use the Retention option to automate and simplify the deletion of audit data as per your requirement.\n      - [Enable an audit deletion estimate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-audit-deletion-estimation.md) -- Enable the audit deletion estimation feature that calculates the approximate number of records that will be deleted based on retention policies. This information helps you make an informed decision before applying a retention policy, which permanently deletes audit data and cannot be reversed.\n  - [Viewing Sys Audit and Audit Relationship Change tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_UnderstandingTheSysAuditTable.md) -- The ServiceNow AI Platform tracks inserts and updates to audited records in the Sys Audit (sys_audit) and Audit Relationship Change (sys_audit_relation) tables.\n    - [How the Audit Relationship Change (sys_audit_relation) table works](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_UnderstandingTheSysAuditTable.md) -- The ServiceNow AI Platform tracks inserts and updates to audited records in the Sys Audit (sys_audit) and Audit Relationship Change (sys_audit_relation) tables.\n  - [Knowing about History sets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_HistorySets.md) -- The system automatically generates History Set records as needed from the Audit table when a user either creates a record or views its history.\n    - [Differences Between Audit and History Sets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_DiffBtwnAuditHistSets.md) -- The Audit [sys_audit], History Sets [sys_history_set], and History [sys_history_line] tables store the same data, but they serve different purposes and manage data differently.\n    - [Control access to history](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ControlAccessToHistory.md) -- You can give a role access to view audit history by setting a system property.\n    - [Change the number of history entries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ChangeTheNumberOfHistoryEntries.md) -- By default, the history displays a maximum of 250 history entries, but you can change this value.\n    - [History List](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_HistoryList.md) -- The history list displays each change as its own row in the change list.\n    - [History Calendar](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_HistoryCalendar.md) -- The history calendar shows you the days where the record was changed, who made the change, and when.\n    - [History Timeline](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_HistoryTimeline.md) -- You can view a timeline of changes for a CI and for its related records, relationships, baselines, and proposed changes for the CI. Timelines are available for CIs in the Configuration Item [cmdb_ci] table or a descendant of this table, if auditing is enabled for the tables.\n      - [View timeline of changes to related records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ViewRelatedRecordsChanges.md) -- On the time line of changes for a CI record, you can also view a timeline of changes for the CI's related records.\n      - [Export a snapshot of a configuration item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ExportCIHistoryChanges.md) -- You can export a snapshot of a configuration item from its timeline.\n      - [Compare CI snapshots](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_CompareStartandEndPropertyValues.md) -- You can compare the properties and relationships of a CI at two different points in its timeline.\n    - [Tracking changes to reference fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_TrackingChangesToReferenceFields.md) -- Administrators can track changes to reference field display values.\n    - [Tracking inserts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_TrackingInserts.md) -- By default, the system does not create Audit records for inserts because in a typical instance, inserts can account for over 80% of the size of the Audit table.\n    - [Tracking CI Relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_CIRelationshipsAndHistory.md) -- Changes to a CI relationship (CI Relations, CI/User Relations, or CI/Group Relations) appear in the history of the items on both sides of the changed relationship regardless of whether the change was manual or a result of Discovery.\n  - [Granular admin roles for Audit tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/granular-admin-roles-for-auditing.md) -- Granular admin roles replace broad admin access with targeted, feature-specific permissions. Use these roles to grant the administrative capabilities needed for specific tasks without assigning the admin role.\n- [High Security Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_HighSecuritySettings.md) -- High Security Settings refer to several security options available in your instance.\n  - [Exploring High Security Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-high-security-settings.md) -- High Security Settings refer to several security options available in your instance.\n  - [Activating High Security Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ActivateHighSecuritySettings.md) -- The High Security Settings plugin is active by default on all new instances. If it is not active on your instance, you can request the plugin.\n- [Virtual Private Network (VPN)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_SetUpAVPN4SNowBusNet.md) -- Use a virtual private network (VPN) to integrate your instance with external data sources over the Internet.\n  - [Exploring Virtual Private Network (VPN)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-virtual-private-network.md) -- Use a virtual private network (VPN) to integrate your instance with external data sources over the Internet.\n  - [Activating a VPN service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_RequestAVPNService.md) -- For all VPN requests, including provisioning, modifications, or general questions, use the Service Catalog VPN Request form.\n  - [Configuring an address for VPN communication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_CreateAnAddressForVPNComms.md) -- To prevent conflict or overlap with internal ServiceNow networks or with another customer's internal IP address schemes, the instance requires that all tunneled traffic in the encryption domain use non-RFC-1918 addresses on both sides of the tunnel.\n- [Platform Privacy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/privacy-landing-page.md) -- Privacy enables you to mask the sensitive date on the instance.\n  - [Exploring Data Privacy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy.md) -- Use Data Privacy to classify sensitive data and to remove personally identifiable information (PII) from user data in a production instance and anonymize data in non-production instances. Once anonymized, the user data is no longer considered regulated private information.\n  - [Data Privacy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-landing.md) -- Use Data Privacy to classify sensitive data and to remove personally identifiable information (PII) from user data in a production instance and anonymize data in non-production instances. Once anonymized, the user data is no longer considered regulated private information.\n    - [Data Privacy for ServiceNow Otto](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/now-assist-for-data-privacy-landing.md) -- Set up and configure how to discover and anonymize sensitive data from generative AI prompts.\n      - [Exploring Data Privacy for ServiceNow Otto](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/explore-now-assist-data-privacy.md) -- Learn more how Data Privacy for ServiceNow Otto enhances your ability to protect sensitive data.\n      - [Configuring Data Privacy for ServiceNow Otto](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/configure-now-assist-data-privacy.md) -- Configure a data privacy advanced configuration to de-identify personally identifiable information (PII) in generative AI applications.\n    - [Data privacy (Classic)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-classic.md) -- Data privacy (Classic) is available as a family release. The last family updates were released in the Tokyo launch.\n      - [Data Privacy for Virtual Agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-for-virtual-agent.md) -- You can use Data Privacy to detect and mask the sensitive data and PII during a Virtual Agent conversation.\n      - [Activate data privacy (Classic)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/install-data-privacy.md) -- You can activate the data privacy plugin (com.glide.data_privacy) for Platform Security if you have the admin role. If the application doesn't include demo data or it doesn't install related applications and plugins, delete or revise the following sentence:The application includes demo data and installs related ServiceNow Store applications and plugins if they aren't already installed.\n      - [Installed with data privacy (Classic)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/installed-with-data-privacy.md) -- Learn about the components installed with the data privacy plugin (com.glide.data_privacy).\n      - [Data privacy (Classic) configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-config.md) -- Learn how to create data privacy techniques and policies, and how to create and execute data privacy jobs.\n        - [Create a data privacy technique configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/config-dp-technique.md) -- Create a data privacy technique configuration to customize how data privacy anonymizes your data.\n        - [Create a data privacy policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/config-dp-policy.md) -- Configure a data privacy policy to specify which data privacy techniques are used when anonymizing your data.\n        - [Configure a data privacy job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/config-data-privacy-job.md) -- Configure a data privacy job on your production instance to use anonymized data on your non-production instance for user and data class jobs.\n        - [Data privacy job rollback](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-job-rollback.md) -- Database changes are captured for actions like jobs and scripts so that the changes can be rolled back. Roll back a data privacy job for when human error inadvertently anonymizes incorrect user information. The rollback de-anonymizes the data from the data privacy job.\n          - [Roll back a data privacy job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/rollback-data-privacy-job.md) -- Roll back a data privacy job on your non-production instance that uses anonymized data from your production instance to a state prior to de-identification of a data class or user job.\n      - [Data privacy clone](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dp-clone.md) -- As customer data are cloned from a source to a target instance, typically from production to non-production, sensitive data are de-identified on the target instance.​\n        - [Configure data privacy clone request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/configure-dp-clone.md) -- Data privacy clone integration is configured using a PostClone script to create and execute data privacy jobs for configured policies on the target. After running the script, users will see de-identified data and will not have access to the original data.\n      - [Data Privacy Job Logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dp-job-logs.md) -- Review errors from Data Privacy jobs.\n    - [Data privacy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-data-privacy.md) -- The data privacy store app is a Next Experience refresh for data classification and data privacy with modern look, feel, and usability. Data privacy store app is supported in Utah and above.\n      - [Data privacy overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-data-privacy-overview.md) -- The Overview homepage is a starting point to manage your data and data privacy compliance.\n      - [Data classification](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-data-classification.md) -- Group data by type, using pre-defined or user-defined data classifications. If you have an assigned data classification administrator or auditor role, you can administer different data classes or visually analyze the current state of different types of data within the instance.\n        - [Create data classifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-create-data-classifications.md) -- Create your own user-defined data classifications in the [data_classification] table that you can then assign to specific columns in specific tables. Create new data classes to start the classification process.\n        - [Classify data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-classify-data.md) -- Group data by type, using pre-defined or user-defined data classifications. Assign data classifications to specific table columns in the Dictionary [sys_dictionary] table. When you assign data classifications, it creates entries in the Dictionary-Data Class [m2m_dictionary_dataclass] table, which you can then review in the Overview dashboard.\n      - [Data anonymization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-data-anonymization.md) -- Anonymization provides a way to easily transform data so that it is unidentifiable and more compliant with data privacy regulations.\n        - [Create anonymization techniques](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-create-anonymization-techniques.md) -- Create a data privacy technique configuration to customize how data privacy anonymizes your data.\n        - [Create anonymization policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-create-anonymization-policies.md) -- Configure an anonymization policy to specify which techniques are used when anonymizing your data.\n          - [Assign data anonymization techniques](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-assign-anonymization-techniques.md) -- Assign anonymization techniques for data tables or columns, user specific data, or real time data.\n          - [Configure data anonymization clone request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-configure-data-anonymization-clone.md) -- Data privacy clone integration is configured using a PostClone script to create and execute data privacy jobs for configured policies on the target. After running the script, users will see de-identified data and will not have access to the original data.\n        - [Create anonymization job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-create-anonymization-job.md) -- Configure a data privacy job on your production instance to use anonymized data on your non-production instance for user and data class jobs.\n        - [Activate parallel jobs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/parallel-jobs-anonymization.md) -- Use parallel jobs to reduce your anonymization job execution time.\n        - [Anonymization of encrypted columns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/anonymization-of-encrypted-columns.md) -- When creating data privacy policies, you may include columns that are also protected by Column Level Encryption (CLE). How you handle those columns depends on your organization's compliance requirements.\n        - [Data anonymization errors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-anonymization-errors.md) -- When executing anonymization jobs, the following error states may be encountered. All known runtime errors are listed here.\n      - [Real time anonymization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/real-time-anonymization.md) -- Use the real time anonymization(RTA) policy to anonymize data entries in real time.\n        - [Real time anonymization failures](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/real-time-anonymization-failures.md) -- Review real time anonymization(RTA) failures.\n      - [Real time protection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/real-time-protection.md) -- Analyze user input in real time at the field level to identify sensitive data and alert users about potential sensitive data entry.\n        - [Real time protection policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/real-time-protection-policies.md) -- You can configure policies to protect sensitive data in real-time through alerts and blocking actions.\n        - [User sensitive data logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/user-sensitive-data-logs.md) -- You can view the top 100 activity logs for specific real-time protection policies that contain the most sensitive data from the last month.\n        - [Alert data patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/alert-data-patterns.md) -- Before you can define real-time protection policies, you must create your alert data patterns; reusable groups of data patterns that detect and then alert or block sensitive data across your organization.\n        - [Attachment quarantine policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/attachment-quarantine-policies.md) -- Manage policies that automatically isolate suspicious attachments for security review and analysis.\n        - [Attachment scan findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/attachment-findings.md) -- You can review the findings of your attachment quarantine scans, and work with any quarantined or alerted attachments.\n      - [Activate data privacy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/dps-activate-data-privacy.md) -- Data Privacy includes data classification and anonymization and is installed from the ServiceNow Store.\n    - [Domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-domain-separation.md) -- If any conrefs are broken, re-add them from the doc/source/reuse/domain-separation/domain-separation-overview.dita file. In the short description, edit the first sentence to state whether domain separation is supported or not and add the application name. Keep the conref at the end that describes domain separation.Domain separation is unsupported for data privacy. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n    - [Supported field types for anonymization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-supported-data-types.md) -- Check which field types are supported when anonymizing data.\n    - [Data privacy roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-roles.md) -- Data privacy adds these roles.\n      - [Data privacy administrator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-roles.md) -- Data privacy adds these roles.\n      - [Data privacy auditor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-roles.md) -- Data privacy adds these roles.\n      - [Data privacy clone processor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-roles.md) -- Data privacy adds these roles.\n      - [Data privacy processor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-privacy-classic/data-privacy-roles.md) -- Data privacy adds these roles.\n  - [Data Discovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-landing.md) -- Use Data Discovery to identify sensitive data within an instance, such as credit card information, emails, or social security numbers.\n    - [Exploring Data Discovery (Classic)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery.md) -- Use Data Discovery to identify sensitive data within an instance, such as credit card information, emails, or social security numbers.\n      - [Activating Data Discovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/activate-data-discovery.md) -- The application installs Data Discovery and related ServiceNow Store applications and plugins if they aren't already installed.\n      - [Classify data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/classifying-data.md) -- Classify sensitive data found by all successful jobs through Data Discovery Findings.\n      - [Data Discovery jobs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-jobs.md) -- Data Discovery reviews your targeted information using user-defined data patterns and target tables.\n        - [Configure a job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/configure-data-discovery-jobs.md) -- Configure a Data Discovery job and review the status of ongoing jobs. A Data Discovery job defines when a pattern is executed on a target table.\n          - [Attachment scanning](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-attachment-scanning.md) -- Attachment scanning in Data Discovery enables you to scan, discover, and report on sensitive data in file attachments.\n        - [Configure patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/configure-data-discovery-patterns.md) -- Active data patterns are only used for certain product capabilities.\n          - [Default NER data patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/default-ner-data-patterns.md) -- Use Named Entity Recognition (NER) based discovery to help discover sensitive data that does not follow fixed patterns.\n          - [Default regular expression data patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/default-data-patterns.md) -- Review the default data pattern regular expressions included in Data Discovery. These default data patterns can be used to filter table entries for further classification.\n          - [Using Text to RegEx with the classic UI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/t_generate_regex_classic_ui.md) -- Use the Generate Regex button and modal in the classic UI to automatically create a regular expression from a text description.\n        - [Configure target tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/configure-data-discovery-target-table.md) -- Target tables are only used when defining real time anonymization policies. They are the basis for which users can select tables and columns in the policy creation process.\n        - [Activate parallel jobs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/activate-parallel-jobs-for-data-discovery.md) -- Use parallel jobs to reduce your Data Discovery job execution time.\n      - [Data Discovery roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-roles.md) -- You can assign Data Discovery roles to limit user access to certain data types.\n        - [Data discovery administrator [sn_data_discovery.data_discovery_admin]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-roles.md) -- You can assign Data Discovery roles to limit user access to certain data types.\n        - [Data discovery auditor [sn_data_discovery.data_discovery_auditor]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-roles.md) -- You can assign Data Discovery roles to limit user access to certain data types.\n        - [Data classification administrator [data_classification_admin]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-roles.md) -- You can assign Data Discovery roles to limit user access to certain data types.\n      - [Data Discovery job results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-findings.md) -- The Data Discovery Findings page shows details on the data found by a job. You can use the Findings page to review the results of a job and begin classifying data.\n        - [Classify data in the Data Discovery job results page](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-findings.md) -- The Data Discovery Findings page shows details on the data found by a job. You can use the Findings page to review the results of a job and begin classifying data.\n      - [Data Discovery supported data types](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-supported-data-types.md) -- Check which field types are supported when using Data Discovery.\n      - [Scanning with Granular Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/granular-configuration.md) -- Granular scan can be used to scan specific table columns for discovery. Traditional Data Discovery jobs scan the entire table to discover data, whereas granular scan targets specific columns of the table thereby offers more control over the discovery process\n        - [Granular Findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/granular-findings.md) -- Granular findings may be reviewed using the Granular Findings tool.\n      - [Data Discovery policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/data-discovery-policies.md) -- Use Data Discovery policies to scan specific tables and enable column based jobs.\n        - [Create a policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/create-a-data-discovery-policy.md) -- Create a Data Discovery Policy for granular control over your Data Discovery jobs.\n    - [Data Discovery Store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-data-discovery.md) -- Discover and track sensitive data within a ServiceNow instance\n      - [Data Discovery Store overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-overview.md) -- Get visibility into sensitive data on your instance and work towards implementing security measures to prevent loss or exposure of sensitive data.\n      - [Data Discovery policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-policy.md) -- Use Data Discovery policies to define what sensitive data patterns should be identified and how they should be handled.\n        - [Create new policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-new-policy.md) -- Create a Data Discovery policy to begin scanning tables for data patterns.\n      - [Data Discovery sources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-sources.md) -- Create, and select the data patterns to be used in Data Discovery, and what tables to scan.\n        - [Create new data pattern](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-create-new-data-pattern.md) -- Create a new Data Discovery store pattern.\n          - [Using Text to RegEx](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/c_text_to_regex_overview.md) -- Text to RegEx is an AI-powered capability that automatically generates regular expressions from natural language descriptions, helping you create data patterns without manual regex syntax.\n            - [Generate a regular expression using the discovery UI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/t_generate_regex_discovery_ui.md) -- Use the Text to RegEx feature in the discovery UI to automatically generate a regular expression from a natural language description of the pattern you need.\n            - [Text to RegEx error handling](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/r_error_handling.md) -- When errors occur during regex generation or testing, Text to RegEx displays an error message to help you understand what went wrong and how to resolve the issue.\n            - [Licensing prerequisites for Text to RegEx](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/r_licensing_prerequisites.md) -- Text to RegEx requires specific licenses to be active in your instance and relies on the Now Assist for Vault plugin. This reference describes all licensing requirements you must meet to use Text to RegEx.\n        - [Select active data patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-active-data-patterns.md) -- Active data patterns are only used for certain product capabilities.\n        - [Select target tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-select-target-tables.md) -- Target tables are only used when defining real time anonymization policies. They are the basis for which users can select tables and columns in the policy creation process.\n      - [Data Discovery scheduled discovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-scheduled-discovery.md) -- Set up and schedule data discovery jobs to scan your instance for sensitive information.\n        - [Create discovery job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-create-new-job.md) -- Create and schedule a new Data Discovery Store job.\n        - [Review discovery findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-review-discovery-findings.md) -- Classify data in Data Discovery Store\n        - [Create granular job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-create-granular-job.md) -- Scan specific table columns in Data Discovery Store.\n        - [Review granular findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-discovery/dds-review-granular-findings.md) -- Review granular findings in Data Discovery Store\n  - [Data Classification](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-classification/data-classification.md) -- Group data by type, using pre-defined or user-defined data classifications. If you have an assigned data classification administrator or auditor role, you can administer different data classes or visually analyze the current state of different types of data within the instance.\n    - [Exploring Data Classification](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-classification/exploring-data-classification.md) -- Explore about data classification.\n    - [Installing plugin demo data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-classification/install-data-classification-plugin-demo-data.md) -- When you upgrade to or install Australia (and above), the Data Classification (com.glide.data_classification) plugin is automatically activated. However, you should manually install the demo data that comes with the plugin. It includes several important pre-defined data classifications, and it also assigns one of them to specific User [sys_user] table columns in your instance.\n      - [Components installed with Data Classification demo data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-classification/install-data-classification-plugin-demo-data.md) -- When you upgrade to or install Australia (and above), the Data Classification (com.glide.data_classification) plugin is automatically activated. However, you should manually install the demo data that comes with the plugin. It includes several important pre-defined data classifications, and it also assigns one of them to specific User [sys_user] table columns in your instance.\n    - [Creating data classifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-classification/create-data-classification-codes.md) -- Create your own user-defined data classifications in the Data Classification [data_classification] table that you can then assign to specific columns in specific tables.\n    - [Assigning data classifications to dictionary entries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-classification/apply-data-classification-codes-dictionary-entries.md) -- Assign data classifications to specific table columns in the Dictionary [sys_dictionary] table. When you assign data classifications, it creates entries in the Dictionary-Data Class [m2m_dictionary_dataclass] table, which you can then review in the Overview dashboard.\n    - [Analyzing data classifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-classification/analyze-data-classifications.md) -- The Overview dashboard reports the current state of data classifications within your instance and how your users are distributed by location.\n    - [Domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/data-classification/domain-separation-data-classification.md) -- Domain separation is supported for Data Classification . Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n- [Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/encryption-landing.md) -- Protect your sensitive data and stay compliant with regulatory  requirements and standards.\n  - [Key Management Framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/encryption.md) -- Use the Key Management Framework (KMF) to generate, exchange, store, use, and replace the cryptographic keys used to encrypt and decrypt sensitive data on your ServiceNow instance.\n    - [Exploring the Key Management Framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/explore-kmf.md) -- Learn about the components of the Key Management Framework (KMF), and how to use them to manage how cryptographic operations are performed on your instance.\n      - [Cryptographic module overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/crypto-module-overview.md) -- The Key Management Framework (KMF) is centered around managing Cryptographic modules. Use these modules to select a cryptographic mechanism and define where they're applied on your instance.\n      - [Cryptographic specification overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/cryptographic-purpose.md) -- The Cryptographic specification is the component that defines aspects of your cryptographic module, including its cryptographic purpose and which encryption algorithm to use.\n      - [Module access policy overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/module_access_policy_overview.md) -- Module access policies (MAPs) are access controls that you apply to your cryptographic modules. Use these access policies to decide which users and scripts can access data encrypted by a cryptographic module.\n      - [Instance level keys in the Key Management Framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/instance-level-keys.md) -- Learn about the Key Management Framework (KMF) key structure, which uses envelope encryption to ensure that all platform keys under KMF management are protected through a chain of keys. Customer Data Encryption Keys (CDEKs) created by KMF are also included in this structure\n    - [Configuring the Key Management Framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/configure-kmf.md) -- Create and maintain Key Management components to customize and manage how cryptographic operations are performed on your ServiceNow instance.\n      - [Assign Key Management Framework roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/assign-kmf-roles.md) -- Administrators with the security_admin role can assign Key Management Framework (KMF) admins, who in turn can assign other Key Management Framework roles.\n      - [Configure field encryption settings to select key type](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/configure-field-encryption-settings.md) -- Configure your field encryption settings to use ServiceNow supplied keys or your own customer-supplied keys (CSK) for encryption on the ServiceNow AI Platform.\n      - [Create a cryptographic module](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/create-cryptographic-module.md) -- Create a cryptographic module to define the mechanisms used for cryptographic operations. After you create the module, you create a cryptographic specification, where you define an algorithm for encryption and generates a key.\n        - [Create a cryptographic specification](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/create-crypto-spec.md) -- After you create a cryptographic module, create a cryptographic specification to define the module algorithms.\n        - [Configure key lifecycle states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/configure-key-lifecycle-states.md) -- After you have created a cryptographic specification, you can configure the lifecycle actions for the keys in your instance.\n        - [Generate a ServiceNow cryptographic key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/generate_sn_key.md) -- Follow this procedure to upload and configure a ServiceNow cryptographic key to encrypt sensitive data.\n      - [Create a module access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/create-module-access-policy.md) -- Create module access policies to decide which users and scripts can access data encrypted by a cryptographic module.\n      - [Create a cryptographic module life-cycle policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/create-cryptographic-module-lifecycle-policy.md) -- Create a cryptographic module life-cycle policy to place limits on cryptographic modules, such as how long the key is good for. Create policies to safeguard cryptographic modules by limiting their exposure.\n        - [Create module life-cycle policy exceptions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/create-module-policy-exceptions.md) -- Create a module policy exception to change the life-cycle policy of a key only for a specific on one instance.\n    - [Key Management Framework Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/understanding-kmf.md) -- The Key Management Framework (KMF) API/UX lets you fully customize and manage how cryptographic operations are performed on your ServiceNow instance. The ServiceNow Key Management Framework provides a secure and comprehensive interface for instance-side cryptographic key management services.\n      - [Key Management Framework key life-cycle states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/key-life-cycle-states.md) -- KMF supports several cryptographic key life-cycle states through the enforcement of specific allowable actions. For example, only keys that are in the active state can be used fully for their intended cryptographic purpose. The following table provides further detail on the varying key life-cycle states.\n      - [Roles installed with Key Management Framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/kmf-roles.md) -- The Key Management Framework (KMF) introduces specific roles for cryptographic module and key management-related configurations.\n        - [KMF admin [sn_kmf.admin]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/kmf-roles.md) -- The Key Management Framework (KMF) introduces specific roles for cryptographic module and key management-related configurations.\n        - [KMF cryptographic manager [sn_kmf.cryptographic_manager]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/kmf-roles.md) -- The Key Management Framework (KMF) introduces specific roles for cryptographic module and key management-related configurations.\n        - [KMF cryptographic auditor [sn_kmf.cryptographic_auditor]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/kmf-roles.md) -- The Key Management Framework (KMF) introduces specific roles for cryptographic module and key management-related configurations.\n        - [KMF cryptographic integrator [sn_kmf.cryptographic_integrator]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/kmf-roles.md) -- The Key Management Framework (KMF) introduces specific roles for cryptographic module and key management-related configurations.\n        - [KMF cryptographic operator [sn_kmf.cryptographic_operator]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/kmf-roles.md) -- The Key Management Framework (KMF) introduces specific roles for cryptographic module and key management-related configurations.\n        - [Assign KMF roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/kmf-roles.md) -- The Key Management Framework (KMF) introduces specific roles for cryptographic module and key management-related configurations.\n      - [Module access policy visualization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/map-vis-concept.md) -- Use module access policy visualization to view all relevant cryptographic module information on a single UI page.\n      - [Module access policy debugger](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/map-debugger.md) -- Use the module access policy debugger to review logging information and understand why your users are or aren’t granted access to an encryption context.\n      - [Encryption and Key Management subscription bundle](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/encryption-sku.md) -- With Key Management, Field Encryption is upgraded at no additional charge to include highly configurable encryption modules. You can also optionally upgrade to the unlimited-use license. Subscribe to the new encryption entitlement bundle, Platform Encryption, which includes Field Encryption Enterprise and Cloud Encryption.\n    - [Key management actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/key-management-actions.md) -- One of the core features of KMF is to provide the capability  to manage  keys, such as revoking or rotating keys.  KMF properly secures sensitive data with the most up-to-date encryption materials and life cycle operations.\n      - [View and manage keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/view-manage-keys.md) -- Review the status of any key to determine further key action, such as when to renew, rotate, suspend, deactivate, or destroy a current key.\n      - [Rotate keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/rotate-cust-supplied-keys.md) -- For increased security, you can rotate your cryptographic keys on a pre-determined schedule. Key rotation is when you retire an encryption key and replace that old key by generating a new cryptographic key.\n    - [Import a key from a web service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/import-key-webservice-1.md) -- Securely upload an external customer key onto your instance using import a key from a web service (for example the key REST API). Both symmetric and asymmetric public keys can be imported into a targeted KMF cryptographic module.\n      - [Import the wrapping / unwrapping key pair](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/import-key-webservice-1.md) -- Securely upload an external customer key onto your instance using import a key from a web service (for example the key REST API). Both symmetric and asymmetric public keys can be imported into a targeted KMF cryptographic module.\n      - [Import a wrapped key from a web service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/import-key-webservice-1.md) -- Securely upload an external customer key onto your instance using import a key from a web service (for example the key REST API). Both symmetric and asymmetric public keys can be imported into a targeted KMF cryptographic module.\n    - [Key Management Framework Health](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/kmf_diagnostics.md) -- Access on-demand health status information for the Key Management Framework. Warning and malfunction errors contain a detailed message.\n    - [Prepare your instance for GlideEncrypter deprecation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/check-3des.md) -- Use an instance scan script to find and remove GlideEncrypter API calls on your instance. Removing these calls is a necessary step in deprecating 3DES encryption on your instance.\n      - [GlideEncrypter deprecation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/glideencrypter-deprecation.md) -- Learn how to remove the use legacy GlideEncrypter calls from the scripts on your instance.\n      - [Deprecate GlideEncrypter usage of 3DES for password2 fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/password2-3des-deprecation.md) -- Deprecate GlideEncrypter usage of 3DES encryption standard on your instance ensure that your instance uses the more secure Advanced Encryption Standard (AES) exclusively for the encryption and decryption of your Password2 data.\n    - [Key Management Framework Resource Exchange](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/resource-exchange.md) -- ServiceNow Resource Exchange is a KMF feature that gives you the capability to exchange resources between instances in a secure manner.\n      - [Key Management Framework Key Exchange](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/kmf-key-exchange-overview.md) -- KMF Key Exchange is a subset function of KMF Resource Exchange. Key Exchange securely transfers encrypted data across multiple instances.\n      - [Configure Key Exchange](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/configure-key-exchange.md) -- Key Management Framework (KMF) generates automatic key exchange requests for supported cryptographic modules during the fresh installation or upgrade of the instance, and manages the data encryption key locally for the instance.\n      - [Rekey ciphertext with Key Exchange](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/rekey-keyexchange.md) -- Resource Exchange supports rekeying of ciphertext on the target instance that was encrypted with keys from the source. Rekey activity is tracked in the key life-cycle.\n      - [Recurring Key Exchange walkthrough](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/key-exchange-walkthrough.md) -- Use this walkthrough to set up a recurring key exchange in your instance using and Resource Exchange.\n    - [Infrastructure Security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/infrastructure-security.md) -- Use Infrastructure security tools to create, upload, and manage certificates your instance uses to encrypt traffic from client to server.\n      - [Generate a Certificate Signing Request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/inf-sec-generate-csr.md) -- Use the Generate Certificate Signing (CSR) page to create a certificate signing request to support customer-signed certificates for your instance load balancer.\n    - [Password2 encryption with the Key Management Framework (KMF)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/password-2way-encrypted-fields.md) -- Supported by the Key Management Framework, use the Password2 (2-way encrypted) field type to encrypt and decrypt custom fields with segregation of duties, key protection, and life-cycle management. It works in accordance with NIST 800-57 guidelines and provides FIPS 140-2-L3 protection.\n    - [FlowKMFEncrypter API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/flowkmfencrypter-api.md) -- The FlowKMFEncrypter API provides secure encryption and decryption for ServiceNow Flow Actions, using the Key Management Framework (KMF) crypto operations.\n      - [FlowKMFEncrypter in a Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platform-encryption/allow-flowkmfencrypter-restricted-caller-access.md) -- Resolve the \"undefined is not a function\" error that occurs when a Flow Action calls the FlowKMFEncrypter API, by allowing the operation in the Restricted Caller Access Privilege record.\n  - [Certificates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_Certificates.md) -- Your instance requires certificates to establish secure connections and validate signatures.\n    - [Exploring Certificates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-certificates.md) -- Your instance requires certificates to establish secure connections and validate signatures.\n    - [Generating an LDAP client certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_GenerateAnLDAPClientCertificate.md) -- Generate an LDAP client certificate for mutual authentication using OpenSSL. The final output is a PKCS#12 certificate stored within a Java keystore.\n      - [Generating a server certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_GenerateAServerCertificate.md) -- You can use keytool to generate a new Java keystore file, create a certificate signing request (CSR), and import the private key, public certificate pair, and signed certificates into the keystore.\n    - [Uploading a certificate to an instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_UploadACertificateToAnInstance.md) -- Add a certificate to the instance from the Certificates module.\n      - [Uploading a trusted server certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_UploadATrustedServerCertificate.md) -- By uploading the service provider's trusted server certificate, the instance ensures it is connecting to a valid and secure service.\n  - [Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/field-encryption.md) -- Protect encrypted data on your instance from unauthorized users, scripts, or system processes using Field Encryption.\n    - [Exploring Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-fe.md) -- Learn the details of Field Encryption Starter and Field Encryption Enterprise\n      - [Field Encryption Enterprise](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/now-platform-encryption.md) -- Field Encryption Enterprise uses the Key Management Framework (KMF) to enable you to customize and manage how fields and attachments are encrypted and decrypted on your instance. A subscription is required to use Field Encryption Enterprise.\n    - [Configuring Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configuring-column-level-encryption.md) -- Learn how to activate and configure Field Encryption and manage migration from Encryption Support.\n      - [Activate Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/activate-platform-encryption.md) -- Activate either Field Encryption Starter or Field Encryption Enterprise.\n      - [Role requirements for Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/fe-roles.md) -- Learn about the roles required to configure Field Encryption.\n      - [Configure Field Encryption modules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-fe-modules.md) -- Learn how to configure Field Encryption modules.\n      - [Cryptographic specifications for Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-fe-crypto-specs.md) -- Use cryptographic specifications to define the purpose, algorithm, key length, mode, and origin of your encryption key.\n      - [Module keys for Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/fe-module-keys.md) -- The Module Keys tab shows you summary level information about your Field Encryption Data Encryption Key(s). You can view the Key alias, Key type, Algorithm, Key lifecycle state, and Key version.\n      - [Module lifecycle policy exceptions for Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/module-lifecycle-policy-exceptions-for-fe.md) -- Use module lifecycle policy exceptions to customize the lifecycle of your module keys.\n      - [Configure Customer-supplied keys for Field Encryption Enterprise](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/fe-config-customer-supplied-keys.md) -- Bring your own data encryption key to the platform instead of using the one that ServiceNow generates.\n        - [Configure properties for customer-supplied key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-properties-for-customer-supplied-key.md) -- Review the system properties for the ephemeral public wrapping key that your instance uses to unwrap customer-supplied keys.\n        - [Wrap your customer-supplied key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/wrap-your-customer-supplied-key.md) -- Wrap your symmetric data encryption key with an ephemeral public wrapping key before you can upload it to your instance.\n      - [Configure encrypted field configurations for fields or attachments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-fe-fields-attachments.md) -- Create an encrypted field configuration to specify which fields are encrypted on a table, and whether that table's attachments are encrypted.\n      - [Configure multi-module encrypted field configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/multi-module-fe-config.md) -- Create an encrypted field configuration that uses more than one encryption module.\n      - [Configure module access policies for Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/maps-for-fe.md) -- Create a module access policy to control which users, scripts, or system processes can encrypt or decrypt data encrypted by a field encryption module.\n      - [Migrating to Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/migration-to-platform-encryption.md) -- Scheduled jobs migrate your keys and encrypted data from Encryption Support to Field Encryption.\n        - [Field Encryption migration status page](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cle-migration-status-page.md) -- Use the migration status page to track the migration of encryption contexts to encryption modules.\n      - [Migrate from Edge Encryption to Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/migrate-ee-to-fe.md) -- Migrate from Edge Encryption to Field Encryption to take advantage of the latest security features.\n        - [Configure Field Encryption for your Edge Encrypted fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/migrate-ee-to-fe-1.md) -- Before migrating your existing edge encrypted fields to Field Encryption, you must configure field encryption for these fields.\n      - [Field Encryption and system clones](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/fe-system-clones.md) -- Cloning an instance with Field Encryption installed automatically generates new field encryption module encryption keys on the target clone instance.\n      - [Prevent users from attaching unencrypted files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/attach-enc-property.md) -- Modify the com.glide.encryption.enable_attachment_key_ui property to prevent your users with access to an encryption module key from attaching unencrypted attachments.\n    - [Using Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/using-column-level-encryption.md) -- Use Field Encryption to manage access to encrypted data on your instances.\n      - [Create cryptographic module for Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-PE-cryptographic-module.md) -- Create a Field Encryption cryptographic module to define the mechanisms used for cryptographic operations.\n      - [Using multiple encryption modules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/using-multiple-encryption-modules.md) -- Multiple encryption modules enable data to be encrypted with more than one encryption module. If each module has its own access policy based on a role, for example, users with different roles can encrypt data on the same table but used to help prevent them from viewing each other's encrypted data.\n        - [Encrypt data using Row Conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/encrypt-data-using-row-conditions.md) -- Encrypt fields with multiple Field Encryption modules using Row Conditions to define the data being encrypted and the associated encryption keys. Row Conditions can also be used to define the users that have access using the condition builder.\n        - [Encrypt data using the Multiple Modules feature](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/encrypt-data-using-multiple-modules-feature.md) -- Encrypt data with more than one encryption module permitting the user to determine which keys are used for specific rows within the encrypted data.\n      - [Create a cryptographic specification for Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-crypto-spec-pe.md) -- After you create a cryptographic module, access the corresponding cryptographic specification to define the algorithm.\n      - [Configure advanced algorithms for Field Encryption Enterprise](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/adv-algorithm-cleent.md) -- Create a cryptographic specification to define the algorithm for a cryptographic module. Customize the encryption specifications with advanced options that are available for Field Encryption Enterprise.\n      - [Using customer-supplied keys with Field Encryption Enterprise](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/csk-landing.md) -- You can use your own customer-supplied key instead of using the ServiceNow system-generated keys.\n        - [Configure properties for customer-supplied keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/customer-supplied-keys.md) -- If the Field Encryption Enterprise plugin is enabled, you can use system properties to define key padding, ephemeral key pair size, and a key validity period of your customer-supplied keys.\n        - [Wrap your customer-supplied key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/wrap-customer-supplied-key.md) -- Wrap the symmetric key to use for encryption with the downloaded public key.\n        - [Configure and upload your customer supplied key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/upload-customer-supplied-key.md) -- You can use your own customer-supplied key instead of using the ServiceNow system-generated keys.\n      - [Encrypting fields and attachments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/field-encryption-key-management.md) -- Once cryptographic modules are created, a security admin can define the encrypted fields configuration (EFC) and opt to encrypt a field or attachment on a table.\n        - [Set encrypted field configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/set-encrypted-field-config.md) -- Configure which table columns or attachments that the system encrypts using a preconfigured cryptographic module.\n        - [Script access for cryptographic modules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/script-map.md) -- Scripts can be run to access a cryptographic module policy for a cryptographic purpose.\n          - [Configure script access to encrypted data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-script-encryption.md) -- Execute a script to run the cryptographic module policy for a cryptographic purpose. Specific read (decrypt/unwrap) or write (encrypt, wrap) access can be defined based on the module access policy operation granularity.\n            - [View declined cryptographic module usage requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/view-declined-crypto-module-usage-requests.md) -- View cryptographic modules that rejected encryption requests made by scripts because of unsupported encryption mechanisms.\n        - [Schedule mass encryption, decryption, and rekeying jobs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/schedule-mass-jobs.md) -- Schedule encryption, decryption, and rekeying jobs to run at a time that is best for your instance.\n        - [Run mass encryption or decryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/mass-enc-dec.md) -- You can run mass encryption on encryption configurations, as well as a mass decryption to decrypt previously encrypted values.\n        - [Upload attachments for encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/upload-attachments-for-encryption.md) -- Protect sensitive files by encrypting record attachments using Field Encryption and Row Conditions.\n        - [Module access policies for inbound email attachment encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/fe-maps-inbound-email-attachment-encryption.md) -- Encrypting inbound email attachments associated with matched records requires one or more module access policies (MAPs).\n          - [Create a system module access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/fe-create-system-map.md) -- Create a module access policy (MAP) for a matched user to encrypt attachments when inbound email processing runs as that user.\n          - [Create a user module access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/fe-create-user-map.md) -- Create a module access policy (MAP) for a matched user to encrypt attachments when inbound email processing runs as that user.\n      - [Field Encryption Enterprise examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/kmf-walkthroughs-tutorials.md) -- These examples walk you through the encryption of fields and attachments using customer-supplied keys.\n        - [Field Encryption Enterprise walkthrough](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/kmf-walkthroughs-tutorials.md) -- These examples walk you through the encryption of fields and attachments using customer-supplied keys.\n        - [Attachment encryption walkthrough](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/kmf-walkthroughs-tutorials.md) -- These examples walk you through the encryption of fields and attachments using customer-supplied keys.\n    - [External Key Management Service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-external-key-management.md) -- External Key Management Service (EKMS) enables you to integrate Field Encryption with your own external key management systems.\n      - [Configuring External Key Management Service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-configuring-external-key-management.md) -- Set up External Key Management Service (EKMS) to control the encryption of your ServiceNow data using your Amazon Web Service Key Management System (AWS KMS).\n        - [Activate External Key Management Service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-activate-external-key-management.md) -- Install the External Key Management Service (EKMS) plugin and configure user permissions to enable external key management functionality.\n        - [Configure an external key definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-configure-external-key-definition.md) -- Configure your external encryption key to use in External Key Management Service (EKMS).\n        - [Create a cryptographic module with external key wrapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-create-crypto-module.md) -- Create a cryptographic module that uses external Amazon Web Services Key Management System (AWS KMS) key wrapping to encrypt ServiceNow data.\n        - [Create Encrypted Field Configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-create-encrypted-field-config.md) -- Configure specific fields to be encrypted using your External Key Management Service (EKMS) cryptographic module with external Amazon Web Services Key Management System (AWS KMS) key wrapping.\n        - [Set up Module Access Policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-set-up-maps.md) -- Configure module access policies in External Key Management Service (EKMS) to control who can view encrypted data in clear text.\n        - [Test an external key definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-test-external-key-definition.md) -- Test your external encryption key to use in External Key Management Service (EKMS).\n      - [Using External Key Management Service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-using-external-key-management.md) -- Manage and maintain your External Key Management Service (EKMS) configuration after initial setup\n        - [Change the status of an AWS KMS Key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-change-status-aws-kms-key.md) -- Modify the status of your Amazon Web Services Key Management System (AWS KMS) key and synchronize the status with your ServiceNow instance.\n        - [Check External Key Management Service Key Status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-check-key-status.md) -- View the status of your Amazon Web Services Key Management System (AWS KMS) key in your instance.\n        - [Change synchronization frequency](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-change-synchronization-frequency.md) -- Modify the system property to change how often External Key Management Service (EKMS) synchronizes Amazon Web Service Key Management Service (AWS KMS) key status with your instance.\n        - [External Key Management Service and instance automation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ekms-instance-automation.md) -- Understand requirements and limitations for instance automation operations when External Key Management Service is enabled.\n  - [Column Level Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/column-level-encryption-landing.md) -- Column Level Encryption permits and denies access to encrypted data based on user role. Column Level Encryption includes basic key management using encryption modules.\n    - [Exploring Column Level Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-column-level-encryption.md) -- Learn more about Field Encryption.\n      - [Column Level Encryption Guided Tour](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cle-tour.md) -- The tour gives a brief overview of the Column Level Encryption setup needed to encrypt table fields or attachments.​ Steps for the creation of Field Encryption Modules, Module Access Policies, and Encrypted Field Configurations are also covered. The tour includes links to detailed documentation and the ServiceNow University Column Level Encryption Overview course.​\n      - [Column Level Encryption Enterprise](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/now-platform-encryption-2.md) -- Column Level Encryption Enterprise uses the Key Management Framework (KMF) to enable you to customize and manage how fields and attachments are encrypted and decrypted on your instance. A subscription is required to use Column Level Encryption Enterprise.\n    - [Configuring Column Level Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configuring-column-level-encryption-2.md) -- Learn how to activate and configure Column Level Encryption and manage migration from Encryption Support.\n      - [Activate Column Level Encryption Enterprise](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/activate-platform-encryption-2.md) -- With subscription to Column Level Encryption Enterprise, an admin can activate the com.glide.now.platform.encryption plugin.\n      - [Migrating to Column Level Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/migration-to-platform-encryption-2.md) -- Scheduled jobs migrate your keys and encrypted data from Encryption Support to Column Level Encryption.\n      - [Prevent users from attaching unencrypted files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/attach-enc-property.md) -- Modify the com.glide.encryption.enable_attachment_key_ui property to prevent your users with access to an encryption module key from attaching unencrypted attachments.\n    - [Using Column Level Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/using-column-level-encryption-2.md) -- Use Column Level Encryption to manage access to encrypted data on your instances.\n      - [Create cryptographic module for Column Level Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-PE-cryptographic-module-2.md) -- Create a Field Encryption cryptographic module to define the mechanisms used for cryptographic operations.\n      - [Encrypt data using the Multiple Modules feature](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/encrypt-data-using-multiple-modules-feature.md) -- Encrypt data with more than one encryption module permitting the user to determine which keys are used for specific rows within the encrypted data.\n      - [Create a cryptographic specification for Column Level Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-crypto-spec-pe-2.md) -- After you create a cryptographic module, access the corresponding cryptographic specification to define the algorithm.\n      - [Configure advanced algorithms for Column Level Encryption Enterprise](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/adv-algorithm-cleent-2.md) -- Create a cryptographic specification to define the algorithm for a cryptographic module. Customize the encryption specifications with advanced options that are available for Column Level Encryption Enterprise.\n      - [Using customer supplied keys with Column Level Encryption Enterprise](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/csk-landing-2.md) -- You can use your own customer-supplied key instead of using the ServiceNow system-generated keys.\n        - [Configure properties for customer-supplied keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/customer-supplied-keys.md) -- If the Field Encryption Enterprise plugin is enabled, you can use system properties to define key padding, ephemeral key pair size, and a key validity period of your customer-supplied keys.\n        - [Wrap your customer-supplied key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/wrap-customer-supplied-key.md) -- Wrap the symmetric key to use for encryption with the downloaded public key.\n        - [Configure and upload your customer supplied key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/upload-customer-supplied-key.md) -- You can use your own customer-supplied key instead of using the ServiceNow system-generated keys.\n      - [Encrypting fields and attachments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/field-encryption-key-management.md) -- Once cryptographic modules are created, a security admin can define the encrypted fields configuration (EFC) and opt to encrypt a field or attachment on a table.\n        - [Set encrypted field configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/set-encrypted-field-config.md) -- Configure which table columns or attachments that the system encrypts using a preconfigured cryptographic module.\n        - [Script access for cryptographic modules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/script-map.md) -- Scripts can be run to access a cryptographic module policy for a cryptographic purpose.\n          - [Configure script access to encrypted data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-script-encryption.md) -- Execute a script to run the cryptographic module policy for a cryptographic purpose. Specific read (decrypt/unwrap) or write (encrypt, wrap) access can be defined based on the module access policy operation granularity.\n            - [View declined cryptographic module usage requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/view-declined-crypto-module-usage-requests.md) -- View cryptographic modules that rejected encryption requests made by scripts because of unsupported encryption mechanisms.\n        - [Schedule mass encryption, decryption, and rekeying jobs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/schedule-mass-jobs.md) -- Schedule encryption, decryption, and rekeying jobs to run at a time that is best for your instance.\n        - [Run mass encryption or decryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/mass-enc-dec.md) -- You can run mass encryption on encryption configurations, as well as a mass decryption to decrypt previously encrypted values.\n      - [Column Level Encryption Enterprise examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/kmf-walkthroughs-tutorials-2.md) -- These examples walk you through the encryption of fields and attachments using customer-supplied keys.\n        - [Column Level Encryption Enterprise walkthrough](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/column-level-encryption-enterprise-walkthrough-2.md) -- This walkthrough shows you how to encrypt a field in your instance using Field Encryption Enterprise with the Key Management Framework (KMF). It also shows you how to use your own key.\n        - [Attachment encryption walkthrough](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/attachment-encryption-walkthrough.md) -- This walkthrough shows you how to encrypt an attachment in your instance using Field Encryption Enterprise with the Key Management Framework (KMF). It also shows you how to use your own key.\n  - [Cloud Encryption with Key Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/dare-overview.md) -- ServiceNow Cloud Encryption offers encrypted storage for the database using block encryption, along with enhanced key management. Cloud Encryption is available with the ServiceNow Platform Encryption subscription bundle.\n    - [Key management operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-operations-ce.md) -- The Key Management Operations submodule provides access to view and manage all encryption keys used with ServiceNow Cloud Encryption.\n      - [Rotate a ServiceNow managed key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-operations-ce.md) -- The Key Management Operations submodule provides access to view and manage all encryption keys used with ServiceNow Cloud Encryption.\n      - [Prepare your customer managed key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-operations-ce.md) -- The Key Management Operations submodule provides access to view and manage all encryption keys used with ServiceNow Cloud Encryption.\n      - [Switch between ServiceNow and customer-managed keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-operations-ce.md) -- The Key Management Operations submodule provides access to view and manage all encryption keys used with ServiceNow Cloud Encryption.\n      - [Rotate a customer managed key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-operations-ce.md) -- The Key Management Operations submodule provides access to view and manage all encryption keys used with ServiceNow Cloud Encryption.\n      - [Switch to a customer managed key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-operations-ce.md) -- The Key Management Operations submodule provides access to view and manage all encryption keys used with ServiceNow Cloud Encryption.\n      - [Switch to a ServiceNow managed key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-operations-ce.md) -- The Key Management Operations submodule provides access to view and manage all encryption keys used with ServiceNow Cloud Encryption.\n      - [Schedule key rotation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-operations-ce.md) -- The Key Management Operations submodule provides access to view and manage all encryption keys used with ServiceNow Cloud Encryption.\n      - [Withdraw a customer managed key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-operations-ce.md) -- The Key Management Operations submodule provides access to view and manage all encryption keys used with ServiceNow Cloud Encryption.\n      - [Resupply a customer managed key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-operations-ce.md) -- The Key Management Operations submodule provides access to view and manage all encryption keys used with ServiceNow Cloud Encryption.\n    - [Quorum Control Policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/quorum-ctrl-policy.md) -- The Quorum Control Policy specifies the minimum number of approvals required among the total number of selected approvers to reach quorum for customer managed key withdrawal.\n      - [Configure Quorum Control Policy Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/configure-quorum.md) -- Follow these steps to configure Quorum Control Policy Settings.\n      - [Manage Quorum Control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/quorum-ctrl-mgmt.md) -- After a withdrawal operation workflow is triggered, quorum actions can be managed from the Key Management Operations page. The key withdrawal operation is blocked until the quorum is met.\n        - [Approve or deny a quorum control request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/quorum-transactions-approval.md) -- Approve or deny a quorum control request from Key Management Transactions.\n        - [Approve or deny a quorum request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/perform-quorum-action.md) -- When a quorum request has been created, the minimum number of approvals is required by the members. After a withdrawal operation workflow is triggered, quorum actions can be managed using several methods. The users can grant approvals from the Key Management Operations page, My Approvals in the Instance, or directly from the request email. The key withdrawal operation is blocked until the quorum is met.\n    - [Key management transactions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/key-mgmt-transactions-ce.md) -- The Key Management Transactions submodule displays all transactions that have occurred for the keys in your ServiceNow instance.\n    - [Cloud Encryption logging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/dare-logging.md) -- Learn about logging options for Cloud Encryption.\n    - [Tamper Detection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/cloud-encryption/tamper-detect.md) -- Use tamper detection to improve security by detecting unauthorized changes to your quorum control settings.\n  - [Full disk encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/full-disk-encryption.md) -- Full disk encryption (FDE) applies encryption to the entire storage system within the database server only, because this is the only customer data-storing component. FDE protects only against physical loss or theft of storage devices. When encrypted disk servers are powered on and providing data, the encryption provides no additional protection.\n  - [Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-encryption.md) -- ServiceNow Edge Encryption encrypts sensitive data on your company premises before sending it over the Internet to your ServiceNow instance (encrypted in flight), where it remains encrypted at rest.\n    - [Exploring Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EdgeEncryptionOverview.md) -- Edge Encryption is a network encryption system that resides on your network and that encrypts and decrypts sensitive data as it travels between your data center and the ServiceNow cloud.\n      - [Edge Encryption components](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EdgeEncryptionProxy.md) -- Edge Encryption is composed of the Edge Encryption proxy server that runs on a server in your network, and the Edge Encryption plugin that must be installed on your ServiceNow instance. If using order-preserving encryption types or encryption patterns, a proxy database must also be installed in your network.\n      - [Edge Encryption clients](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-clients.md) -- Edge Encryption uses three clients to inform the instance that the proxy is running, to synchronize requests between the proxy and the instance, and to forward all end user requests to the instance after any potential encryption.\n      - [Key management for Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptionKeyManagement.md) -- You are responsible for providing and managing the encryption keys used by Edge Encryption.\n        - [SafeNet key versioning](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/safenet-key-versioning.md) -- Use SafeNet key versioning to simplify changing keys. Instead of creating an alias for every new key, SafeNet key versioning keeps the same alias and increments the version.\n      - [Encryption configurations and patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptionTypes.md) -- With Edge Encryption, you can encrypt fields and tokenize strings.\n      - [Installed with Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/installed-with-edge-encryption.md) -- Edge Encryption installs tables to store encryption-related data, system properties to configure default behavior, and the edge_encryption role to administer Edge Encryption.\n    - [Planning for Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EdgeEncryptionPlanning.md) -- Successful implementation of Edge Encryption requires planning and preparation.\n      - [System requirements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/r_CloudEdgeSystemRequirements.md) -- You can run the Edge Encryption proxy application on servers or virtual machines that run on Microsoft Windows or Linux operating systems. For optimum performance, ensure that your configuration meets these requirements.\n      - [Sizing your environment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-environment-size.md) -- Choosing the number of proxy servers for your environment is an important task. Consider the number of users, redundancy needs, and acceptable latency.\n      - [Calculate the order-preserving and tokenization database size](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/size-db.md) -- If using order-preserving encryption or encryption patterns, determine the size of your MySQL database by multiplying the number of potential records by record size.\n      - [Edge Encryption limitations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-encryption-limitations.md) -- Edge Encryption impacts system functions. Carefully evaluate the impact of encrypting a field.\n    - [Installing Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_InstallEdgeEncryptionProxy.md) -- You can install an Edge Encryption proxy manually or using the Edge Encryption interactive installer.\n      - [Request Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_InstallCloudEdge.md) -- The Edge Encryption plugin (com.glide.edgeencryption) is available as a separate subscription.\n      - [Set up an Edge Encryption user account](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_SetupEdgeEncryptionUser.md) -- The Edge Encryption proxies connect to the instance as a user to obtain and update encryption configuration information. Create a user account for this purpose and give the edge_encryption role to the user.\n      - [Download the Edge Encryption proxy server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_DownloadtheProxy.md) -- Download the Edge Encryption proxy server application from your instance, and then copy the file to each computer that is to run the Edge Encryption proxy server.\n      - [Install the Edge Encryption proxy server using the interactive installer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/proxy-installer.md) -- Install the Edge Encryption proxy server on a Windows or Linux computer using the interactive installer.\n        - [Install the proxy server (interactive installer)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/install-proxy.md) -- Install the Edge Encryption proxy on a Windows or Linux computer.\n        - [Configure CyberArk properties protection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/configure-cyberark-prop-protection.md) -- Optionally, configure CyberArk properties protection to securely store Edge Encryption passwords in a centralized and secure digital vault.\n        - [Configure the signature key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/configure-sig-key.md) -- Configure the signature key after installing the proxy server through the Edge Encryption proxy installer.\n        - [Configure the HTTPS certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/configure-cert.md) -- To enable clients to connect to the Edge Encryption proxy server using a secure SSL connection, import the HTTPS certificate to the proxy server.\n        - [Configure the AES 128-bit encryption key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/configure-128-key.md) -- After you configure the HTTPS certificate through the Edge Encryption proxy installer, configure the AES 128-bit encryption key to encrypt your data.\n        - [Configure the AES 256-bit encryption key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/configure-256-key.md) -- After you configure the AES 128-bit key through the Edge proxy installer, you can optionally configure an AES 256-bit encryption key to encrypt your data.\n        - [Update SSL certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/update-ssl-certificate.md) -- When updating an SSL certificate on an Edge proxy server, you must delete the old one.\n        - [Configure the proxy database](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/configure-proxy-db.md) -- If using order-preserving encryption types or encryption patterns, you can optionally configure the Edge Encryption proxy database properties.\n        - [Launch the proxy server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/launch-proxy.md) -- After an Edge Encryption proxy is installed and configured, you can start the proxy from the installer.\n        - [Verify and troubleshoot proxy server installation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/verify-install.md) -- After your Edge Encryption proxy is installed, you can verify the installation to locate problems or start and stop the proxy.\n      - [Install the Edge Encryption proxy server using the command line installer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/manual-proxy-install.md) -- Manually install multiple Edge Encryption proxy servers in your network.\n        - [Install the proxy server (command line installer)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/install-edge-linux-windows.md) -- Install an Edge Encryption proxy on a 64-bit Windows or Linux computer.\n        - [Create and configure the RSA key pair for the digital signature](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_SetUpAKeyPair.md) -- Create an RSA key pair that the proxy server can use to create the digital signature for signing changes to the encryption properties and configuration.\n        - [Import and configure the certificate for secure SSL connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_SetUpSecureSSLConnection.md) -- To use a secure SSL connection, import a server certificate and add it to the Java KeyStore.\n        - [Set up a keystore and encryption keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/set-up-keystore.md) -- Set up the keystore and encryption keys used by the Edge Encryption proxy server.\n          - [Set up a Java KeyStore keystore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_JavaKeyStoreSetUp.md) -- You can use a Java KeyStore keystore to store encryption keys.\n            - [Create encryption keys using the Java KeyStore keytool](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_CreateEncryptionKeys.md) -- You can use the keytool shipped with the encryption proxy distribution to create AES 128-bit and AES 256-bit encryption keys.\n          - [Set up a SafeNet KeySecure keystore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_SetUpNAEKeyStore.md) -- If you are using a SafeNet keystore, copy a set of libraries into the proxy distribution directory.\n            - [Upgrade from Kingston or lower to London or higher](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_SetUpNAEKeyStore.md) -- If you are using a SafeNet keystore, copy a set of libraries into the proxy distribution directory.\n          - [Set up Unbound Technology keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/unbound-key-install.md) -- Use Unbound Technology (previously Dyadic Security) keys with Edge Encryption by storing the base64-encoded wrapped encryption key as text file on the Edge Encryption proxy server and providing the wrapping key alias. The Unbound Technology implementation maintains control of the wrapping key.\n          - [Create an encryption key stored in a file](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_CreateAFileStoreKeyStore.md) -- You can use a simple text file as a keystore. Each file holds a single encryption key.\n        - [Configure encryption keys on the instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_RotateEncryptionKeys.md) -- Edge Encryption provides the tools to manage encryption keys without taking the proxy offline.\n        - [Configure additional properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/set-props.md) -- After installing the Edge Encryption proxy server in your network and setting up your keystore and keys, configure the additional Edge Encryption properties.\n        - [Configure a web proxy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_SetUpWebProxyProperties.md) -- If your network uses a web proxy, you can set up the Edge Encryption proxy to use the web proxy.\n        - [Set proxy server memory limits](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/increase-memory.md) -- Set the initial memory limit and upper bound memory limit to specify how much memory the proxy server can consume. Set these limits to avoid performance issues in your Edge Encryption implementation.\n        - [Start the proxy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_RuntheProxy.md) -- After an Edge Encryption proxy is installed and configured, you can start the proxy from the command line.\n        - [Obfuscate passwords in the properties file](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_SetUpPasswordEncryption.md) -- Obfuscate passwords in the edgeencryption.properties file to be able to share the properties file without revealing clear text passwords.\n        - [Manually add an additional proxy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_AddAdditionalProxies.md) -- After the first Edge Encryption proxy is properly configured and tested, you can set up additional proxies on a Linux or Windows machine. Installing multiple proxies on the same machine is not recommended.\n      - [Authenticate a proxy server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/authenticate-edge-proxy.md) -- Specify that a proxy server is a trusted source so that Edge Encryption can process requests coming from that proxy server.\n      - [Stop the proxy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_StoptheProxy.md) -- You can stop an Edge Encryption proxy from the command line.\n      - [Uninstall the proxy on Linux](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_UninstalltheProxy.md) -- You can uninstall the Edge Encryption proxy. If you are upgrading the proxy, it is not necessary to shut down and uninstall the current version.\n      - [Uninstall the proxy on Windows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_UninstalltheProxyonWindows.md) -- You can uninstall the Edge Encryption proxy. If you are upgrading the proxy, it is not necessary to shut down and uninstall the current version.\n      - [Set up multiple provider SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/SSO-edge.md) -- Set up multiple provider SSO to enable logging in through the Edge Encryption proxy server URL or the instance URL. If you are implementing multiple provider single sign-on (SSO) with Edge Encryption enabled, some users might need to log in to your instance through the Edge Encryption proxy server, while other users might not.\n      - [Edge Encryption proxy server properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-encryption-proxy-server-properties.md) -- The edgeencryption.properties configuration file located in the <installation directory>/conf/ folder contains properties used to configure your environment.\n      - [CyberArk integration with the Edge proxy server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/cyberark-integration-edge-proxy.md) -- Use CyberArk to store passwords in a centralized and secure digital vault to secure passwords that were previously stored in clear text and secured by file access, or that were previously encrypted via a second file.\n      - [Using a load balancer with the Edge proxy server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/load-balancer-edge-proxy.md) -- You can use a load balancer to balance the load across the proxy servers in your Edge Encryption proxy setup. If the load balancer and proxy servers are using different ports, specify the host name and HTTPS port of the load balancer to enable users to view responses on their browser.\n        - [Configure the load balancer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/load-balancer-edge-proxy.md) -- You can use a load balancer to balance the load across the proxy servers in your Edge Encryption proxy setup. If the load balancer and proxy servers are using different ports, specify the host name and HTTPS port of the load balancer to enable users to view responses on their browser.\n    - [Upgrading Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_UpdateEdgeEncryptionProxy.md) -- Both instance upgrades and proxy server upgrades require special consideration in an Edge Encryption environment.\n      - [Schedule proxy server upgrade](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/schedule-proxy-upgrade.md) -- Create an upgrade schedule to enable the instance to upgrade an out-of-date proxy server.\n      - [Manually upgrade a proxy server running on Linux](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_UpdateEEProxyOnLinux.md) -- Update a proxy running on Linux.\n      - [Manually upgrade a proxy server running on Windows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_UpdateEEProxyOnWindows.md) -- Update a proxy running on Windows.\n      - [Roll back a proxy server upgrade](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_RollBackAProxyUpdate.md) -- If a proxy upgrade is unsuccessful, you can go back to the earlier version.\n    - [Configuring Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-config.md) -- After the Edge Encryption proxy server is installed and running, manage Edge Encryption through the proxy server.\n      - [Rotate encryption keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptionKeyRotation.md) -- Perform encryption key rotation from the instance. Add a new key, change the default key assignment, and then schedule a mass key rotation or a single key rotation.\n        - [Schedule a single key rotation job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptionKeyRotation.md) -- Perform encryption key rotation from the instance. Add a new key, change the default key assignment, and then schedule a mass key rotation or a single key rotation.\n        - [Schedule a mass key rotation job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptionKeyRotation.md) -- Perform encryption key rotation from the instance. Add a new key, change the default key assignment, and then schedule a mass key rotation or a single key rotation.\n        - [Schedule an attachment key rotation job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptionKeyRotation.md) -- Perform encryption key rotation from the instance. Add a new key, change the default key assignment, and then schedule a mass key rotation or a single key rotation.\n      - [Encrypt fields using encryption configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_ConfigureCloudEdge.md) -- Encrypt fields by creating encryption configurations.\n        - [Create a field encryption configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_ConfigureCloudEdge.md) -- Encrypt fields by creating encryption configurations.\n        - [Create a variable encryption configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_ConfigureCloudEdge.md) -- Encrypt fields by creating encryption configurations.\n        - [Deactivate an encryption configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_ConfigureCloudEdge.md) -- Encrypt fields by creating encryption configurations.\n        - [Schedule an encryption job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_ConfigureCloudEdge.md) -- Encrypt fields by creating encryption configurations.\n        - [Schedule a decryption job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_ConfigureCloudEdge.md) -- Encrypt fields by creating encryption configurations.\n      - [Encrypt attachments using standard encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptingAttachments.md) -- You can encrypt attachments for specific tables.\n        - [Configure attachment encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptingAttachments.md) -- You can encrypt attachments for specific tables.\n        - [Schedule an attachment encryption job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptingAttachments.md) -- You can encrypt attachments for specific tables.\n        - [Schedule an attachment decryption job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptingAttachments.md) -- You can encrypt attachments for specific tables.\n      - [Change a field or attachment's encryption type](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_ChangeAFieldsEncryptionType.md) -- You can change a field or attachment's encryption type by selecting a new encryption type in the existing encryption configuration record. A specific table and field combination can only have one active configuration at a time.\n      - [Tokenize strings using encryption patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_ConfigureBasicEncryptionPatterns.md) -- You can replace string patterns with tokens before they are sent to and stored in the instance.\n      - [Repair or recover order-preserving encrypted data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EdgeEncryptionJobs.md) -- If you have the security-admin role, you can schedule jobs performed by the Edge Encryption proxy to repair or recover fields that use order preserving encryption.\n        - [Schedule an order token repair job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EdgeEncryptionJobs.md) -- If you have the security-admin role, you can schedule jobs performed by the Edge Encryption proxy to repair or recover fields that use order preserving encryption.\n        - [Schedule a proxy-database recovery job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EdgeEncryptionJobs.md) -- If you have the security-admin role, you can schedule jobs performed by the Edge Encryption proxy to repair or recover fields that use order preserving encryption.\n      - [Configure the IP address deny list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/deny-list-IPs.md) -- Prevent an IP address in your network from sending requests to your instance\n      - [Encrypt data from a record producer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/record-producers-edge.md) -- Configure your Edge Encryption proxy server to allow inserts from a record producer by creating encryption rules from the record producer record.\n      - [Define a custom encryption rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptionRules.md) -- It may be necessary to identify and encrypt sensitive information in HTTP requests on the way to your instance. You can write encryption rules to identify, interpret, and encrypt data in such requests, mapping fields in the request to table-field names on your instance.\n        - [Inspect the client request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/request-type.md) -- Before creating a custom encryption rule, you must determine the format of the client request entering the Edge Encryption proxy server.\n        - [Create an encryption rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/t_CreateAnEncryptionRule.md) -- Encryption rules are used by the proxy to find content in HTTP requests that should be encrypted.\n        - [Encryption rule conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptionRuleConditions.md) -- Encryption rule conditions determine if the rule should be executed.\n        - [Encryption rule actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_EncryptionRuleActions.md) -- An encryption rule maps fields in a client request to fields in a table on your instance and identifies fields marked for encryption.\n        - [Encryption rule objects and APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/api-overview.md) -- Use encryption rule APIs to parse and encrypt values in requests moving through the Edge Encryption proxy server to the instance.\n          - [request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_requestAPI.md) -- The request object is a global object available in Edge Encryption rule action and condition scripts.\n            - [request - getAsJsonContent()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_requestAPI.md) -- The request object is a global object available in Edge Encryption rule action and condition scripts.\n            - [request - getAsXmlContent()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_requestAPI.md) -- The request object is a global object available in Edge Encryption rule action and condition scripts.\n            - [request - XMLContains(String path)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_requestAPI.md) -- The request object is a global object available in Edge Encryption rule action and condition scripts.\n          - [POST and URL parameter APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/param-apis.md) -- POST and URL parameters can be accessed as properties of the request object using request.postParams and request.urlParams.\n            - [ParameterValue - toString()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/param-apis.md) -- POST and URL parameters can be accessed as properties of the request object using request.postParams and request.urlParams.\n            - [ParameterValue - getAsJsonContent()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/param-apis.md) -- POST and URL parameters can be accessed as properties of the request object using request.postParams and request.urlParams.\n            - [ParameterValue - getAsXmlContent()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/param-apis.md) -- POST and URL parameters can be accessed as properties of the request object using request.postParams and request.urlParams.\n            - [ParameterValue - encodedQueryFor(String tableName)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/param-apis.md) -- POST and URL parameters can be accessed as properties of the request object using request.postParams and request.urlParams.\n            - [ParameterValue - valueFor(String tableName, String fieldName)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/param-apis.md) -- POST and URL parameters can be accessed as properties of the request object using request.postParams and request.urlParams.\n          - [XML APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/xml-overview.md) -- XML APIs can be used after calling getAsXmlContent() on either the request object or a ParameterValue property.\n            - [XMLContent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLContentAPI.md) -- A global object that provides methods to iterate over the XML content.\n              - [XMLContent - getIterator()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLContentAPI.md) -- A global object that provides methods to iterate over the XML content.\n              - [XMLContent - getIterator(String xPath)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLContentAPI.md) -- A global object that provides methods to iterate over the XML content.\n            - [XMLElementIterator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLElementIteratorAPI.md) -- Provides methods for iterating over XML elements.\n              - [XMLElementIterator - hasNext()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLElementIteratorAPI.md) -- Provides methods for iterating over XML elements.\n              - [XMLElementIterator - next()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLElementIteratorAPI.md) -- Provides methods for iterating over XML elements.\n            - [XMLElement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLElementAPI.md) -- Provides methods for iterating through XML elements and mapping values to fields in a table.\n              - [XMLElement - getIterator(String xPath)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLElementAPI.md) -- Provides methods for iterating through XML elements and mapping values to fields in a table.\n              - [XMLElement - getIteratorOverAllChildren()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLElementAPI.md) -- Provides methods for iterating through XML elements and mapping values to fields in a table.\n              - [XMLElement - valueFor(String tableName, String fieldName)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLElementAPI.md) -- Provides methods for iterating through XML elements and mapping values to fields in a table.\n              - [XMLElement - encodedQueryFor(String tableName)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLElementAPI.md) -- Provides methods for iterating through XML elements and mapping values to fields in a table.\n              - [XMLElement - getName()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLElementAPI.md) -- Provides methods for iterating through XML elements and mapping values to fields in a table.\n              - [XMLElement - getAttributeValue(String attribute)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_XMLElementAPI.md) -- Provides methods for iterating through XML elements and mapping values to fields in a table.\n          - [JSON APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/json-overview.md) -- JSON APIs can be used after calling getAsJsonContent() on either the request object or a ParameterValue property.\n            - [JsonNode](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeAPI.md) -- A global object that provides methods to iterate over the JSON content.\n              - [JsonNode - getIterator(String xPath)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeAPI.md) -- A global object that provides methods to iterate over the JSON content.\n              - [JsonNode - iterator()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeAPI.md) -- A global object that provides methods to iterate over the JSON content.\n              - [JsonNode - getAsString()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeAPI.md) -- A global object that provides methods to iterate over the JSON content.\n              - [JsonNode - getAsString(String propertyName)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeAPI.md) -- A global object that provides methods to iterate over the JSON content.\n              - [JsonNode - getName()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeAPI.md) -- A global object that provides methods to iterate over the JSON content.\n              - [JsonNode - valueFor(String tableName, String fieldName)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeAPI.md) -- A global object that provides methods to iterate over the JSON content.\n              - [JsonNode - encodedQueryFor(String tableName)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeAPI.md) -- A global object that provides methods to iterate over the JSON content.\n            - [JsonNodeIterator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeIteratorAPI.md) -- You get a JsonNodeIterator object by calling the getIterator() or iterator() methods of the JsonNode class.\n              - [JsonNodeIterator - hasNext()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeIteratorAPI.md) -- You get a JsonNodeIterator object by calling the getIterator() or iterator() methods of the JsonNode class.\n              - [JsonNodeIterator - next()](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_JsonNodeIteratorAPI.md) -- You get a JsonNodeIterator object by calling the getIterator() or iterator() methods of the JsonNode class.\n          - [print(String message)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/r_GLBL-print_S.md) -- Prints a message to the wrapper log file: <proxy server directory>/logs/wrapper_<date>.log.\n          - [Prohibited keywords](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/r_ProhibitedKeywords.md) -- The Edge Encryption proxy validates encryption rule scripts before saving the rule. Many JavaScript keywords aren’t allowed in encryption rule scripts.\n      - [Edge Encryption dictionary attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/r_EdgeEncryptionDictAttributes.md) -- Add dictionary attributes to tables and fields to control how they work with Edge Encryption.\n      - [Domain separation and Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-encryption-domain-separation.md) -- Domain separation is supported in limited circumstances with Edge Encryption. Edge Encryption provides the ability to encrypt data from within the customer's environment through the use of specific configurations, rules, and keys defined on the Edge Encryption proxy. The Edge Encryption proxy is not domain aware and cannot support domain-specific settings. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n      - [Data integration with Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/data-integration.md) -- To integrate third-party data with an instance using Edge Encryption, you must route the data through the Edge Encryption proxy server using supported integrations. Supported integrations use base system encryption rules that map data in each payload to fields in a table.\n        - [ODBC driver integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_IntegrateODBCWithEdge.md) -- Configure your ODBC driver to query data encrypted by Edge Encryption. The Edge Encryption proxy server encrypts ODBC driver requests to the ServiceNow instance when Edge Encryption is integrated with the ODBC driver.\n          - [Import a self-signed certificate to the ODBC truststore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_IntegrateODBCWithEdge.md) -- Configure your ODBC driver to query data encrypted by Edge Encryption. The Edge Encryption proxy server encrypts ODBC driver requests to the ServiceNow instance when Edge Encryption is integrated with the ODBC driver.\n          - [Set the ODBC driver properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/c_IntegrateODBCWithEdge.md) -- Configure your ODBC driver to query data encrypted by Edge Encryption. The Edge Encryption proxy server encrypts ODBC driver requests to the ServiceNow instance when Edge Encryption is integrated with the ODBC driver.\n        - [MID Server integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-mid-pass-through.md) -- Configure the MID Server to route data through an Edge Encryption proxy server.\n          - [Point the MID Server to the Edge Encryption proxy server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-mid-pass-through.md) -- Configure the MID Server to route data through an Edge Encryption proxy server.\n      - [Diagnostics and performance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-stats.md) -- Monitor Edge Encryption proxy server performance trends and drill into errors generated by the Edge Encryption proxy server.\n        - [Disable or reduce Edge Proxy statistic collection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-stats.md) -- Monitor Edge Encryption proxy server performance trends and drill into errors generated by the Edge Encryption proxy server.\n      - [Increase debug logging for the proxy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-debug-logging.md) -- Increase the level of logging to interpret the logs and debug issues with the proxy.\n        - [Debugging issues with the Edge Encryption application other than SSL connectivity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-debug-logging.md) -- Increase the level of logging to interpret the logs and debug issues with the proxy.\n        - [Logging timing metrics for requests through the proxy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-debug-logging.md) -- Increase the level of logging to interpret the logs and debug issues with the proxy.\n        - [Debug issues with SSL connectivity between the Edge Encryption proxy and the instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption/edge-debug-logging.md) -- Increase the level of logging to interpret the logs and debug issues with the proxy.\n  - [Database Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/database-encryption-with-customer-controlled-switch/db-full-disk-encryption.md) -- ServiceNow offers database encryption (DBE) and full-disk encryption methods for customers with statutory obligations for data protection which may require at-rest protection for all data.\n    - [Exploring Database Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/database-encryption-with-customer-controlled-switch/explore-database-encryption.md) -- ServiceNow offers database encryption (DBE) and full-disk encryption methods for customers with statutory obligations for data protection which may require at-rest protection for all data.\n    - [Requesting database key rotation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/database-encryption-with-customer-controlled-switch/request-dbkek-rotation.md) -- Rotate the database key annually or as needed by submitting a request to support.\n    - [Database Encryption with Customer Controlled Switch](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/database-encryption-with-customer-controlled-switch/dbe-with-ccs.md) -- Database Encryption with Customer-Controlled Switch (DBE-CCS) is an encryption solution that encrypts all data-at-rest when not in use in the database.\n- [Access Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-management-landing.md) -- Access Management enables you to have access to ServiceNow instance securely.\n  - [Zero Trust Access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/session-access.md) -- Zero Trust Access (ZTA) is a security model that assumes no user or device is trusted by default.\n    - [Explore ZTA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/explore-zero-trust-access.md) -- Zero Trust Access (ZTA) is a security model that assumes that no user or device is trusted by default.\n    - [Activating ZTA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/activate-session-access.md) -- Activate the Zero Trust - Policy Based Session Access com.snc.zero_trust_session_access plugin to enable security admins to reduce or limit user access in a session based on IP address, location, Identity Provider attributes, and user attributes using adaptive authentication policies.\n    - [Configuring Session Access role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-session-access-role.md) -- Configure Session Access to reduce user access in a session based on IP, location, Identity Provider attributes, and user attributes using adaptive authentication policies.\n    - [System properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/session-access-system-properties.md) -- Use system properties to enable and customize Zero Trust Access to meet your security requirements.\n      - [Session Access Audits](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/session-access-audit.md) -- The Session Access Audits displays the Session Access logs and information related to a user's session.\n    - [Tutorial: Use ZTA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/use-zero-trust-access.md) -- Procedure to use Zero Trust Access feature with an end-to-end use case.\n      - [Configure IDP attribute for Session Access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-idp-session-access.md) -- Use Identity Provider (IDP) attribute created from the Security Assertion Markup Language (SAML) response and OpenID Connect (OIDC) for removing or restricting user session access to the instance.\n    - [ZTA for Mobile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/zero-trust-access-mobile.md) -- Zero Trust Access (ZTA) is a security model that assumes that no user or device is trusted by default.\n    - [Continuous Authentication (CA)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ca-homepage.md) -- ServiceNow's continuous authentication enables you to reverify and authenticate a user if they access resources that are protected by you.\n      - [Exploring CA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/explore-continuous-auth.md) -- ServiceNow's continuous authentication (CA) enables you to re-verify and authenticate a user if they access resources that are protected by you.\n        - [Policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ca-policies.md) -- View the different continuous authentication policies that are created.\n        - [Metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ca-metrics.md) -- View the different metrics for continuous authentication.\n        - [System properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ca-system-properties.md) -- Use system properties to enable and customize continuous authentication (CA) to meet your zero trust access security requirements.\n      - [Pre-work for CA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/pre-work-ca.md) -- Ensure to perform the following pre-work before using Continuous Authentication (CA).\n      - [Activating CA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/activate-continuous-authentication.md) -- For activating the Continuous Authentication feature on your instance, install the Zero Trust - Continuous Authentication (com.snc.zero_trust_continuous_authentication) plugin.\n      - [Configuring CA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-ca.md) -- Configure continuous authentication (CA) policies to re-authenticate the users if there's an attempt to access resources that are protected by you.\n        - [Tutorial: Configure CA for a Table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-ca-tutorial-table.md) -- Procedure that describes end to end configuration of continuous authentication policy for a table and the impacts to the users due to the configuration changes.\n        - [Tutorial: Configure CA for a Data Class](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-ca-tutorial.md) -- Procedure that describes end to end configuration of continuous authentication policy for a data class and the impacts to the users due to the configuration changes.\n      - [High Assurance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/high-assurance-ca.md) -- Establish high assurance session for with ServiceNow's continuous authentication.\n        - [SSO Login](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/high-assurance-sso-logins.md) -- Establish high assurance session for SSO login using ServiceNow's continuous authentication.\n        - [Non-SSO login](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/high-assurance-non-sso-logins.md) -- Establish high assurance session for non-SSO logins (local or LDAP) using ServiceNow's continuous authentication.\n      - [Audit logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ca-audit-logs.md) -- Describes the details about Continuous Authentication (CA) logs. The CA logs displays all the authentication attempts performed by the users.\n  - [Domain separation for service providers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/domain-sep-landing-page.md) -- With the ServiceNow Platform, service providers (SPs) can provide their customers with faster onboarding, meet compliance, and protect their data using domain separation. You can separate client data, processes, and reports into logical groupings called domains. SPs control who sees and accesses what content.\n    - [Exploring domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_DomainSeparation.md) -- With domain separation you can separate data, processes, and administrative tasks into logically defined domains.\n      - [Delegating configuration options to customers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ds-before-you-begin.md) -- Domain separation is designed to give ServiceNow service providers (SPs) the ability to configure the services they offer to their customers. It is not designed to enable their customers to administer those services themselves, except in a few areas that this topic details.\n      - [Domain assignment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_DomainAssignment.md) -- By default, domain separation adds a domain field to tables and their extensions.\n      - [Visibility domains and Contains domains](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_DomainVisibility.md) -- Visibility domains control what a specific user or group of users can see. \"Contains\" domains control what an entire domain of users can see.\n      - [Domain scope](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_DomainScope.md) -- Domain scope defines what users can and cannot access.\n      - [Concepts for service providers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/sp-concepts.md) -- These concepts work with the existing ServiceNow platform capabilities to help you solve for common use cases.\n        - [Global queue v.2](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/global-queue.md) -- The global queue concept provides a single virtual view of tasks that reside in multiple instances. The concept creates a custom application to provide a fulfiller view of work that resides in multiple instances without having to replicate tasks or data.\n        - [Service provider connector](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-service-connector.md) -- The service provider connector application is a reference design for creating a ServiceNow Store application for your customers to use to integrate with your systems. Service provider applications help you speed on-boarding and create standardized integrations.\n      - [Installed with domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_InstalledWithDomainSeparation.md) -- Several platform components are added or modified with domain separation.\n    - [Application support for domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/domain-separated-apps.md) -- Many ServiceNow applications support domain separation in the base system but not all. Some supported applications include limitations on the data and administrative settings that can be domain-separated. These definitions delineate the domain separation support levels from the perspective of actual use cases and the people who use them.\n    - [Recommended practices for service providers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-sep-recommended.md) -- You can create, implement, and maintain domain separation for your applications and services.\n      - [Domain separation explained](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-what-is-domain-separation.md) -- With domain separation, you can segregate application data, UI, and business logic, such as rules or workflows, in a single customer instance. Separating these elements into logically defined domains supports specific hierarchies for all customers using your applications.\n        - [Value proposition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-dom-sep-value-prop.md) -- With domain separation, service providers can have a multitenant instance architecture that delivers offerings efficiently and securely to their clients. Strong universal process standards, data-driven process design, strict governance, and centralized administration help to maximize these benefits.\n        - [Definition of domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-dom-sep-definition.md) -- With domain separation (also known as the ServiceNow Multitenant Platform Architecture), you can segregate application data, UI, and business logic in a single customer instance that supports hierarchical modeling with cross-tenant (customer) intelligence.\n      - [Domain separation hierarchies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-sep-hierarchies.md) -- Create a hierarchy when defining a domain architecture to track your processes and workflows.\n      - [Context and domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-sep-context.md) -- The context of a user's session determines the processes, data, and user interface (UI) as the user browses through list views, home pages, reports, and knowledge articles. The context is determined by the processes that you create, the business rules that you set, your workflows, and other factors.\n      - [Segregating and securing data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-segregate-secure.md) -- You can segregate and secure data on the ServiceNow platform in multiple ways, depending on your customer's needs. \n        - [Cross tenant intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-dom-sep-how-it-works.md) -- A multi-tenant architecture is where you have a single instance serving multiple tenants. Data, metadata, business logic, and processing context for tenants is automatically handled with access to additional tenant data.\n      - [Alternatives to domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-separation-alternatives.md) -- You can use a separate instance as an alternative to domain separation for your customers. A separate instance allows you the flexibility to meet the requirements for data separation within the groups and departments in an organization with little to no impact on others.\n      - [Evaluating the need for domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-evaluation-dom-sep.md) -- You may find that domain separation doesn't always work for your customers' organizations. It's best that you base your decision to go with domain separation by looking at your customers' needs.\n      - [Benefits of domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-advantages-dom-sep.md) -- Domain separation may work better for your customers' organizations than any other method for separating the data between groups and departments.\n      - [How a database query works with domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-db-query-with-ds.md) -- Using database queries with domain separation in your customers' applications help them protect their data. These queries then speed up the configuration and build processes.\n      - [Domain separation levels of support](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-levels.md) -- Choose from three categories for domain separation of an application for your customers' organizations.\n      - [Service provider reference architecture](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-sp-reference-arch-ds.md) -- Your customers can access service provider (SP) services by using a portal that is designed for them to reach their domain-separated instance.\n        - [Decision trees](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-ded-instance-decision-tree.md) -- You can use decision trees and a comparison chart to determine if a new customer should be added to a shared instance or to their own dedicated instance.\n        - [Dedicated instances](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-sp-reference-arch-dedicated.md) -- Service provider (SP) customers can access SP services by using a portal to a dedicated instance. SPs use these dedicated instances to manage their service delivery.\n        - [Hybrid solution](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-sp-reference-arch-hybrid.md) -- Use the hybrid service provider (SP) reference architecture for a customized solution. Your customers require a dedicated instance for a specific service. They can still use the shared SP instance for other services, but it requires integration of each instance.\n        - [Service Integration Management (SIAM)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-sp-reference-arch-siam.md) -- The Service Integration Management Service Integration and Management (SIAM) for service provider (SP) architecture integrates services for a unified customer experience.\n      - [Domain separation terms](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-terms-conditions.md) -- With a ServiceNow instance, you can improve efficiency, add greater security, and increase performance for your customer organizations. It's helpful to understand some of the most common terms as you create your configurations.\n      - [Domain-separate a custom table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-ds-custom-table.md) -- You may need to create custom tables in separate domains. This topic covers both the procedure and the concept behind domain-separating a custom table.\n      - [Customizing domain properties and themes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-prop-themes.md) -- You can customize your customers' company properties and themes within the domains that you have configured. Customization makes their instances fit in with their companies' overall look and feel.\n      - [Managing domain separation for specific uses](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-emails-catalog-users.md) -- You can set up separate domains for email notifications and customize the properties of catalog, tables, users, groups, and views. This enables you to provide more specific behavior in each domain, giving your customers more flexibility.\n      - [Configuring domain separation with the domain picker](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-picker-config-process.md) -- Use the domain picker wisely, and remember the 80/15/5 approach so that you do not customize too much and impact the performance of your instance.\n      - [Performance considerations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-performance-considerations.md) -- As you configure domain separation in your application and services, make sure that you consider the number and properties of domains you create. Too many property-heavy domains can impact the performance of your instance.\n      - [Setting up domain hierarchies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-hierarchy.md) -- You can avoid slowdowns and performance impacts in your instance by knowing how domain hierarchies work and by setting them up properly.\n      - [Checking domain logs for errors and warnings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-logs.md) -- Check the domain logs to find errors or warnings in your domain path processes and hierarchy configurations.\n      - [Importance of the Default domain](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-default-domain.md) -- Organizing your domains is a crucial part of the domain separation process. If you don't set a default domain, new tasks and user records go to the global domain. Anyone can see the records in the global domain, which means that data can be seen when it is not supposed to.\n      - [Contains queries and domain access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-contains-domain-visibility.md) -- Use a \"contains\" query only in special cases, such as when users or groups need to see data from a domain that they don't have access to, but you don't want to move those users to a domain. Creating domain \"contains\" and user or group access for a domain should be an exception, only when absolutely needed.\n      - [Domain paths query method](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-query-method.md) -- You can create effective queries with domain paths.\n      - [Slow queries and SQL debugging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-debug-sql.md) -- Debugging SQL and slow queries can help you resolve slowness issues in an instance.\n      - [Before Query business rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-before-query-business-rules.md) -- You can use a Before Query business rule to help support data segregation on an instance. ServiceNow applications that support domain separation may support the separation of data and data routing only, have advanced business logic separation, or support tenant (customer) level administration of the application.\n      - [Avoiding domain path in scripts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-no-domain-path-in-scripts.md) -- Domain paths can cause the values of your script to change or even break, so don't use them in scripts.\n      - [Domain assignments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-domain-assignment.md) -- How you assign a domain impacts the value of the sys_domain field. The assignments contain designs and business properties that affect how the application functions in each domain.\n      - [CSM plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/bp-ds-and-csm.md) -- For the best outcome, be aware of how the properties in the CSM plugin work. When the plugin is enabled, you can see the status of your records in your domains.\n    - [Domain Separation Help](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/domain-separation-help.md) -- Additional assistance with Domain Separation\n    - [Setup and administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_DomainSeparationSetup.md) -- Setting up domain separation involves requesting activation of a plugin, setting options, and assigning users and records to domains.\n      - [Request domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ActivateDomainSeparation.md) -- All domain support features are activated with a plugin called Domain Support - Domain Extensions Installer. Administrators can request activation of this plugin.\n      - [Domain separation plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/domain-sep-plugin.md) -- The Domain Support - Domain Extensions Installer plugin activates several domain separation features and properties at once. This plugin is typically referred to as the Domain Separation plugin.\n      - [Domain system properties and user preferences](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_DefaultDomainScope.md) -- Administrators have access to properties and user preferences that control domain scope.\n      - [Create a domain](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_CreateADomain.md) -- You can create a domain by creating a record in the [domain] table.\n      - [Make a domain the default](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_MakeAnMSPDomainTheDefault.md) -- Made a domain the default domain to which the system automatically assigns task and user records that are not already assigned to a domain.\n      - [Manually manage the domain for particular records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ManuManDomPartRec.md) -- By default, the system automatically assigns a domain based on the user's company record. In some cases, however, domain administrators want to manually manage which domain a particular record belongs to.\n      - [Domain Separated Tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/domain-separated-tables.md) -- You can see at a glance which tables are domain-separated in your instance with the Domain Separated Tables feature.\n      - [Domain Override Viewer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/domain-sep-override-viewer.md) -- With the Domain Override Viewer, you can see and manage all your process overrides at once across the entire instance.\n      - [Enable or disable a domain](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ActivateDeactivateADomainForMSP.md) -- When you activate or deactivate a domain, the activation status cascades to companies within the domain.\n      - [Add a domain field to a table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_AddADomainFieldToATable.md) -- As an administrator, domain-separate a custom table by adding a sys_domain field to it.\n      - [View upgraded processes or records in the global domain](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_view-upgraded-overriden-domains.md) -- You can track and review base system records or processes in the global domain that were overridden across one or multiple domains prior to an upgrade and were subsequently updated during a platform or app upgrade.\n        - [Review overridden records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/review-overridden-record.md) -- You can view information about specific overridden records and mark them reviewed.\n      - [View domain relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ViewDomainRelationships.md) -- The domain map offers domain administrators a read-only representation of the active domains on the instance and how they relate to each other.\n        - [Select a primary domain](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_SelectAPrimaryDomain.md) -- The primary domain indicates the top-level domain in the domain map.\n        - [Create Contains relationships between domains](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_CrContRelBetDom.md) -- Create a \"contains\" relationship between domains to change the domain hierarchy.\n        - [Expand domain scope](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ChangeDomainVisibility.md) -- By default, when a user in the global domain views a table containing a sys_overrides column, the user sees records from only the global domain. When an admin in the global domain views a process table, that admin sees only records that are in that process table.\n          - [Add domains to a visibility domains list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_AddADomainToAVisibilityDomainList.md) -- Adding a visibility domain allows a user or group to see and potentially edit records from another domain regardless of the user or group's normal domain membership.\n          - [Grant visibility domains to an individual user](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_GrVisDomIndUser.md) -- While it is possible to add visibility domains for specific users on the User form, it's best to add them only via groups. This controls permissions and access should individuals change departments or leave the company.\n      - [Create a domain-specific choice list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_CreateADomainSpecificChoiceList.md) -- Administrators can configure choice lists to contain entries specific to a particular domain.\n      - [Advanced administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_DomainSeparationAdministration.md) -- Administrators can view information about domain separation, identify potential issues, and change configuration settings.\n        - [Use domain selection menus](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_DisplayingDomainSelectionMenus.md) -- The instance offers domain selection via two menu formats.\n          - [Enable domain selection menus in Core UI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_EnableDomainReferencePickerProperty.md) -- Displaying the domain picker in Core UI enables the domain selector by default. After enabling the domain selector, you can add a system property to enable the domain reference picker.\n          - [Restrict access to the domain picker](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_RestrictAccesstoDomainPicker.md) -- Use a system property to restrict access to the domain picker in Core UI and Next Experience.\n        - [Application properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ds-application-properties.md) -- The Domain Separation plugin has two new tables to give service providers more flexibility in customizing their applications that use domain separation. These tables are the System Application Property table [sys_application_property] and the System Application Property Value table [sys_application_property_value].\n      - [Domain Migration Tool](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/tenant-domain-migration-tool.md) -- Use the Domain Migration Tool to move a customer from a domain-separated environment to their own dedicated instance.\n        - [Migrate a domain-separated instance to a dedicated instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/tenant-domain-migration-tool.md) -- Use the Domain Migration Tool to move a customer from a domain-separated environment to their own dedicated instance.\n      - [Process administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_DelegatedAdministration.md) -- Process administration allows administrators to set domain-specific policies.\n        - [Example: Domain specific applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_ExDelAdmDomAppMod.md) -- The following example illustrates process administration with domain-specific applications and modules.\n      - [Enable logging and debug messages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_EnableDomainLogDebugMsgs.md) -- Domain log and debug messages allow you to troubleshoot domain configuration errors.\n        - [View a real-time domain message](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ViewARealTimeDomainMessage.md) -- You can view real-time domain messages from the system logs.\n        - [View a historical domain message](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ViewAHistoricalDomainMessage.md) -- View historical domain messages in the log file to troubleshoot domain separation issues.\n        - [Troubleshoot domain separation errors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_TroubleshootDomainSeparationError.md) -- If you encounter domain separation issues, review this list of solutions.\n      - [Post-Production Domain Separation Activation Utility](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/post-prod-domain-sep-utility.md) -- The post-production Domain Separation activation utility aids in the activation of Domain Separation in a live environment.\n      - [Domain Job Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/domain-job-manger.md) -- Queue multiple Domain Separation updates sequentially into a single background job using the Domain Job Manager.\n      - [Delete by domain](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/delete-by-domain.md) -- Clean up inactive leaf level domains in the domain hierarchy with a controlled and automated tool.\n    - [Domain Separation Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/domain-separation-center.md) -- Audit your domains regularly to reveal problems.\n      - [Configure the Domain Separation Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-the-domain-separation-center.md) -- Specify which tables in domains are large and whether you want detailed logging.\n      - [Configure audits](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-domain-separation-audits.md) -- Configure whether an audit is active and how frequently it runs.\n      - [Schedule audits](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/schedule-audits.md) -- Specify the time and day that audits are run.\n      - [Execute audits immediately](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/execute-audits-immediately.md) -- Audits typically run as scheduled. You can, however, run all audits on command.\n      - [View audits with warnings and errors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/view-audits-with-warnings-and-errors.md) -- The Domain Separation Center provides details about audit errors and warnings.\n      - [View running and pending results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/view-running-and-pending-results.md) -- You can view running and pending audits to see their status.\n      - [View inactive audits](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/view-inactive-audits.md) -- You can view all inactive audits in one place and optionally activate them.\n  - [Security data filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-data-filters.md) -- Security data filters restrict access to records based on role, or security-attribute related assertions.\n    - [Create a security data filter](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-security-data-filters.md) -- Learn how to create security data filter rules to grant your users' access to records and tables.\n    - [Default security filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/default-security-filters.md) -- Generally data filters are applied after absolute ACLs (also sometimes called table-level ACLs), and after row-level ACLs. They are applied by default, and can be impactful to system behavior if not used carefully.\n  - [Authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_Authentication.md) -- ServiceNow's authentication validates the identity of a user who accesses an instance, and then authorizes the user to features that match the user's role or job function.\n    - [Adaptive authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/adaptive-authentication.md) -- Use the Adaptive authentication policy framework to enforce contextual authentication controls to the right users at the right time. Adaptive authentication uses authentication policies to evaluate authentication requests and then either deny or allow access to your instance based on the specified policy conditions.\n      - [Activate adaptive authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/adaptive-authentication-plugin.md) -- You can activate the Adaptive Authentication plugin (com.snc.adaptive_authentication) for Adaptive Authentication if you have the admin role.\n      - [Filter criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/adaptive-auth-filter-criteria.md) -- Filter criteria (also called policy inputs) are used as inputs for policy conditions to verify and meet the requirements of an authentication request.\n        - [IP Filter](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/ip-filter.md) -- Use IP filter criteria to filter the users based on the user's IP addresses. Both IPv4 and IPv6 are supported.\n          - [Create IP filter criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-ip-filter-criteria.md) -- IP filter criteria allows you to filter users based on the user's IP addresses. You can configure an authentication policy to allow or deny access to a specific address or range of addresses.\n        - [Role Filter](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/role-filter.md) -- Use role filter criteria to filter users based on their roles.\n          - [Create role filter criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-role-filter-criteria.md) -- Role filter criteria allows you to filter users based on the roles. You can configure an authentication policy to allow or deny access to a list of user roles.\n        - [Group Filter](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/group-filter.md) -- Use group filter criteria to filter users based on the user group to which the user belongs.\n          - [Create group filter criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-group-filter-criteria.md) -- Group filter criteria allows or denies user access based on the user group to which the user belongs.\n        - [Location Filter](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/location-filter.md) -- Location filter criteria can be used as filter input for users based on the user location.\n          - [Activate Location Based Access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-location-based-access.md) -- Activate the Zero Trust - Location Based Access (com.snc.zero_trust_location_access) to allow admins to configure adaptive authentication policies based on the location of the user.\n          - [Create Location filter criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-location-filter-criteria.md) -- Use location filter criteria to filter input for users authentication based on the user location.\n          - [Tutorial: Use Location Filter criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/use-location-filter-criteria.md) -- Describes steps to use location filter criteria in the authentication policy and restrict access to the users based on the location.\n            - [Use Location Filter in Pre Authentication Context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/use-lf-pre-auth.md) -- Use the location filter criteria created in the Pre Authentication Context.\n            - [Use Location Filter Post Authentication Context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/use-lf-post-auth.md) -- Use the location filter criteria created in the Post Authentication Context.\n            - [Use Location Filter in MFA Context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/use-lf-in-mfa.md) -- Use the location filter criteria created in MFA Context.\n            - [Use Location Filter for Session Access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/lf-for-session-access.md) -- Use the location filter criteria created in Session Access to reduce roles based on the location of the user.\n        - [Identity Provider Attributes Filter](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/identity-provider-attributes.md) -- Use the Identity Provider attributes that are received from the Security Assertion Markup Language (SAML) response and OpenID Connect (OIDC) from the Identity Provider (IdP) as a filter criteria for authentication.\n          - [Attributes for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/idp-attributes-saml.md) -- Use the Identity Provider attributes that are received from the Security Assertion Markup Language (SAML) response and OpenID Connect (OIDC) from the Identity Provider (IdP) as a filter criteria for authentication.\n            - [Use as filter criteria for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/use-idp-filter-criteria.md) -- Use the Identity Provider (IDP) attribute from the Security Assertion Markup Language (SAML) response as a filter criteria for authentication policy.\n          - [Attributes for OIDC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/idp-attributes-oidc.md) -- Use the Identity Provider attributes that are received from the OpenID Connect (OIDC) from the Identity Provider (IdP) as a filter criteria for authentication.\n            - [Use as filter criteria for OIDC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/use-idp-filter-criteria-oidc.md) -- Use the Identity Provider (IDP) attribute from the OpenID Connect (OIDC) response as a filter criteria for authentication policy.\n      - [Authentication policy contexts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/auth-policy-contexts.md) -- Use authentication policy contexts to determine how and when your instance enforces authentication policies.\n        - [Pre authentication context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/pre-auth-context.md) -- The pre authentication policy context defines how and when a policy is enforced during the login process. The policy used in this context executes before your users see a login screen.\n        - [Post-authentication context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/post-auth-context.md) -- The Post Authentication policy context defines how and when a policy is enforced during the login process. The policy used in this context executes after your users see a login screen.\n        - [MFA context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-auth-context.md) -- The Multi-factor Authentication (MFA) policy context uses a policy to define how and when MFA is enforced during the login process.\n        - [Account recovery context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/account-recovery-context.md) -- The account recovery context uses a policy to define how and when the account recovery can be established.\n        - [Session validation context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/session-context.md) -- Use the Session Validation Context as an additional layer of protection against session or cookie hijacking.\n          - [Activate session validation context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-session-validation-context.md) -- Use session validation context to restrict access to ServiceNow when hijackers copy a user's session cookies from one device to another to impersonate the session or restricts the user's session access if they’re using an insecure network.\n          - [Tutorial: Configuring session validation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/use-ip-session-context.md) -- Configure session validation within the Adaptive Authentication framework to provide as an additional layer of protection for session or cookie hijacking.\n      - [Authentication policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/authentication-policies.md) -- Authentication policies evaluate authentication requests based on the specified policy conditions and either allow or deny access depending on the output of policy conditions evaluation. For example, access is allowed only if all the policy conditions specified in Allow Access Policy evaluate to true.\n        - [Configure a policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-allow-access-policy.md) -- Configure an authentication policy to define inputs and conditions to used to grant access to an instance or enforce multi-factor authentication.\n        - [Add to an authentication policy context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/add-policy-to-context.md) -- Add an authentication policy to one of the authentication policy contexts. The authentication context uses the policy inputs and conditions to determine whether uses are granted access to the instance, or whether MFA is enforced for your users.\n      - [Adaptive authentication events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/adaptive-authentication-events.md) -- You can use the adaptive authentication events table to know about the events.\n      - [Configure properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-adaptive-auth-properties.md) -- After activating adaptive authentication, configure adaptive authentication properties according to your security requirements.\n        - [Tutorial: Configure adaptive authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/adaptive-auth-example.md) -- Use these example steps to configure adaptive authentication on an instance.\n          - [Create a filter criteria record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/adaptive-auth-example.md) -- Use these example steps to configure adaptive authentication on an instance.\n          - [Create a policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/adaptive-auth-example.md) -- Use these example steps to configure adaptive authentication on an instance.\n          - [Configure a policy context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/adaptive-auth-example.md) -- Use these example steps to configure adaptive authentication on an instance.\n      - [Adaptive authentication for Trusted Mobile apps](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mobile-adaptive-authentication.md) -- Access your ServiceNow from untrusted networks by using the Now Mobile app.\n        - [Activate Trusted Mobile app](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-trusted-mobile-app.md) -- Activate adaptive authentication with trusted mobile app by using the authentication policy and filter conditions.\n        - [Register a trusted device](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/register-trusted-device.md) -- Register a trusted device to access the ServiceNow instance outside the network.\n        - [Manage your trusted device](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/manage-your-trusted-device.md) -- Manage your trusted device from the Trusted Device registration page.\n        - [Registration details of registered devices](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/device-app-registration-details.md) -- View the details of devices that are registered with your ServiceNow instance.\n        - [Trusted Mobile app troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/troubleshooting-trusted-device.md) -- Review these troubleshooting scenarios to resolve issues with Trusted Mobile app.\n    - [API Authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/api-authentication.md) -- Authentication configurations for API.\n      - [Certificate based authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/certificate-api-auth.md) -- Certificate-based authentication lets you mutually authenticate inbound API requests using certificates from a trusted Certificate Authority (CA).\n      - [OAuth](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/oauth-inbound-and-outbound.md) -- OAuth based authentication validates the identity of the client that attempts to establish a trust on the system by using an authentication protocol.\n      - [Token-based authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/token-based-auth-api.md) -- Token-based authentication for inbound REST APIs configuration using API Key or HMAC.\n        - [API Key and HMAC Authentication for inbound REST APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/api-key-and-hmac-rest-apis.md) -- Support API tokens for REST API endpoints so that the ServiceNow user name and password isn't visible in the webhook URL.\n          - [Activate API Key and HMAC Authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/active-api-key-hmac.md) -- You can activate the plugin API Key and HMAC Authentication (com.glide.tokenbased_auth) in your ServiceNow instance.\n          - [Configure API key - Token-based authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-api-key.md) -- Configure an API key to support authentication for REST API endpoints.\n          - [Configure HMAC - Token-based authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-hmac.md) -- Configure HMAC to support authentication for REST API endpoints.\n          - [Cleaning up token Expiry](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/token-expiry-api-and-hmac.md) -- Details about how to clean up token expiry by using different system properties.\n      - [Basic authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/basic-authentication.md) -- Legacy API authentication method using username and password, with restricted usage and varying behaviour in zBoot and upgraded instances.\n        - [Basic authentication restriction](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/basic-auth-restriction.md) -- Basic authentication restriction is a security feature that controls which accounts can use basic authentication on a ServiceNow instance. Administrators can review identified users and assign per-account decisions before enforcement begins.\n        - [Basic authentication exceptions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/basic-auth-exceptions.md) -- The Basic Auth Exceptions table lists accounts that have been identified as using basic authentication on the instance, along with their assigned decision and usage details.\n    - [API access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/api-access-policy.md) -- API access policy defines the permissions and duration of access to an API.\n      - [REST API access policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/inbound-authentication-profile.md) -- REST API access policies allow you to restrict access to inbound REST APIs based on the authentication type and the specified filter criteria of the access policy.\n        - [Activate REST API access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-rest-api-access-policy.md) -- You can activate the REST API Access Policy plugin (com.glide.rest.policy) if you have the admin role. If the application does NOT include demo data or it does NOT install related applications and plugins, delete or revise the following sentence:The application includes demo data and installs related ServiceNow Store applications and plugins if they are not already installed.\n        - [Create an authentication profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-authentication-profile.md) -- Create an authentication profile and add one or more authentication policies to the profile. You can also configure the ID Token and OAuth Token authentication profiles that are available by default.\n        - [Create REST API access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-api-access-policy.md) -- Create an API access policy and map an authentication profile to restrict the authentication type for a REST API. For example, you can create an API access policy that allows only ID token authentication for a REST API.\n          - [API access policy prioritization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/api-access-policy-prioritization.md) -- Learn about the policy prioritization logic if there are multiple API access policy configured for your ServiceNow instance.\n        - [REST API Auth Scope](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/rest-api-auth-scope.md) -- Use the REST API Auth Scope to provide access to a specific REST API\n          - [Activate REST API Auth Scope](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-rest-api-auth-scope.md) -- You can activate the REST API Auth Scope plugin (com.glide.rest.auth.scope) to link the OAuth entity with authentication scopes.\n          - [Properties and tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/rest-api-auth_scope-properties.md) -- The REST API Auth Scope plugin (com.glide.rest.auth.scope) includes the following system properties, tables, and scripts.\n          - [Configure auth scope](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-rest-api-auth-scope.md) -- Link the OAuth entity with an auth scope to manage the token to access the REST APIs that are linked with the auth scope.\n          - [Troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/rest-api-scope-troubleshooting.md) -- Troubleshooting actions can help resolve common issues when setting up or running the REST API scope.\n      - [SOAP API access policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/soap-api-access-policies.md) -- SOAP API access policies allow you to restrict access to inbound SOAP APIs based on the authentication type and the specified filter criteria of the access policy.\n        - [Activate SOAP API access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-soap-api-access-policy.md) -- For SOAP API access policy, install the SOAP API Access Policy (com.glide.soap.policy) plugin.\n        - [Create an authentication profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-an-authentication-profile.md) -- Create an authentication profile and add one or more authentication policies to the profile. You can also configure the ID Token and OAuth Token authentication profiles that are available by default.\n        - [Create SOAP API access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-soap-api-access-policy.md) -- Create an API access policy and map an authentication profile to restrict the authentication type for a SOAP API. For example, you can create an API access policy that allows only ID token authentication for a SOAP API.\n          - [Create a global API access policy to protect SOAP APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-global-api-access-protect-soap.md) -- Create a single global API access policy to protect all the SOAP APIs.\n        - [Filter criteria for APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/filter-criteria-apis.md) -- Filter criteria contains filter conditions or queries that are used as policy inputs for an authentication policy. Policy inputs are used to group one or more filter criteria and define the policy conditions of an authentication policy. For example, an IP Filter Criteria define an IP address in the Classless Inter-Domain Routing (CIDR) format or a range of IP addresses.\n      - [API Authentication Policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/api-authentication-policies.md) -- Authentication policies evaluate authentication requests based on the specified policy conditions and either allows or denies access depending on the matching criteria.\n        - [Create a policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-api-authentication-policy.md) -- Authentication policies allow you to enforce access restrictions on the APIs based on the specified filter criteria.\n        - [Configure global blocking policy for APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-global-blocking-policy-apis.md) -- Global blocking policy denies the authentication requests of users and APIs based on the specified policy conditions. This policy can be used as an alternative to the IP Address Access Control.\n      - [System or Export Processors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/api-auth-policy-export-processors.md) -- Ability for System or Export Processors to leverage processor access policy to secure all the export endpoints.\n        - [Activate Processor access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-processor-access-policy.md) -- For Processor, install the Processor Access policy (com.glide.processor.policy) plugin.\n        - [Configure an Authentication profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-auth-profile-processor.md) -- Apply authentication profile for the export processors.\n    - [Authentication factors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/authentication-factors.md) -- Authentication factors help identify and verify callers, allowing only authorized users to access AI voice agents on the ServiceNow AI Platform.\n      - [Explore authentication factors for AI voice agents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/explore-authentication-factors.md) -- Authentication factors are the elements used for caller identification and authentication. In secure voice agent environments, the process begins with identifying the caller, followed by authenticating their identity before granting access. A robust security strategy combines multiple factors to confirm that only authorized users interact with AI voice agents.\n      - [Configure authentication factors for AI voice agents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configuring-authentication-factors-for-ai-voice-agents.md) -- To secure voice agent environments, configure authentication factors that first identify the caller, then authenticate them before granting access.\n        - [Configure voice input for authentication factors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-voice-authentication-factors.md) -- Configure how callers provide authentication responses by speaking or using the phone keypad.\n        - [TOTP authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/totp-authenticator-apps.md) -- A time based one-time password (TOTP) is a secure authentication factor that verifies user identity by generating a unique, time-sensitive code.\n        - [Push notification - Okta verify](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/push-notification-okta-verify.md) -- The Okta Verify app push notification enables users to securely approve authentication requests directly on their enrolled mobile devices.\n          - [Configure push notification (Okta Verify)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-okta-verify-push-notification.md) -- Configure Okta Verify to receive push notifications for secure and convenient identity verification.\n        - [Soft PIN authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/softpin-authentication.md) -- Soft PIN is a six-digit numeric PIN that verifies a caller's identity during an AI voice agent session.\n          - [Configure Soft PIN](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-soft-pin.md) -- Users are required to configure Soft PIN before it can be used for authentication with ServiceNow AI Platform.\n        - [SMS OTP authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/sms-otp-authentication.md) -- SMS one-time password (OTP) authentication is a method used to verify user identity by sending a temporary, numeric code to the user's registered mobile number. The user enters this code to complete authentication.\n        - [Email OTP authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/email-otp-authentication.md) -- Email OTP for AI voice agents sends a one-time numeric code to the caller's email address. The caller retrieves the code from their email and provides it to the agent to verify their identity.\n          - [Configure Email OTP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-email-otp-service.md) -- Configure the Email one-time password (OTP) to enable OTP-based authentication for users in your instance.\n        - [Knowledge-based authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/knowledge-based-authentication.md) -- Knowledge-based authentication (KBA) is an identification and authentication method that verifies callers by prompting them to answer preconfigured questions across conversational AI channels, such as AI voice agents. KBA can be used to identify a caller, authenticate a caller, or both within the same interaction.\n          - [Configure KBA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-kba.md) -- Configure knowledge-based authentication (KBA) to identify and authenticate callers by prompting them to answer preconfigured questions across conversational AI channels, such as AI voice agents.\n            - [Create KBA questions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-knowledge-based-questions.md) -- Create knowledge-based questions to use for caller identification and authentication in AI voice agent interactions.\n            - [Create KBA answers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-knowledge-based-answers.md) -- Create knowledge-based answers for the preconfigured security questions to confirm the user's identity.\n            - [Map KBA questions to answers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-kba-answer-mappings.md) -- Create knowledge-based questions and answer mapping to confirm the user's identity.\n            - [AI voice agent service mapping with KBA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-kba-service-mappings.md) -- Specify the questions used for caller identification and authentication with a specific AI voice agent service.\n      - [Human-assisted SMS OTP authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/human-assisted-sms-otp.md) -- Human-assisted SMS OTP lets a human agent verify an end user's identity by sending a one-time passcode via SMS during a live interaction. The agent initiates OTP generation and validation through the platform's scriptable APIs, and the consuming application (for example, CSM or FSO workspace) handles the agent-facing workflow and user interface.\n        - [Configure human-assisted SMS OTP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-human-assisted-sms-otp.md) -- Configure the HA SMS OTP service to enable human agents to generate and validate one-time pass codes during live interactions.\n    - [Certificate-based authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-based-authentication/certificate-based-authentication.md) -- Certificate-based authentication lets you mutually authenticate user logins or inbound API requests using certificates from a trusted Certificate Authority (CA).\n      - [Set up](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-based-authentication/set-up-mutual-auth.md) -- Set up mutual authentication for either user interface-based logins or inbound web services.\n        - [Activate Certificate-based authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-based-authentication/set-up-mutual-auth.md) -- Set up mutual authentication for either user interface-based logins or inbound web services.\n        - [Register CA certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-based-authentication/set-up-mutual-auth.md) -- Set up mutual authentication for either user interface-based logins or inbound web services.\n        - [Map PEM certificate to user](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-based-authentication/set-up-mutual-auth.md) -- Set up mutual authentication for either user interface-based logins or inbound web services.\n        - [Configure Certificate-based authentication properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-based-authentication/set-up-mutual-auth.md) -- Set up mutual authentication for either user interface-based logins or inbound web services.\n      - [Log in](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-based-authentication/ui-login-mutual-auth.md) -- After your administrator sets up Certificate-based authentication, you can register the client certificate and log in using your PIV (Personal Identity Verification) or CAC (Common Access Card) card.\n        - [Register client certificate for your PIV or CAC card](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-based-authentication/ui-login-mutual-auth.md) -- After your administrator sets up Certificate-based authentication, you can register the client certificate and log in using your PIV (Personal Identity Verification) or CAC (Common Access Card) card.\n        - [Log in to ServiceNow AI Platform using PIV or CAC card](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-based-authentication/ui-login-mutual-auth.md) -- After your administrator sets up Certificate-based authentication, you can register the client certificate and log in using your PIV (Personal Identity Verification) or CAC (Common Access Card) card.\n        - [Manage your client certificates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/certificate-based-authentication/ui-login-mutual-auth.md) -- After your administrator sets up Certificate-based authentication, you can register the client certificate and log in using your PIV (Personal Identity Verification) or CAC (Common Access Card) card.\n    - [Custom instance URLs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/custom-url.md) -- You can enable your ServiceNow instance to be accessible from a company-branded or custom URL.\n      - [Activate custom URLs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-custom-url-plugin.md) -- Enable custom URLs to be set up on your ServiceNow instance. You can activate the Custom URL plugin (com.snc.customurl) if you have the admin role.\n      - [Set as the instance URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-custom-url.md) -- Add a custom URL to your instance configuration to use instead of your ServiceNow URL.\n      - [Identity Provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/custom-url-with-multiple-identity-providers.md) -- Set your custom URL with the Identity Provider to enable the user to login with their IdP's.\n      - [Datacenter job information](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/view-custom-url-datacenter-jobs.md) -- Every custom URL that is associated to your instance has a corresponding ServiceNow datacenter job which runs and shows URL information that is pertinent to your instance as described in the table.\n      - [Generate SP metadata for SAML/SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/generate-idp-metadata-sso.md) -- A SAML or SSO installation needs the SP metadata generated for the IdP before the custom URL instance generates.\n      - [Custom URL errors and fixes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/custom-url-error-fix.md) -- A list of common errors and associated fixes for a custom URL setup and configuration.Target Audience: ServiceNow Admin\n    - [Installation exits](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_InstallationExits.md) -- Installation exits are customizations that exit from Java to call a script before returning back to Java.\n    - [IP range based authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_IPRangeBasedAuthentication.md) -- One way to secure a web-based application is to restrict access based on the IP address.\n      - [IP address access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_AccessControl.md) -- Apply an IP access control to outbound traffic, inbound traffic, or bidirectional traffic. The system only blocks an IP address if a matching Deny rule exists and no matching Allow rule exists. By default, there are no restrictions on access to your instance.\n      - [Find denied IP addresses](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_FindDeniedIPAddresses.md) -- Find Denied IP addresses in the instance's node log files.\n    - [LDAP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_LDAPIntegration.md) -- An LDAP integration allows your instance to use your existing LDAP server as the primary source of user data.\n      - [Understand LDAP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_LDAPIntegrationFAQs.md) -- An LDAP integration allows your instance to use your existing LDAP server as the primary source of user data.\n      - [LDAP integration requirements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_LDAPIntegrationRequirements.md) -- Review the requirements for LDAP integration, which include a PKI certificate an LDAP compliant directory services server.\n      - [LDAP integration setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_LDAPIntegrationSetup.md) -- Administrators can enable LDAP integration to allow sign-on of users from their company LDAP directory.\n        - [Install the LDAP X.509 SSL certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_UploadTheX509SSLCertificate.md) -- You can install an X.509 certificate for your LDAP integration.\n        - [Define an LDAP server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_DefineAnLDAPServer.md) -- Create a new LDAP server record in the instance.\n        - [Enable an LDAP listener and set system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_EnableAListener.md) -- Enabling a listener is optional. If enabled, a listener notifies the system to process LDAP records soon after there is an update on the LDAP server.\n        - [Specify the LDAP attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_SpecifyLDAPAttributes.md) -- Specify the attributes included in LDAP server queries by using the LDAP server Attributes field. This can enhance performance as well as security.\n        - [Test an LDAP connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_TestAnLDAPConnectionManually.md) -- The instance tests the connection automatically every time a user opens the LDAP Server form. Alternatively, you can manually test the connection to the LDAP server from the LDAP server form.\n        - [Define LDAP organizational units](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_DefineLDAPOrganizationalUnits.md) -- An organizational unit (OU) definition specifies the LDAP source directories available to the integration.\n        - [Create a data source for LDAP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_CreateADataSource.md) -- Each LDAP organizational unit (OU) definition has its own related list of data sources.\n        - [Auto provision LDAP users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_AutoProvisionLDAPUsers.md) -- You automatically provision users who are in the LDAP server but not yet in your instance.\n        - [LDAP integration via MID Server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_LDAPIntegrationViaMIDServer.md) -- Administrators can integrate using an LDAP data source over a Management, Instrumentation, and Discovery (MID) Server.\n          - [Configure LDAP connection monitoring](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_ConfigureLDAPConnectionMonitoring.md) -- Change or disable LDAP connection monitoring and notifications.\n          - [Import binary data through a MID Server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_ImportBinaryDataThroughAMIDServer.md) -- As an administrator, you can import binary large object (BLOB) data with an LDAP integration through the MID Server.\n          - [Troubleshooting LDAP integration via MID Server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_TroubleshootLDAPIntegViaMIDSvr.md) -- You may encounter issues in the following areas while integrating LDAP via MID Server.\n      - [Import and map data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_LDAPImportMaps.md) -- LDAP import maps match fields in your LDAP database to fields in your instance.\n        - [LDAP transform maps](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_LDAPTransformMaps.md) -- The transform map moves data from the import set table to the target table (User or Group).\n        - [LDAP scripting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_CommonLDAPScripts.md) -- Create custom transform maps, scripts, and business rules to specify requirements when importing data.\n          - [Set disabled Active Directory users to inactive](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_CommonLDAPScripts.md) -- Create custom transform maps, scripts, and business rules to specify requirements when importing data.\n          - [Assign LDAP field values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_CommonLDAPScripts.md) -- Create custom transform maps, scripts, and business rules to specify requirements when importing data.\n          - [Exclude particular LDAP users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_CommonLDAPScripts.md) -- Create custom transform maps, scripts, and business rules to specify requirements when importing data.\n        - [Set choice action for reference field imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_SetChoiceAction.md) -- The LDAP transform map determines how fields in the Import Set table map to fields in existing tables such as Incident or User.\n        - [Verify LDAP mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_VerifyLDAPMapping.md) -- After creating an LDAP transform map, refresh the LDAP data to verify the transform map works as expected.\n      - [LDAP integration troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_LDAPIntegrationTroubleshooting.md) -- If you are integrating your LDAP server and have questions, these items may help you troubleshoot the issue.\n        - [View the LDAP monitor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_ViewLDAPMonitor.md) -- You can view current information about LDAP servers and listeners using LDAP monitor.\n        - [LDAP error codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_LDAPErrorCodes.md) -- The LDAP Log file lists industry standard error codes for both LDAP and Active Directory (AD).\n        - [Send a one-time password when the LDAP server is down](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_SendOneTimePassword.md) -- An LDAP property is available to send a one-time password to a user if the user is unable to log in because the LDAP server is down. You can also configure another property to control how long the password is valid.\n      - [LDAP record synchronization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_LDAPRecordSynchronization.md) -- Administrators can synchronize inactive, disabled, or deleted LDAP records with their LDAP records.\n        - [LDAP refresh filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_LDAPRefreshFilters.md) -- Filters on the LDAP refresh process can be used to specify processing that ignores inserts of disabled users.\n        - [LDAP extraction](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_LDAPExtraction.md) -- Implement an LDAP extraction process to detect inactive users.\n        - [Inactive LDAP user accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_InactiveLDAPUserAccounts.md) -- Detect that an existing, current, user account is inactive or has been disabled or deleted from an Active Directory (AD) LDAP.\n          - [Use the userAccountControl field](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_FindInactLDAPAcctsWUsrAcctCtrlFld.md) -- Identify when an Active Directory (AD) user is deleted (or made inactive).\n        - [LDAP script examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_LDAPScriptExamples.md) -- The following script examples assume you use an Active Directory (AD) for your LDAP server.\n      - [Active Directory Application Mode (ADAM)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_ActiveDirectoryApplicationMode.md) -- Active Directory Application Mode (ADAM) is an Lightweight Directory Access Protocol (LDAP)-compliant directory service.\n        - [Configuring an instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_ConfiguringAnInstance.md) -- The first install copies the ADAM files to your computer, registers requires components, and creates the application shortcuts.\n        - [Set up the ADAM console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_SettingUpTheConsole.md) -- Set up the ADAM console. Even though there are many similarities between ADAM and Active Directory, the administration can be very different since there is no Users and Computers management console.\n        - [Create containers and organizational units](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_CreateContainersAndOrgUnits.md) -- Logically group objects stored in ADAM into containers and organizational units (OU) just as they would be in Active Directory.\n        - [Delegation with ADAM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_Delegation.md) -- Once the OU structure is created, define the permission delegations to properly secure the objects to limited users.\n        - [Populating ADAM Objects](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_PopulatingADAMObjects.md) -- ADAM Objects include User Objects, UserProxy Object, and Group Objects.\n        - [Testing and troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_TestingAndTroubleshooting.md) -- The primary tool used for testing is LDP. This allows you to fully test user authentication.\n        - [Backup and recovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_BackupAndRecovery.md) -- All ADAM data can be backed up using standard file system backup methods.\n        - [Use LDAPS with ADAM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_UsingLDAPSWithADAM.md) -- The default configuration for userProxy object authentication is to enforce LDAPS (secure LDAP) communications. LDAPS requires SSL certificates to secure the network traffic.\n          - [Assign the certificate to ADAM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_AssigningTheCertificateToADAM.md) -- Install an SSL certificate on the server and any LDAP client to support secure binds and encrypt the user and password information being transmitted.\n          - [Export the public key certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_ExportingThePublicKeyCertificate.md) -- LDAPS clients, including the instance need the public key certificate in order to make a secure connection to ADAM.\n        - [ADAM access account](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_ServiceNowITSASuiteAccessAccount.md) -- The system requires a user account to read the Active Directory Application Mode (ADAM) object information that is imported into the application instance.\n        - [Test the LDAPS connections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_TestingLDAPSConnections.md) -- Test the LDAPS connections. There are two console connections, one for Local Computer Certificates, and the other for Local Computer Services Certificates on the new ADAM service.\n        - [Use ADAMSync to populate ADAM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_UsingADAMSyncToPopulateADAM.md) -- Administrators use MS ADAMSync to populate LDAP directories that use MS ADAM.\n          - [Define ADAM user accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_DefineUserAccounts.md) -- Define user accounts in ADAM. One user account is used for the instance to connect with and the other user account is for ADAMSync.\n          - [Set up ADAMSync](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_SetUpADAMSync.md) -- ADAMSync is included with Windows Server 2003 R2. Download and install ADAMSync if you are using a different OS.\n          - [Install the ADAM configuration file](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_InstallTheConfigurationFile.md) -- Install the ADAM configuration file through the Windows command line.\n            - [Example ADAM configuration files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_ExampleConfigurationFiles.md) -- All of the configurations for ADAMSync are stored in xml files.\n      - [Configure Microsoft AD for secure LDAPS communication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_ConfigureMicrosoftADForSSLAccess.md) -- Use certificate pairs to enable Microsoft Active Directory (AD) LDAPS communications.\n        - [Set up a stand-alone certificate authority](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_SetUpAStandaloneCA.md) -- The first step to configure Microsoft Active Directory for SSL access is to set up a stand-alone Certificate Authority (CA).\n        - [Generate a certificate from an internal certificate authority](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_GenACertificateFromAnInternalCA.md) -- When you configure Microsoft Active Directory for SSL access, you must generate an internal certificate and request the external certificate.\n        - [Test the LDAPS connectivity locally](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_TesttheLDAPSConnectivityLocally.md) -- Test the LDAPS connectivity after installing the internal and third party certificates when you configure Microsoft Active Directory for SSL access.\n        - [Export the public key certificate to trust the LDAP certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_ExportThePublicKeyCertificate.md) -- Export the public key certificate and import it into the application when you configure Microsoft Active Directory for SSL access.\n      - [LDAP global catalog usage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_LDAPUsingGlobalCatalog.md) -- A DC can be granted the Global Catalog (GC) role. Global Catalog (GC) role is an LDAP-compliant directory consisting of a partial representation of every object from every domain within a forest.\n      - [OpenLDAP minor schema modification](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/r_OpenLDAPMinorSchemaModification.md) -- In OpenLDAP 2.3 systems that use the back-bdb (Berkley backend), administrators make a minor modification to their schema to facilitate the integration.\n        - [Modify the schema](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/t_ModifyTheOpenLDAPSchema.md) -- Modify the OpenLDAP schema. These steps detail a schema modification to OpenLDAP 2.3 provided by one of our customers that helped them integrate with their instance.\n      - [Record LDAP deletions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/ldap-integration/c_DeletedRecords.md) -- By default, the instance does not delete any entries after they disappear from LDAP.\n    - [Limit concurrent sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/limit-concurrent-sessions.md) -- You can limit the number of concurrent interactive sessions for a user or role on an instance across all nodes.\n      - [Explore limit concurrent sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/explore-lcs.md) -- You can limit the number of concurrent interactive sessions for a user or role on an instance across all nodes.\n      - [Configure the plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/limit-concurrent-sessions-plugin.md) -- You can activate the Limit Concurrent Sessions plugin (com.glide.limit.concurrent.sessions) if you have the admin role.\n      - [Set a limit by user or role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/set-session-limit-user-role.md) -- You can set a concurrent session limit on a specific user or on a particular role.\n      - [Disable a limit by user or role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/disable-session-limit-user-role.md) -- You can disable a concurrent session limit on a specific user or on a particular role.\n    - [Local authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/local-authentication.md) -- Use ServiceNow local authentication to secure the users login on a local device.\n      - [Login and authentication security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_LoginSecurity.md) -- Configure login security options to control access to your instance.\n        - [Explore login and authentication security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/exploring-login-and-authenication-security.md) -- Configure login security options to control access to your instance.\n      - [Define login scenarios](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_LoginScenarios.md) -- You can direct all users to the same page after login.\n        - [Employee self-service portal](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_LoginsESSP.md) -- The system keeps track of the first starting page that a user is trying to access even if the user wants to log in to the Employee Self-Service Portal.\n        - [Specify a login landing page](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SpecifyingALoginLandingPage.md) -- By default, users see their homepage on login. You can specify a different login landing page by using a system property or the content management system.\n        - [Specify lockout for failed login attempts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_LockoutForFailedLogins.md) -- The system provides inactive script actions that enable you to specify the number of failed login attempts before a user account is locked and to reset the count after a successful login.\n        - [Make UI pages public or private](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_MakeAPagePublic.md) -- You can make pages public if you want your users to see the pages without logging in.\n      - [Password complexity requirements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/password-complexity-requirements.md) -- Passwords in your ServiceNow instance must meet complexity requirements.\n        - [Explore Password complexity requirements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/explore-password-requirements.md) -- Passwords in your ServiceNow instance must meet complexity requirements.\n        - [Enable password policies on your instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/enable-password-policies.md) -- Implement password policy controls at login. Force users to change their password if the password does not meet the password policy criteria.\n          - [Password policy properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/password-policy-properties.md) -- The password policy properties enable you to administrate password policies, exclude list passwords, and apply a password policy during login.\n        - [Configure your password policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/set-your-password-policy.md) -- Password policy criteria enables you to secure your password and adhere to the minimum password complexity requirements.\n          - [Configure password for a user](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/reset-your-password.md) -- Set your user's password for the instance based on the password policy that is configured.\n          - [Exclude passwords on your instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/blacklist-passwords.md) -- Add passwords to the Excluded Password table to prohibit specific passwords from being used by users on your instance.\n        - [Unsupported password characters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/unsupported-password-characters.md) -- There are password characters that are not supported. Users cannot use these characters, based on ServiceNow password complexity requirements.\n      - [Password Reset](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_SelfServicePasswordReset.md) -- The default self-service Password Reset process enables a user to reset the password without assistance from service desk agents.\n        - [Modify notification email](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_ModifyPasswordResetNotification.md) -- Users of the self-service Password Reset process receive an email notification when they request password reset. You can modify the text of the email and other aspects of the notification.\n        - [Configure properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetPwdResetProps.md) -- You can specify properties that configure the Password Reset experience for end users.\n      - [Remember me](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_ChSetRemMeChkbxCookie.md) -- When the Remember me check box is selected at login, a cookie is stored on the user's computer. This cookie automatically authenticates the user upon subsequent visits.\n        - [Change the default value of the Remember me check box](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_ChSetRemMeChkbxCookie.md) -- When the Remember me check box is selected at login, a cookie is stored on the user's computer. This cookie automatically authenticates the user upon subsequent visits.\n        - [Remove the Remember me check box](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_ChSetRemMeChkbxCookie.md) -- When the Remember me check box is selected at login, a cookie is stored on the user's computer. This cookie automatically authenticates the user upon subsequent visits.\n      - [Configure the logout confirmation prompt](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_EnableTheLogoutConfirmPrompt.md) -- You can enable a logout confirmation prompt to prevent users from inadvertently logging themselves out.\n      - [Implement a nonce](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_ImplementingANonce.md) -- You can implement a nonce to be used with single sign-on digest authentication.\n        - [Nonce process flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_HighLevelOverview.md) -- When a customer has implemented the digested token Single Sign-on and wishes to add the security of a nonce, they follow a certain process flow.\n        - [Implement a nonce](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_Implementation.md) -- Add a cryptographic nonce to the authentication header for custom digest-based Single Sign- On (SSO) to confirm that each authentication token is valid for one use only. This implementation requires ServiceNow developer expertise.\n    - [Multi-factor authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-landing.md) -- Learn how to activate, use, and configure Multi-factor authentication (MFA).\n      - [MFA enforcement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-enforcement.md) -- Enforcement of MFA for non-SSO logins to ServiceNow from the Yokohama release.\n        - [Changes due to the MFA enforcement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/changes-mfa-enforcement.md) -- Information about the changes that are expected due to the MFA enforcement.\n        - [MFA enforcement properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-enforcement-properties.md) -- Configure the properties for MFA enforcement from Yokohama and upgrade to Yokohama.\n        - [Troubleshooting MFA enforcement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/troubleshoot-mfa-enforcement.md) -- Troubleshooting information due to the MFA enforcement.\n        - [Frequently asked questions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/faq-mfa.md) -- Details about some of the FAQs due the MFA enforcement.\n          - [MFA enforcement requirements – What and Why](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/faq-mfa-enforcement.md) -- FAQ related to MFA enforcement and why it’s important.\n          - [MFA enforcement scope](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-enforcement-scope.md) -- FAQ related to MFA enforcement scope and why it’s important.\n          - [MFA enforcement timeline](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/faq-mfa-enforcement-timeline.md) -- FAQ related to MFA enforcement timelines and why it’s important.\n          - [MFA enforcement exception](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/faq-mfa-exception.md) -- FAQ related to MFA enforcement exception and why it’s important.\n          - [MFA metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/faq-familiar-with-mfa.md) -- FAQ related to understanding the MFA metrics.\n          - [MFA types](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/faq-mfa-types.md) -- FAQ related to MFA types and why it’s important.\n          - [MFA reset](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/faq-reset-mfa.md) -- FAQ related to MFA reset and why it’s important.\n      - [Exploring MFA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/explore-mfa.md) -- Multi-factor Authentication (MFA) is an authentication method that requires users to provide information other than their basic credentials.\n      - [Configuring MFA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-mfa.md) -- Configure multi-factor authentication (MFA) to improve your users security posture when using ServiceNow.\n        - [MFA context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-auth-context.md) -- The Multi-factor Authentication (MFA) policy context uses a policy to define how and when MFA is enforced during the login process.\n        - [MFA verification methods](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-methods.md) -- ServiceNow's MFA supports verification methods such as Authenticator App, Fast IDentity Online 2 (FIDO2) and Time-based One-Time Password (TOTP).\n          - [Web Authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/web-authentication-mfa.md) -- Use the Integration - Web Authentication (com.snc.integration.webauthn) to allow hardware key or biometric reader authentication on your instance.\n            - [Configuring with Biometrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/user-pub-cred.md) -- Administrators can use the User Public Credentials list to view and manager user created credentials.\n            - [Authenticator configuration options](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-auth-config.md) -- Use the Authenticator Configuration page to manage authenticator options on your instance.\n          - [MFA factor policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-factor-policies.md) -- Use the MFA factor policies to specify the types of authentication factors that you would like to permit for your instance.\n            - [FIDO2 as an MFA factor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-with-fido.md) -- You can configure FIDO2 as an MFA factor policy to enforce MFA for yours.\n              - [Configure FIDO2 as an MFA factor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-fido-mfa-factor.md) -- Configure policy input and condition to display FIDO2 as an MFA factor policy for authentication.\n            - [SMS as an MFA factor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-with-sms.md) -- Multi-factor authentication (MFA) with SMS as a factor for your authentication.\n              - [Activate the MFA with SMS plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/active-mfa-sms-plugin.md) -- For MFA with SMS, install the Multi-factor authentication with SMS (com.snc.authentication.sms_mfa) plugin.\n              - [Configure SMS as an MFA factor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-sms-as-mfa-factor.md) -- Configure policy input and condition to display SMS OTP as an MFA factor policy for authentication.\n              - [Multi-factor authentication Providers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/multi-factor-authentication-providers.md) -- Use MFA providers to configure SMS and Email based authentication to ensure every user can login securely.\n                - [Configure MFA Provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-mfa-provider.md) -- Configure SMS and Email with the Provider to ensure every user can login securely.\n                - [Vonage Provider custom configuration (Tutorial)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/vonage-provider-config.md) -- Configure a SMS with Vonage Provider to ensure every user can login securely.\n            - [Email as an MFA factor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-with-email.md) -- Multi-factor authentication (MFA) with Email as a factor for your authentication.\n              - [Configure Email as an MFA factor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-mfa-factor-policy-with-email.md) -- Configure policy input and condition to display Email OTP as an MFA factor policy for authentication.\n        - [MFA system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-properties.md) -- Use system properties to enable and customize MFA to meet your security requirements.\n        - [MFA criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/multi-factor-authentication-criteria.md) -- Use MFA criteria to determine which users and roles must use two-step verification.\n          - [Configure user-based multi-factor criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_RequireMultifactorAuthForAUser.md) -- Use user based multi-factor criteria to enable MFA for a user.\n          - [Configure role-based multi-factor criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-role-criteria.md) -- Use role based multi-factor criteria to enforce Multi-factor authentication for all users assigned to specific roles.\n          - [Configure adaptive authentication policy-based multi-factor criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-policy-criteria.md) -- Use adaptive policies to determine which users must use two-step multi-factor (MFA) verification.\n        - [MFA with SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-sso.md) -- You can use MFA with an SSO provider for your ServiceNow instance.\n          - [Configuring MFA with SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-mfa-with-sso.md) -- Enforce MFA with SSO for your users within or outside your organization.\n        - [Reset MFA for users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/reset-multi-factor-authentication.md) -- Administrators can reset MFA for users who deleted the app, lost access to the device, or have no alternative MFA associated with their device.\n        - [MFA References](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/reference-topic-multi-factor-authentication.md) -- Reference topic related to the configuration of MFA.\n        - [MFA Metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-metrics.md) -- View the different MFA metrics to understand the MFA adoption and usage.\n      - [Using MFA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-use.md) -- Learn how to use multi-factor authentication tools to securely access your instance.\n        - [Set up MFA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetUpMultiFactorAuthUponLogin.md) -- If your administrator enabled MFA on your profile but you have not yet set up the application, you can set it up upon login.\n        - [Set up MFA on your user profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-setup-profile.md) -- Enable multi-factor authentication for your account in your user profile settings.\n          - [Log in with MFA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_LogOnWithMultifactorAuth.md) -- Login with MFA when it is enabled by your administrator on your instance.\n        - [Authenticator applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-auth-app.md) -- Use third party authenticator applications to generate temporary MFA pass codes.\n          - [Change an Authenticator app](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/change-authenticator-app.md) -- Generate a new code to change an Authenticator app on your device.\n        - [Web Authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-web-auth.md) -- Your users can use hardware keys or their device's biometric readers (FIDO2) to authenticate to an instance.\n          - [Register a biometric authenticator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-setup-bio-auth.md) -- Register a biometric authenticator to use as part of your MFA login.\n          - [Register a hardware security key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-setup-hardware-key-auth.md) -- Register a hardware key to use as part of your MFA login.\n      - [MFA Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-dashboard.md) -- View the different MFA metrics to understand the MFA adoption and usage.\n        - [User Metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/user-metrics.md) -- User Metrics displays the user MFA enrollment trends on ServiceNow.\n        - [Log in Metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/login-metrics.md) -- Log in Metrics displays the log in trends on the ServiceNow.\n        - [MFA Guided Setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/mfa-guided-setup.md) -- Use the MFA Guided Setup to step through the initial configuration of the MFA module and understand the requirements for MFA enforcements.\n    - [Multi-Provider single sign-on (SSO)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_MultipleProviderSingleSignOn.md) -- External SSO allows organizations to use several SSO identity providers (IdPs) to manage authentication as well as retain local database (basic) authentication.\n      - [Activate Multi-Provider SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_ActivateMultipleProviderSSO.md) -- This integration requires the Integration - Multiple Provider Single Sign-On Installer (com.snc.integration.sso.multi.installer) plugin.\n      - [Properties, tables, and scripts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_InstalledWithMultiProviderSSO.md) -- The Integration - Multiple Provider Single Sign-On Installer plugin includes the following system properties, tables, and scripts.\n      - [Multi-Provider SSO configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/sso-configurations.md) -- You must perform several steps to set up Multi-Provider SSO, including configuring properties, creating identity providers (IdPs), and configuring users to use SSO.\n        - [Configure Multi-Provider SSO properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_ConfigureMultiProviderSSOProps.md) -- Configure SSO properties and also add a property to the System Properties table to configure an IdP inclusion list.\n        - [Create an external identity provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_CreateUpdateIdentityProvider.md) -- After you have configured the multi-provider SSO properties, you can update or create new SAML 2.0 or digest token identity provider.\n          - [Generate instance service provider (SP) metadata for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_GenerateServiceNowSPMetadata.md) -- As part of your SSO configuration, you can generate the instance SP metadata to provide to the IdP.\n        - [Configure users for Multi-Provider SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_ConfigureUsersMultiProviderSSO.md) -- Administrators can configure Multi-Provider SSO for individual users or for all users who belong to a company. You cannot configure Multi-Provider SSO for groups.\n        - [Test IdP connections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_TestIdPConnections.md) -- Testing the connection to an IdP validates the settings before enabling external authentication.\n          - [Common IdP connection errors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_CommonConnectionErrors.md) -- The following table describes some of the common IdP connection errors and their solutions.\n          - [Troubleshoot script issues with SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_TroubleshootScriptIssuesWithSAML.md) -- Troubleshoot script issues with SAML. You might encounter script issues if SAML is already active at the time that you activate Multiple Single Sign-On and if you already customized the installation exits.\n        - [Log in using Multi-Provider SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/log-in-multi-provider-sso.md) -- The recommended and most efficient method for users to log in using Multi-Provider SSO is to use a specifically configured URL.\n        - [Enable users to choose the identity provider for login](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_AllowUsersToChooseTheLoginIdP.md) -- SSO federation support enables users to choose which IdP to log in to.\n        - [Use Service Portal with Multi-Provider SSO to redirect a URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_UsingESSPagesWithMultiProviderSSO.md) -- Service Portal uses a combination of system properties and script includes to determine how the system handles URL redirects for users logging in to the portal.\n        - [Account recovery (ACR)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/sso-acct-recovery.md) -- Administrators can configure account recovery (ACR) to perform recovery activities such as addressing SSO misconfiguration or expired certificates.\n          - [Configure an ACR user](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/config-acr.md) -- Configure an account recovery user to perform account recovery activities on your instance.\n            - [Configure an account recovery user from the Account Recovery Properties page](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/config-acr.md) -- Configure an account recovery user to perform account recovery activities on your instance.\n            - [Configure an account recovery user from an admin user profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/config-acr.md) -- Configure an account recovery user to perform account recovery activities on your instance.\n          - [Account recovery properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/acr-properties.md) -- Use system properties to configure Account Recovery (ACR) on your instance.\n        - [E-signature for Multi-Provider SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/e-signature-for-multi-provider-sso.md) -- E-signature with Multi-Provider SSO enables you to use the e-signature properties instead the SAML or OIDC properties for authentication.\n          - [Activate Approval with e-Signature plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-approval-esignature.md) -- The Approval with e-Signature plugin (com.glide.e_signature_approvals) allows users to approve requests by re-entering their login credentials.\n          - [SSO approval for a SAML 2.0 authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/sso-esignature-approval-SAML.md) -- An SSO approval with e-signature requires configuration on the SAML IdP and the ServiceNow instance.\n          - [SSO approval for an OIDC authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/sso-esignature-approval-oidc.md) -- An SSO approval with e-signature requires configuration on the SAML IdP and the ServiceNow instance.\n      - [OIDC as a SSO identity provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/OIDC-SSO-overview.md) -- OpenID Connect (OIDC) is an identity layer built on top of the OAuth protocol, which provides a modern and intuitive Single Sign-on (SSO) experience to you and your end users.\n        - [Create an OIDC configuration for SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-OIDC-configuration-SSO.md) -- Create or update an OpenID Connect (OIDC) configuration by using the Multi-Provider SSO plugin.\n        - [Use Facebook-based SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/use-facebook-based-sso.md) -- Log in to your ServiceNow instance by using your Facebook credentials on the Facebook-based SSO.\n        - [Configure a Facebook-based SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-facebook-based-sso.md) -- Configure a Facebook-based SSO to your ServiceNow instance.\n      - [SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_SAML2.0WebBrowserSSOProfile.md) -- The Security Assertion Markup Language (SAML) is an XML-based standard for exchanging authentication and authorization data between security domains.\n        - [Multi-Provider SSO (SAML) IdP authentication flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/idpauthflow.md) -- Describes the different entities that can authenticate a user through the SAML multi-SSO.\n        - [Identity Provider (IdP) system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_IdentityProviderIdPSysProps.md) -- An IdP generally offers an XML document containing their authentication and logout metadata.\n          - [Set the IdP issuer URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetTheIdPIssuerURL.md) -- Provide the URL to the IdPs who will issue the security token.\n          - [Set the AuthnRequest service URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetTheAuthnRequestServiceURL.md) -- Using the IdP's metadata, set the request service URLs for the integration's IdP.\n          - [Set the SingleLogoutRequest service URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetTheSingleLogoutRequestSvcURL.md) -- Set the request service URLs for the integration's IdP by using the IdP's metadata.\n          - [(Optional) Enable signed logout requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_EnableSignedLogoutRequests.md) -- Some IdPs require the Service Provider to sign logout requests with a certificate.\n        - [Service Provider (SP) system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_SetTheServiceProviderSPSysProps.md) -- These system properties define how the instance interacts with the IdP as a Service Provider.\n          - [Set the instance URL for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetTheInstanceURL.md) -- Set the instance-specific URLs so that the IdP can authenticate users.\n          - [Set the audience URL for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetTheAudienceURL.md) -- Enable your instance to verify that it is the intended recipient of a SAML response by using the Audience property.\n          - [Set up a NameID policy for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetUpNameIDPolicy.md) -- Set up a NameID policy for SAML. SAML 2.0 requires the IdP to exchange a NameID token with the service provider.\n            - [Determine what User table field matches the NameID token](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_MatchUserTableFieldToNameIDToken.md) -- Identity providers specify what format the NameID token has.\n            - [Set the IdP NameID policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetTheIdPNameIDPolicy.md) -- Specify what format the IdP uses for the NameID token.\n            - [Values in the User table field for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_ValuesInTheUserTableField.md) -- Ensure that the integration's User table field contains appropriate matching values.\n          - [(Optional) Enable providing an authentication context class for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_OptEnableProvidingAuthContxtClass.md) -- You can enable the instance to send an authentication context class request to the IdP containing your instance's preferred authentication request format.\n          - [(Optional) Set keystore properties for signing logout requests for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_OptSetKeystorePropsSignLogoutReqs.md) -- Set the keystore properties to enable the integration to sign logout requests by using your signed server and signed CA certificates.\n            - [Create a service provider key store for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_CreatingAServiceProviderKeyStore.md) -- Create a Java key store containing the following items for your instance to sign logout requests.\n            - [Install a service provider keystore for signing SAML requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_InstallASPKeystoreSigningSAMLReqs.md) -- Use the following steps to remove the existing example key store and install your own Service Provider key store containing your public and private key pair.\n            - [Create self-signed BCFKS keystore for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-fips-certificate-for-saml.md) -- Generate a FIPS 140-2 compliant self-signed BCFKS keystore for use in SAML signing and encryption operations within the Multi-Provider SSO plugin.\n        - [(Optional) Advanced SAML properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_SetAdvancedSystemProperties.md) -- The following advanced settings allow you to further increase security and debug the integration.\n        - [Install the identity provider certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_InstallTheIdentityProviderCert.md) -- You can paste a PEM certificate into a X.509 Certificate form so the identify provider can verify communications with the service provider.\n          - [Replace a missing certificate for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_ReplacingAMissingCertificate.md) -- If the Certificate module displays a blank page, the SAML 2.0 certificate record has been deleted. You can replace the missing certificate by manually creating a certificate record.\n        - [Test the SAML integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_TestTheIntegration.md) -- Test the SAML integration after you complete all the other setup tasks.\n          - [Multi-SSO (SAML 2.0) errors and fixes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/saml-errors.md) -- A list of common errors and associated fixes for a Multi-SSO (SAML 2.0) setup and configuration.\n        - [Redirect single sign-on (SSO) logins](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_ForcingLoginViaSSOOnly.md) -- When SSO is enabled, you can redirect users to specific pages or direct users to login locally.\n        - [Clone an instance with a SAML integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_CloneAnInstanceWASAMLIntegration.md) -- Clone an instance with a SAML integration. Before you clone an instance that uses SAML 2.0, preserve the SAML SSO-related settings on the target instance or you might make the target instance inaccessible.\n        - [SAML 2.0 concepts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_SAMLConcepts.md) -- Familiarize yourself with these SAML concepts.\n          - [Typical SAML process flow (diagram)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_TypicalProcessFlowDiagram.md) -- A typical SSO logic flow involves looking for an active session, checking user credentials, and creating the necessary token.\n          - [Login (AuthnRequest) process flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_LoginAuthnRequestProcessFlow.md) -- SAML 2.0 specifies a Web Browser SSO Profile that involves exchanging information among an identity provider (IdP), a service provider (SP), and a principal (user) on a web browser.\n          - [Logout (LogoutRequest) process flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_LogoutLogoutRequestProcessFlow.md) -- During logout, the instance issues the SAML 2.0 LogoutRequest service call to the IdP.\n          - [URL information for an SSO provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_URLInformationForAnSSOProvider.md) -- During a login challenge resulting from a URL link into the instance that requires an SSO session, the referring URL might need to be supplied to the SSO provider so that after authentication, the URL can be passed back to the instance and linked to the correct resource.\n        - [SAML 2.0 configuration using Multi-Provider SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_CreateASAML2Upd1SSOConfigMultiSSO.md) -- You can create or update a SAML 2.0 SSO configuration from the Multi-Provider SSO feature.\n          - [X.509 certificates for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/x-509-certificate-sso.md) -- Store and activate the necessary IdP certificates for your SAML configuration.\n        - [SAML Guided Tour](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/saml-guided-tour.md) -- Use the SAML Guided Tour to configure SAML for single sign-on.\n        - [Integrating SAML 2.0 with other features](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_AddSupportForIntegrations.md) -- You can integration your SAML 2.0 solution with other features like E-Signature, deep linking, and ADFS.\n          - [Add deep linking support for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_AddSupportForDeepLinking.md) -- Deep linking allows instances to support direct email links to a particular record in the system.\n          - [ADFS integration with SAML 2.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_ADFSIntegrationWithSAML2.0.md) -- The ServiceNow Multi-Provider SSO plugin supports a SAML 2. single sign-on (SSO) integration with Microsoft ADFS.\n            - [Set up ADFS for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_DefineADFSServiceURL.md) -- Set up ADFS for SAML. This procedure uses ADFS 2.0 and shows samportal.example.com as the ADFS website. Replace this with your ADFS website address.\n            - [Set up the instance for ADFS](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetUpServiceNowForADFS.md) -- Configure your instance and SAML 2.0 settings to work with ADFS.\n            - [Configure an ADFS relying party](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_ConfigureADFSRelyingParty.md) -- Take the instance metadata and import it into your ADFS server. However, manual configuration of the relying party appears to be easier to implement.\n            - [Configure the ADFS relying party claim rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_ConfigureADFSClaimRules.md) -- Edit the claim rules to enable proper communication with the instance.\n            - [Create a SAML logout endpoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_CreateASAMLLogoutEndpoint.md) -- Create a SAML logout endpoint to allow single logout.\n            - [Test the ADFS configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_TestTheADFSConfiguration.md) -- Test your ADFS configuration to verify that it is properly functioning as an identity provider.\n            - [(Workaround) Enable service provider-initiated authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_EnableSvcProviderInitiatedAuth.md) -- Use this workaround if authentication fails because you do not have SAML 2.0 Update 1. This issue can happen if users attempt to skip IdP authentication and navigate directly to the instance.\n            - [(Workaround) Support Kerberos authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SupportKerberosAuthentication.md) -- A workaround is available for the SAML 2.0 integration that changes the authentication context from forms-based authentication to Windows-based authentication.\n          - [Azure AD Integration with SAML 2.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/azure-ad-integration-with-saml-2-0.md) -- Integrate ServiceNow with Azure Active Directory (Azure AD).\n            - [Add ServiceNow from the gallery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/add-servicenow-from-the-gallery.md) -- Add ServiceNow from the gallery to your list of managed SaaS apps on Azure AD.\n            - [Configure Azure AD SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-azure-ad-sso.md) -- Configure Azure AD SSO in the Azure portal.\n            - [Create an Azure AD test user](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-an-azure-ad-test-user.md) -- Create a test user on Azure AD.\n            - [Assign the Azure AD test user](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/assign-the-azure-ad-test-user.md) -- Assign the Azure AD test user that is created to use Azure single sign-on by granting access to ServiceNow.\n            - [Configure ServiceNow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-servicenow.md) -- Configure ServiceNow with Azure AD details to use SSO.\n          - [Email links with external authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_EmailLinksWithSSO.md) -- You can use email links when using the digestive token external authentication, however, you must establish how to handle links in email notifications.\n        - [Add E-Signature support for SAML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_AddingSupportForESignature.md) -- Configure the following properties for E-Signature with Security Assertion Markup Language (SAML) 2.0 update 1.\n        - [Migrating an existing SAML 1.1 integration to SAML 2.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_MigratingASAML1.1IntegToSAML2.0.md) -- To migrate from a SAML 1.1 integration to a SAML 2.0 integration, contact customer support.\n        - [Update your existing SAML 2.0 integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_UpdateExistingSAML2.0Integration.md) -- Update your existing SAML 2.0 integration.\n          - [Sample SAML 2 responses after the update](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_SampleSAML2ResponsesAfterUpdate.md) -- The following sections illustrate the new required elements and attributes that the IdP should provide in the SAML Response.\n        - [SAML user provisioning](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_SAMLUserProvisioning.md) -- If users exist in your IdP but are not in your instance, SAML user provisioning can automatically create the users in your instance's User [sys_user] table.\n          - [Administer SAML user provisioning](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_AdministerSAMLUserProvisioning.md) -- Update the User table with the users in your IdP by first setting up field mapping and then enabling user provisioning through Multi-SSO IdP settings.\n        - [SAML 2.0 troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_SAML2.0Troubleshooting.md) -- Before contacting support, try the troubleshooting solutions available in the knowledge base on Hi.\n          - [Monitor the event queue for login activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_EventQueueLoginActivities.md) -- Every single sign-on integration creates events for login activities.\n          - [Event queue login events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_EventQueueLoginEvents.md) -- The SAML 2.0 integration creates events for login activities.\n    - [OAuth authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/api-inbound-and-outbound.md) -- OAuth based authentication validates the identity of the client that attempts to establish a trust on the system by using an authentication protocol.\n      - [OAuth 2.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_OAuthApplications.md) -- OAuth 2.0 lets users access instance resources through external clients by obtaining a token rather than by entering login credentials with each resource request.\n        - [Set up OAuth](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SettingUpOAuth.md) -- Set up and activate OAuth, enable the OAuth system property, create an OAuth application endpoint for external client applications to access the instance, and set OAuth parameters.\n        - [Activate OAuth](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_ActivateOAuth.md) -- By default, the OAuth 2.0 (com.snc.platform.security.oauth) plugin is active on new and upgraded instances. If the plugin is not active on your instance, you can activate it.\n        - [Set the OAuth property](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_SetTheOAuthProperty.md) -- To generate OAuth 2.0 tokens to registered applications, the com.snc.platform.security.oauth.is.active property must be active for the instance.\n        - [Change OAuth password parameter](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/OAuth-token-processor-parm.md) -- Use this property to ensure only POST body parameters are accepted as input for all supported grant types.\n      - [OAuth Inbound](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/oauth-inbound.md) -- OAuth Inbound authentication allows trusted external applications to securely access ServiceNow APIs, ensuring controlled and authorized connections.\n        - [Inbound Integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/new-inbound-integrations.md) -- The new inbound integration workflow in the ServiceNow Machine Identity Console provides enhanced experience for managing inbound integrations.\n          - [Auth Code Grant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/authorization-code-grant.md) -- The OAuth authorization code grant is a secure and widely used flow for web, mobile, or desktop apps that access user data with user consent. It supports both private clients (using a client secret), and public clients (using PKCE).\n            - [Authorization Workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/authorization-workflow.md) -- ServiceNow handles both authentication and API access by acting as the authorization and resource server. When single sign-on (SSO) is enabled, it redirects users to the configured IdP for authentication and issues tokens after successful login.\n            - [Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-an-oauth-authorization-code-grant.md) -- Configure the OAuth authorization code grant to enable secure and interactive user authentication to enable applications to access resources on behalf of users. The OAuth authorization code grant verifies that the API access is granted based on the user identity and permissions.\n          - [Client Credentials Grant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/client-credential-grant.md) -- Use the OAuth client credentials grant type for back-end services or automated integrations that access ServiceNow APIs without user interaction. The client application authenticates directly using its client ID and secret, and receives an access token that represents the application itself, and not the user.\n            - [Client Credentials Workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/client-credentials-grant-workflow.md) -- Authenticate a client application using a client credentials workflow. The client credentials grant workflow is used by back-end services or system integrations to access ServiceNow APIs without user involvement.\n            - [Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-an-oauth-client-credential-grant.md) -- Configure the OAuth Client Credentials Grant for secure machine-to-machine authentication without user interaction. It authenticates applications using client credentials and grants-controlled API access with scoped permissions.\n          - [Third Party Token Grant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/third-party-id-token.md) -- The third party token grant enables ServiceNow to accept identity tokens from trusted external identity providers, such as Azure AD or Okta. Third party token grant provides secure, token-based access. This method supports secure access and single sign-on (SSO) in federated authentication scenarios.\n            - [User Token Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/third-party-token-worflow-for-user-accounts.md) -- This workflow can be used to integrate third-party identity providers (IdPs) with ServiceNow for secure API access. It allows client applications to obtain tokens directly from an IdP and use them to access ServiceNow APIs.\n            - [Service Token Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/third-party-token-workflow-for-service-accounts.md) -- Create a service account in ServiceNow to represent the identity of a third-party application accessing APIs through a trusted identity provider (IdP). This account maps the token claims to a user record and manages access with roles and permissions.\n            - [Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-a-third-party-id-token.md) -- Configure a third-party ID token to enable secure authentication by verifying user identities through an external IdP. The third-party ID token improves security by reducing stored credentials, confirms seamless authentication, and supports interoperability with industry standards like OpenID Connect (OIDC).\n          - [JWT Grant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/jwt-bearer-grant.md) -- Configuring an OAuth JSON Web Token (JWT) bearer grant secures token-based authentication without user interaction. Use this flow when a client application needs secure, unattended access to ServiceNow resources, either as itself or on behalf of a user.\n            - [Workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/using-json-web-token-grant.md) -- Configuring an OAuth JSON Web Token (JWT) bearer grant secures token-based authentication without user interaction.\n            - [Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-an-oauth-jwt-bearer-grant.md) -- Configuring an OAuth JSON Web Token (JWT) bearer grant secures token-based authentication without user interaction. It enhances security with signed JWTs and reduces authentication overhead by eliminating repeated login attempts.\n          - [ROPC Grant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/resource-owner-password-grant.md) -- Configuring an OAuth Resource Owner Password Credential (ROPC) grant enables applications to authenticate users by directly using their credentials to obtain an access token.\n            - [Password Grant Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/resource-owner-password-credential-workflow.md) -- This flow is used in legacy or highly controlled environments where secure alternatives aren't feasible. The client app directly collects and sends user credentials to ServiceNow to obtain an access token, making it suitable only for trusted internal use.\n            - [Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-an-oauth-resource-owner-password-credential-grant.md) -- Configuring an OAuth resource owner password credential (ROPC) grant enables applications to authenticate users by directly using their credentials to obtain an access token. This method is ideal for trusted applications and legacy systems that require authentication without browser-based flows, enabling secure token validation and controlled API access.\n          - [CIMD client integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/cimd-inbound.md) -- CIMD lets the ServiceNow AI Platform accept an external OAuth client that identifies itself with an HTTPS metadata-document URL instead of a pre-issued client ID and secret.\n            - [CIMD workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/cimd-inbound-integration-workflow.md) -- Configuring Client ID Metadata Document (CIMD) inbound support lets an instance accept an external OAuth client that's identified by a metadata document URL, without storing a client secret for that client.\n            - [Configure a CIMD client](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-cimd-client.md) -- Register a Client ID Metadata Document (CIMD) client so that the instance accepts inbound OAuth requests from a client identified by a metadata document URL. You can fetch the client's configuration from its metadata URL or enter the details manually.\n            - [Update a CIMD client](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/update-cimd-client.md) -- Update a registered Client ID Metadata Document (CIMD) client, including switching the metadata sync mode between Live and Static.\n        - [Old Inbound integrations experience](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/old-inbound-integrations.md) -- Old experience - Inbound integrations.\n          - [OAuth authorization code grant flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_OAuthAuthorizationCodeFlow.md) -- Authorization code grant flow allows a user to access a resource by authenticating directly with an OAuth server that trusts the resource, in contrast with authenticating with username/password credentials.\n            - [Authorize access to an OAuth endpoint using auth code flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_AuthorizeAccessEndpiont.md) -- End users who own a protected resource on the ServiceNow instance must authorize access to the resource before the instance can provide the access token.\n            - [Authorization code flow state parameter requirement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/oauth-auth-code-flow-state-parm.md) -- The glide.oauth.state.paramater.required system property enables the State parameter to be required in an OAuth request for authorization code flow.\n            - [Authorization code flow example: ServiceNow instance as authorization server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_InstanceAsAuthorizationServer.md) -- You can use an instance as an authorization server to issue tokens to a client using authorization code flow.\n          - [Create an endpoint for clients to access the instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_CreateEndpointforExternalClients.md) -- Create an OAuth application endpoint for external client applications to access the ServiceNow instance.\n            - [OAuth API response parameters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_OAuthAPIResponseParameters.md) -- The OAuth 2.0 API produces a JSON response containing the following parameters as name:value pairs.\n            - [OAuth API request parameters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_OAuthAPIRequestParameters.md) -- Learn about the OAuth API request parameters that access token requests use.\n          - [Create an OAuth JWT API endpoint for external clients (machine to machine integration)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-jwt-endpoint.md) -- OAuth JWT bearer token enables the client web applications to authenticate with your instance seamlessly using the inbound JWT grant type instead of requiring the end user to manually log in or share the password.\n          - [Configure an OAuth OIDC provider for accepting third-party token](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/add-OIDC-entity.md) -- Configure an OAuth OpenID Connect (OIDC) provider to accept identity tokens generated by a third-party OIDC provider using inbound API calls using Single Sign-On option (Multi-Provider SSO).\n          - [Configure client type for OAuth and SSO records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/client-type.md) -- Configure the Client Type field for OAuth and SSO record related configurations.\n          - [OAuth implicit grants](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_OAuthImplicitGrants.md) -- ServiceNow instances support the implicit grant of an access token.\n          - [Client Credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/client-credentials.md) -- Use the OAuth client credentials grant type for Inbound Integrations from a third party OAuth client to the ServiceNow platform.\n            - [Create the Client Credentials system property](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-cc-sys-prop.md) -- Create the glide.oauth.inbound.client.credential.grant_type.enabled system property to use Client Credentials grant type for OAuth inbound integrations.\n            - [Add the OAuth Application User](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/add-oauth-application-user.md) -- Add the OAuth Application User field on the OAuth Entity form to use the Client Credentials grant type for OAuth inbound integrations.\n        - [Manage OAuth tokens](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_ManageTokens.md) -- Open OAuth tokens to provide access to restricted resources.\n          - [Revoke an OAuth token](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_RevokeOAuthToken.md) -- You might want to revoke an OAuth access or refresh token for security reasons.\n      - [OAuth Outbound](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/oauth-outbound.md) -- OAuth outbound enables you to pull data from a third-party provider to your instance.\n        - [Connect to a third-party OAuth provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/connect-3rd-party-oauth-provider.md) -- Configure how the client ID and secret are sent to your OAuth provider.\n        - [JWT Bearer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/jwt-bearer.md) -- JSON Web Tokens (JWTs) enable the capability to configure server-to-server API interactions between ServiceNow and external API providers without requiring any user intervention.\n          - [Set up OAuth provider with JWT Bearer grant type](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/JWT-Bearer-token-support.md) -- JSON Web Tokens (JWTs) enable the capability to configure server-to-server API interactions between ServiceNow and external API providers without requiring any user intervention. This support enables Integration Hub or other automated tasks using JWTs to configure API and Service integrations with different providers.\n            - [Upload Java Key Store certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/JWT-Bearer-token-support.md) -- JSON Web Tokens (JWTs) enable the capability to configure server-to-server API interactions between ServiceNow and external API providers without requiring any user intervention. This support enables Integration Hub or other automated tasks using JWTs to configure API and Service integrations with different providers.\n            - [Configure a JWT signing key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/JWT-Bearer-token-support.md) -- JSON Web Tokens (JWTs) enable the capability to configure server-to-server API interactions between ServiceNow and external API providers without requiring any user intervention. This support enables Integration Hub or other automated tasks using JWTs to configure API and Service integrations with different providers.\n            - [Create a JWT provider with a JWT signing key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/JWT-Bearer-token-support.md) -- JSON Web Tokens (JWTs) enable the capability to configure server-to-server API interactions between ServiceNow and external API providers without requiring any user intervention. This support enables Integration Hub or other automated tasks using JWTs to configure API and Service integrations with different providers.\n          - [Generate a JSON Web Token (JWT)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/Scoped-API-generate-JWT.md) -- Create a JSON Web Token (JWT) for representing claims securely between two parties on the ServiceNow AI Platform.\n        - [OAuth client APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_OAuthClientAPIs.md) -- The OAuth client API provides methods to request and revoke OAuth tokens.\n        - [OAuth parameters for default profile support](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_OAuthProfileParameters.md) -- The default profile feature requires a set of parameters that you can use with the setParameter() API to specify the OAuth requestor, a context for the request, and the provider profile.\n        - [Private Key JWT Support for OAuth 2.0 Client Authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/jwt-support-for-oauth.md) -- Support JWT Support for OAuth 2.0 Client Authentication.\n          - [Configure Private Key JWT for OIDC based SSO](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/config-private-key-jwt-oidc-sso.md) -- Configure Private Key JWT for OIDC based SSO integrations.\n          - [Configure Private Key JWT for Outbound OAuth](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/config-private-key-jwt-outbound-oauth.md) -- Configure Private Key JWT for outbound OAuth integrations.\n        - [Create an outbound REST message](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/create-an-outbound-rest-message.md) -- Create outbound rest message to authorize instance as authorization server.\n    - [Personal authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/personal-authentication.md) -- Personal authentication enables you to securely connect and manage your OAuth-based integrations like Microsoft OneDrive or Google Drive.\n      - [Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-personal-authentication.md) -- You can configure personal OAuth authentication with the REST step in Flow Designer.\n      - [Get OAuth Token](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/personal-oauth-token.md) -- Check whether the user has a personal OAuth token. Use it to confirm valid access before running REST steps or integrations that require personal OAuth credentials.\n      - [Generate Auth URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/generate-initial-token.md) -- Generate the initial token for a user who doesn’t have access to the credentials page to configure personal authentication.\n      - [Activate Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-personal-authentication.md) -- You can activate the Personal Authentication plugin (com.snc.sn_ihub_personal_auth) for Integration Hub if you have the admin role. If the application does NOT include demo data or it does NOT install related applications and plugins, delete or revise the following sentence:The application includes demo data and installs related ServiceNow Store applications and plugins if they are not already installed.\n    - [Self-register to ServiceNow instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/external-user-self-registration.md) -- Use external user self-registration to on-board a large volume of external users to your instance. This feature enhances identity verification to improve customer experiences and supports commonly used registration flows.\n      - [Explore Self-register](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/explore-self-register.md) -- Use external user self-registration to on-board a large volume of external users to your instance. This feature enhances identity verification to improve customer experiences and supports commonly used registration flows.\n      - [Activate External User Self-Registration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/external-user-registration-plugin.md) -- You can activate the External User Self-Registration plugin (com.snc.external_user_self_registration) if you have the admin role.\n        - [External roles in self-registration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/external-roles-self-registration.md) -- To prevent inadvertently providing access to external users, you can assign the snc_external role to all external users.\n      - [Configure a user registration configuration for external users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/external-user-configuration.md) -- Create a user registration configuration record to bootstrap the onboarding process of external users to custom ServiceNow applications. This form guides the external users through the self-registration process.\n        - [Configure Google reCAPTCHA for external user self-registration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-recaptcha-sp.md) -- To use the Google reCAPTCHA service, you must request an API key pair from Google and then configure the related system properties.\n        - [Default registration form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/default-reg-form-fields.md) -- You can use the default registration form fields or create custom registration form fields.\n        - [Add a custom registration form field](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/add-custom-reg-form-field.md) -- You can add custom fields in the user self-registration form.\n      - [Enable external user self-registration for Service Portal](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/sp-ext-user-self-reg.md) -- Enable external users to register to a ServiceNow app through Service Portal.\n      - [Verify user self-registration requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/verify-user-self-reg-requests.md) -- After a user registers from the Service Portal , a user record is added to the Registration Requests module. You can view the list of registered users who have successfully registered in the Service Portal .\n    - [Token based authentication (User logins)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/token-based-authentication.md) -- Enhance the security mechanism for users to access a network using token based authentication.\n      - [Time limited authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/time-limited-authentication.md) -- Support time limited authentication for your ServiceNow instance.\n        - [Explore Time limited authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/explore-tla.md) -- Support time limited authentication for your ServiceNow instance.\n        - [Activate time limited authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/activate-time-limited-authentication.md) -- Time limited authenication activates through the Integration - Multiple Provider Single Sign-On Installer plugin.\n        - [Time limited authentication with SMS - Twilio Tutorial](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/time-based-authentication-with-mfa.md) -- Set up time limited authentication with MFA factors such as SMS using Twilio.\n      - [Digest token authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_DigestTokenAuthentication.md) -- The digest token authentication passes user credentials and a digest token within an unencrypted HTTP header.\n        - [Explore digest token authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/explore-digest-token.md) -- The instance reads the HTTP header value and compares its computed hash value of the digest token.\n        - [Configure the digest properties for multi-provider single sign-on (SSO)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/t_EnterDigestPropsMultiProviderSSO.md) -- After enabling a digest installation exist script, configure properties for multi-provider SSO.\n        - [Sample digest token implementations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/r_SampleImplements.md) -- Here are several samples of creating a digest token.\n        - [Sample Java digest algorithm for encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_SamJavaDigAlgEncrypt.md) -- This Java algorithm illustrates creating a digest token from an HTTP header.\n        - [Sample C](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_SampleC.md) -- This C class illustrates creating a digest token from three input parameters.\n    - [Web Embeddables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/web-embeddables.md) -- Secure the web embeddables feature for authenticating the ServiceNow's web components that are used in third-party portals.\n      - [Configure client session access role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/configure-client-session-access-role.md) -- The Embedded Session Role Configuration (Client Access Role configuration) record is created by default, which included removal of admin and security admin roles (high privilege roles) for the users using the UI components on the third-party portals.\n    - [Web service security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_WebServiceSecurity.md) -- Enforce security using basic authentication, mutual authentication, or WS-Security.\n      - [Explore Web service security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/exploring-web-sec.md) -- Enforce security using basic authentication, mutual authentication, or WS-Security.\n      - [Configure mutual authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/authentication/c_MutualAuthentication.md) -- Mutual authentication establishes trust by exchanging secure sockets layer (SSL) certificates.\n  - [Access Control Lists (ACLs)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/access-control-rules.md) -- Access control lists (ACLs) restrict access to data by requiring users to pass a set of requirements before they can interact with it.\n    - [Explore Access Control Lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/exploring-access-control-list.md) -- Explore access control lists (ACLs).\n      - [ACL types](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/acl-rule-types.md) -- Create ACLs on different components of the system.\n        - [Datatype ACL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/datatype-acl.md) -- The datatype ACL enables you to write ACLs that apply to all fields of a specific type.\n          - [Create a datatype ACL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/create-a-datatype-acl.md) -- Learn how to create a datatype ACL.\n      - [ACL control of function fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/acl-function-fields.md) -- When evaluating access to a function field, in addition to checking access to the function field itself, the system also checks access to the function's contributing fields. Contributing fields are those used as the arguments in a given function definition.\n      - [Security jump-start - ACL rules plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/r_SecurityJumpStartACLRules.md) -- The Security jump-start access control level (ACL Rules) plugin is installed automatically on all new instances. Use this plugin to quickly secure multiple system tables and expedite the production launch process for your organization.\n    - [Configure an ACL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/t_CreateAnACLRule.md) -- Configure custom access control lists (ACLs) to secure access to new objects or to change the default security behavior.\n      - [Deny-Unless ACL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/acl-denial-behavior.md) -- Learn details about Deny-Unless ACLs.\n      - [Allow ACL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/allow-acl.md) -- Learn about Allow ACLs (access control lists).\n      - [Query ACLs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/query-acl-rule.md) -- Query ACLs allow you to define more granular access control by explicitly defining who can query the data.\n      - [Secure records in an embedded list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/t_SecuringRecordsInAnEmbeddedList.md) -- To apply security to the records in embedded lists, limit editing and deleting records in embedded lists to specific roles.\n      - [Related record access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/related-record-access.md) -- Related record access enable consistent control over what records users are able to access between related tables.\n    - [Contextual Security Manager](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/r_ContextualSecurity.md) -- Contextual Security Manager protects your data by controlling read, write, create, and delete authorization.\n      - [Prevent duplicate entries with Contextual Security: Role Management V2](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/Role-Mgmt-V2.md) -- Roles inherited from other roles are added as individual entries in the User Roles table [sys_user_has_role], potentially causing one role to have duplicate entries. Contextual Security: Role Management V2 eliminates these duplicate entries and prevents future duplicates.\n      - [Upgrade to Contextual Security: Role Management V2](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/Role-Mgmt-V2-Upgrade.md) -- Contextual Security: Role Management V2 is automatically installed on new instances. You can upgrade from Contextual Security: Role Management to Contextual Security: Role Management V2 to eliminate duplicate roles in the User Roles table and prevent future duplicates.\n      - [UserHasRoleInhCountPatcher job for Role Management V2](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/userhasroleinhcountpatcher-job.md) -- UserHasRoleInhCountPatcher job for resolving role inheritance discrepancies.\n      - [Enable role auditing with Contextual Security: Role Management V2](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/enable-audit-roles.md) -- Set a system property to enable the Audit Roles table to create audit records related to user roles.\n      - [Double-check form submission](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/r_DoubleCheckFormSubmission.md) -- When the system determines that a particular field (such as task.number) should not be written to by the current user, the system renders that field in a read-only mode, which is why the number field is not writable on most incidents.\n      - [Default deny property](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/c_DefaultDenyProperty.md) -- The default deny property (glide.sm.default_mode) controls the security manager default behavior when the only matching ACL rules are the wildcard table ACL rules.\n    - [Advanced ACL configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/acl-advanced-config.md) -- In addition to creating new ACLs or modifying existing ones, you can configure other aspects of ACL functionality.\n      - [Provide external users access to a table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/t_ProvideExternalUsersAccessToTables.md) -- To enable users with only the snc_external role to access the list view of a table, you must create a series of ACLs.\n      - [Apply ACL script conditions to reference fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/r_ContScriptCondAppRefFld.md) -- Use the glide.sys_reference_row_check system property to enable scripted conditions for reference fields.\n      - [Apply ACLs to AJAXGlideRecord (client-side Glide record)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/r_ApplyACLsToAJAXGlideRecord.md) -- Use a system property to perform access control list (ACL) rule validation when server-side records (for example, tables) are accessed using GlideAjax APIs within a client script.\n      - [Evaluate the admin override at the access level](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/t_EvalAdmOverrideAccLevel.md) -- If you want to force ACL evaluation for admin overrides at the access level, you can add a system property.\n      - [ACL debugging tools](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/c_AccessControlRulesDebug.md) -- Field level debugging and access ACL rule output messages are available to help you troubleshoot and debug ACLs. The ACL configuration watcher lets you know what related ACLs exist when you modify one.\n        - [ACL troubleshooting reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/r_ACLTroubleshoot.md) -- ACL troubleshooting includes identifying ACL rule errors and use the debugging tools to fix the ACL related problems.\n        - [ACL configuration watcher](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/c_ACLConfigWatcher.md) -- The ACL configuration watcher lets you know what related ACLs exist on a table when you insert, update, or delete an ACL on the same table.\n          - [Show ACL execution plan](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/t_ShowACLExecutionPlan.md) -- Administrators can view how ACLs relate to each other by viewing an execution plan for any ACL in the instance.\n          - [Use the ACL configuration watcher](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/t_UseTheACLConfigWatcher.md) -- Use the ACL configuration watcher after you elevate to security_admin role.\n  - [Access Analyzer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/access-analyzer.md) -- ServiceNow Access Analyzer is an access diagnostic tool designed for AI administrators or creators to validate the access controls configured within various resources and agentic assets (agentic workflows and AI agents).\n    - [Exploring Access Analyzer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/explore-access-analyzer.md) -- Analyze identities on the ServiceNow AI Platform instance.\n    - [Using Access Analyzer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/use-access-analyzer.md) -- Analyze identities and their access on the ServiceNow AI Platform instance.\n      - [Using Evaluate access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/using-evaluate-access.md) -- Analyze identities on the ServiceNow AI Platform instance.\n        - [View permissions for a user](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/view-permissions-for-a-user.md) -- Use Access Analyzer to view permissions for a selected user.\n        - [View permissions for a role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/view-permissions-for-a-role.md) -- Use Access Analyzer to view permissions for a selected role.\n        - [View permissions for a group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/view-permissions-for-a-group.md) -- Use Access Analyzer to view permissions for a selected group.\n        - [Export Access Analyzer queries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/export-access-analyzer-queries.md) -- Export the results from an Access Analyzer query.\n      - [Comparing user records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/comparing-user-records.md) -- Compare user records to understand the access between two users.\n      - [Comparing user access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/comparing-access-controls.md) -- Use Access Analyzer to compare two users' access control.\n      - [Viewing previous search results in Access Analyzer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/access-analyzer-queries.md) -- View, reanalyze, or export results from previous searches.\n    - [Permission evaluation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/permission-evaluation.md) -- Understand permission evaluation criteria when using Access Analyzer.\n    - [Frequently Asked Questions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/frequently-asked-questions.md) -- Frequently asked questions while using Access Analyzer.\n      - [Access Analyzer Debug logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/access-analyzer-logs.md) -- Access Analyzer debug logs supply detailed information about the evaluation of access controls for a specific operation. These logs assist administrators and developers in troubleshooting access issues, optimizing security configurations, and ensuring that users have appropriate access to resources within the ServiceNow platform.\n    - [Access simulator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/access-simulator.md) -- As a feature within Access Analyzer, you use access simulator to pre-validate the effects of adding or removing roles and groups for a specific user without actually implementing the changes.\n      - [Exploring Access Simulator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/explore-access-simulator.md) -- Access Simulator helps you pre-validate how access to a specified table would change once a role or group is assigned or removed from the user.\n      - [Configuring the Access Simulator (Take actions)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/configure-access-simulator.md) -- Configure the Take actions options to complete the role and group assignments that you wish to add after the simulation.\n      - [Using the Access Simulator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/use-access-simulator.md) -- Simulate changes to user access.\n        - [Adding Roles to users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/add-role-to-user.md) -- Use the Simulate Add Role for simulating the user's access changes for a resource (table).\n        - [Removing Roles from users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/remove-role-from-user.md) -- Use the Simulate Remove Role for simulating the user's access changes for a resource (tables).\n        - [Adding users to Groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/add-user-to-group.md) -- Use the Simulate Add to Group for simulating the user's access changes for a resource (table).\n        - [Removing users from Groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/remove-user-from-group.md) -- Use the Simulate Remove from Group for simulating the user's access changes for a resource (table).\n      - [Frequently Asked Questions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/faq-access-simulator.md) -- Frequently asked questions about using Access Simulator.\n    - [Access Insights](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/access-insights.md) -- Access Insights helps you analyze or troubleshoot Role and Group entitlements through peer-level comparisons.\n      - [Exploring Access Insights](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/explore-access-insights.md) -- Access Insights is a feature within the Access Analyzer application that provides data-driven recommendations and comparative analysis regarding user, role, and group entitlements.\n      - [Configuring Access Insights](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/configure-access-insights.md) -- Enable and configure the Access Insights feature in Access Analyzer.\n      - [Using Access Insights](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/use-access-insights.md) -- Use Access Insights to understand users' peer-level access to a selected resource.\n  - [Access findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/access-findings.md) -- Access Findings is the proactive detection and remediation layer within Access Management Console. It runs eight out-of-box access checks against your instance on a daily schedule, surfaces prioritized findings when misconfigurations are detected, and provides a complete remediation workflow.\n    - [Explore Access findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/explore-access-findings.md) -- Access Findings runs eight out-of-box access checks against your instance on a daily schedule, letting you know when misconfigurations are detected. It also provides a complete remediation workflow that includes AI-powered guidance.\n    - [Use Access Findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/use-access-findings.md) -- You can use Access Findings to view the potential vulnerabilities that were discovered the last time access checks ran on your ServiceNow AI Platform.\n  - [Access management console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/access-management-console.md) -- ServiceNow AI Platform's Access management console ensures that the right individuals have the appropriate permissions to the right resources at the right time.\n    - [Explore Access management console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/access-controls-console.md) -- Use the Access Management Console within Security Center to review and remediate access issues and misconfigurations. The Access Management Console provides enhanced visibility and control of your Access Analyzer findings, and streamlines remediation efforts. Within the console you can track, prioritize, and resolve access issues by assigning tasks.\n    - [Use Access management console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/use-access-management-console.md) -- Use the Access management console to ensure that the right individuals have the appropriate permissions to the right resources at the right time.\n  - [Security Attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/security-attributes-landing.md) -- Security Attributes offer a flexible alternative to access control lists.\n    - [Security Attributes Fundamentals](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/security-attribute-fundamentals.md) -- A Security Attribute is highly configurable piece of information about a Subject or it’s Environment, when used in access controls, enables fine grain security configuration in a non-complex way.\n    - [Create Security Attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/create-security-attributes.md) -- Create security attributes with a step-by-step guide.\n      - [OOB (Out-of-Box) Security Attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/oob-security-attributes.md) -- Commonly used, generalized Security Attributes roles ready for use.\n      - [Compound Security Attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/compound-security-attributes.md) -- Compound security attributes enable you to create consistent and reusable security attribute profiles to suit your business needs.\n        - [Create compound Security Attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/compound-security-attributes.md) -- Compound security attributes enable you to create consistent and reusable security attribute profiles to suit your business needs.\n    - [Security Attribute Type](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/security-attribute-scope.md) -- Security attributes support local or existing types.\n      - [Local and Existing security attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/security-attribute-scope.md) -- Security attributes support local or existing types.\n  - [Field Query Roles and Restrictions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/field-query-roles-restrictions.md) -- The Field Query Roles and Field Query Restrictionsattribute enable you to better control what information is available to users in tables.\n    - [Configure a Field Query Role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/configure-a-field-query-role.md) -- Learn how to enable and configure a Field Query Role attribute.\n    - [Configure Field Query Restrictions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/configure-field-query-restrictions.md) -- Learn how to configure a Field Query Restriction\n  - [Scripting Governance Tool](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/scripting-governance.md) -- Use the Scripting Governance Tool to provide a single, centralised control for managing scripting access across your ServiceNow AI Platform.\n    - [Explore Scripting Governance Tool](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/explore-sgt.md) -- The Scripting Governance Tool provides a single, centralised control for managing scripting access across your ServiceNow AI Platform.\n    - [Use Scripting Governance Tool](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/use-sgt.md) -- Use the Scripting Governance Tool to provide a single, centralised control for managing scripting access across your ServiceNow AI Platform.\n      - [Scan for users who have scripted](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/scan-for-users-who-have-scripted.md) -- Scan your instance to find users who have scripted within a specific time frame. The scan queries the audit logs and identifies any user who has performed write or update to a table having script field.\n      - [Remove users from the Conditional Script Writer group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/remove-conditional-script-writer-users.md) -- Use the Manage scripting access to manually add or remove users from the Conditional Script Writer group to control who has scripting access.\n    - [Manage Scripting Governance Tool](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/manage-sgt.md) -- Enable or disable the Scripting Governance Tool on your instance by running the appropriate script. Only users with the security_admin role can run these scripts and modify the associated properties.\n  - [Machine identity access controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/machine-identity-access-controls.md) -- Define and enforce granular access control policies on specific resources for integration users.\n    - [Create a machine identity access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-control/create-a-machine-identity-access-control.md) -- Enable administrators to define and enforce granular control for integration users by introducing User Access Profiles. This feature provides an additional layer of security and control, allowing admins to specify the exact resources (REST APIs and SOAP APIs) that an integration user can access, ensuring tighter governance and minimizing security risks.\n  - [Security Roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-roles.md) -- Security Roles provide added security, every user must have at least one role so that the instance can distinguish between internal and external users.\n    - [Explicit Roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/explicit-roles.md) -- You can give both internal users and external users access to your instance. However, you might not want both types of users to have the same level of access. To provide added security, every user must have at least one role so that the instance can distinguish between internal and external users.\n      - [Request Explicit Roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/explicit-roles.md) -- You can give both internal users and external users access to your instance. However, you might not want both types of users to have the same level of access. To provide added security, every user must have at least one role so that the instance can distinguish between internal and external users.\n    - [Elevated privilege roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_ElevatedPrivilege.md) -- Elevated privilege roles require you to manually accept the responsibility of using the role before you can access the features of the role.\n      - [Security_admin role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/security-admin-role.md) -- The security_admin role is an elevated privilege role provided with High Security Settings that lets users create and change access controls and change High Security Settings.\n      - [Elevate to a privileged role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ElevateToAPrivilegedRole.md) -- The base system admin can elevate to a privileged role to have access to the features of High Security Settings.\n      - [Force administrators to manually elevate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ForceAdmManElev.md) -- A property is available to force all users with the administrator role to manually select the role that they want to elevate to.\n  - [Connections and Credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r-credentials.md) -- Credentials and connection information are required to gain access to a computer or network device for Discovery, Service Mapping, and Cloud Management or to perform work using Orchestration. When adding content to Share or AppStore, you can configure connections and credentials relevant to your environment without modifying built content.\n    - [Explore credentials, connections, and aliases](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/credentials-connections-alias.md) -- All application integrations in the ServiceNow AI Platform use connections, credentials, and aliases to enable applications to access resources.\n      - [Scope protections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/scope-protections-connections-credentials.md) -- You can classify certain types of Connection & Credential records as belonging to a scope, and extend scope protections to them. These scope policies protect records you create in a table, and prevent interactions with records that are private to another scope.\n      - [Domain separation and Credentials and Connections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/domain-separation-credentials_conn.md) -- Domain separation is supported in Credentials and Connections. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n      - [Connection & Credential configuration templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/spoke-configuration-template.md) -- Enable users with the admin and flow_designer roles to set up spoke integrations with third-party systems using a single, customizable form.\n        - [Configure a template for OAuth JWT Bearer grant type](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/docusign-example.md) -- This example configuration template sets up Credential and Connection records using the JWT Bearer grant type to authenticate requests to Docusign.\n        - [Create a configuration template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/create-template.md) -- Create a template that defines the inputs required to set up a spoke. Set static key-value pairs to create records and set values that apply to every integration. Set dynamic key-value pairs to gather user input and set field values that may vary. Using this template, admins and flow designers can set up the spoke from a single form.\n    - [Get started with connections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/connection-information.md) -- Use the connections table to set up a Basic, JMS, JDBC, or HTTP(s) connection to a target host.\n      - [Create a basic connection for PowerShell and SSH](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/configure-ps-connection.md) -- Configure connection information to use with a custom activity or action that uses the PowerShell or Secure Shell (SSH) protocol.\n      - [Create an HTTP(s) connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/create-https-connection.md) -- The HTTP(s) connection provides the information custom HTTP(s) actions or activities use to connect.\n      - [Create a JDBC connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/create-JDBC-connection.md) -- The JDBC Connection provides the information custom JDBC actions or activities use to connect to various target databases.\n      - [Create a JMS connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/configure-connection-JMS.md) -- Configure your system to use Java Messaging Service (JMS) with a custom JMS activity or action.\n      - [Create connection attributes for IntegrationHub](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/create-connection-attributes.md) -- Define connection-specific variables that you can use in Integration Hub integration steps.\n    - [Get started with credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/credentials-getting-started.md) -- The MID Server uses the credentials you create in the Credentials [discovery_credentials] table to access resources for Discovery, Orchestration, Service Mapping, and Cloud Management.\n      - [Create a Connection & Credential alias](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/connection-alias.md) -- Define an alias to label a credential or connection record.\n      - [Set up OAuth integration via MID Server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/create-conn-alias-oauth-integration-via-mid-server.md) -- Create a connection record that enables the sending of an OAuth token request to a third-party server via a MID Server.\n      - [Credential aliases for Discovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/discovery-credential-alias.md) -- Credential aliases for Discovery allow an administrator to use specific credentials on Discovery schedules. You can configure behaviors for your aliases that determine how strictly the system enforces their use.\n        - [Create a Discovery credential alias](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/discovery-credential-alias.md) -- Credential aliases for Discovery allow an administrator to use specific credentials on Discovery schedules. You can configure behaviors for your aliases that determine how strictly the system enforces their use.\n      - [Credential aliases for Orchestration activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/c_AssignCredsOrchActivities.md) -- Credential alias gives an administrator more control over the credentials used in Orchestration activities.\n      - [Create and test your credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/t_CreateCredential.md) -- Create and test the credentials that Discovery, Service Mapping, Cloud Management, and Orchestration require to access hardware and software in your network.\n        - [Ansible Tower credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/ansible-tower-creds.md) -- Ansible Tower credentials are required to access your Ansible configuration management account. Use these credentials to manage Ansible resources through the Cloud Management application.\n        - [API key credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/API-key-credential-form.md) -- An API key is a unique code that is passed in to an API to identify the calling application or user.\n        - [Applicative credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/applicative-creds.md) -- Some applications require credentials in addition to the credentials the that host machine requires. Credentials required to access these applications are referred to as applicative credentials.\n        - [Basic authentication credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_BasicAuthCredentialsForm.md) -- The basic authentication credential type manages access to store basic authentication credentials.\n        - [Chef server credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/chef-server-creds.md) -- Chef server credentials access chef integrations with the instance.\n        - [CIM credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_CIMCredentialsForm.md) -- The CIM credential type manages access to a CIM server (also referred to as a CIMOM - Common Information Model Object Manager) for information about VMware ESX servers. This credential type is available for Discovery.\n          - [Configure NetApp storage devices for CIM credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_CIMCredentialsForm.md) -- The CIM credential type manages access to a CIM server (also referred to as a CIMOM - Common Information Model Object Manager) for information about VMware ESX servers. This credential type is available for Discovery.\n        - [Cloud credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_CloudManagementCredentialsForm.md) -- Cloud credential types manage access to cloud-based applications, including Amazon Web Services and the Microsoft Azure cloud.\n        - [Container image repository credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/container-image-repo-credential.md) -- The container image repository credentials manage access to private repositories for container image scanning. This credential type is available for Discovery.\n        - [Infoblox credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/infoblox-creds.md) -- Infoblox credentials are required to set up IP pools (IPAM) in the Cloud Management application.\n        - [JDBC credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_JDBCCredentialsForm.md) -- The JDBC credential type manages access to a Java Database Connectivity (JDBC) connection. This credential type is available for Discovery and Orchestration.\n        - [JMS credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_JMSCredentialsForm.md) -- The JMS credentials type manages access to a Java Message Service (JMS). This credential type is available for Discovery and Orchestration.\n        - [OAuth 2.0 credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/oauth-2-credentials.md) -- OAuth 2.0 credentials enable ServiceNow to obtain access to user accounts on an HTTP service.\n        - [SAP credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_SAPCredentials.md) -- The SAP credential type manages access to SAP JCo systems. This credential type is available for Discovery and Orchestration.\n        - [SNMP credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/c_SNMPCredentials.md) -- Discovery explores many kinds of devices (switches, routers, printers, and so on) using the SNMP protocol. Credentials for SNMP don’t include a user name, just a password, called the community string.\n          - [SNMP community credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/c_SNMPCredentials.md) -- Discovery explores many kinds of devices (switches, routers, printers, and so on) using the SNMP protocol. Credentials for SNMP don’t include a user name, just a password, called the community string.\n          - [SNMPv3 credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/c_SNMPCredentials.md) -- Discovery explores many kinds of devices (switches, routers, printers, and so on) using the SNMP protocol. Credentials for SNMP don’t include a user name, just a password, called the community string.\n        - [SSH credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_SSHCredentialsForm.md) -- Discovery, Orchestration, and Integration Hub explore UNIX and Linux devices by using SSH credentials to execute commands over Secure Shell (SSH). SSH commands must run with root privileges, either with root credentials or through the use of sudo. SSH private key credentials provide additional security.\n        - [VMware credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_VMwareCredentialsForm.md) -- The VMware credentials type manages access to vCenter credentials.\n        - [Windows credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_WindowsCredentialsForm.md) -- Windows credentials provide access to Windows computers. This credential type is available for Discovery and Orchestration.\n          - [Configure Windows credentials for the MID Server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_WindowsCredentialsForm.md) -- Windows credentials provide access to Windows computers. This credential type is available for Discovery and Orchestration.\n      - [Credential affinity for Discovery and Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/c_CredentialAffinity.md) -- Credential affinity is an association between a set of credentials and a device on your network.\n      - [Credentials troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/r_CredentialTroubleshooting.md) -- Review the <credentials_debug> section of the ECC queue payload to troubleshoot issues with credentials.\n      - [External credential storage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/c_ExternalCredentialStorage.md) -- An instance can store credentials used by Discovery, Orchestration, and Service Mapping in an external credential repository rather than directly in a ServiceNow credentials record.\n        - [Request external credential storage for Discovery and Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/t_ActivateExtrnlCredStoragePlugIn.md) -- The External Credential Storage plugin is available by request.\n        - [External credential storage configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/external_cred_storage_configuration.md) -- Configure your instance to obtain credentials from a remote repository.\n          - [Create a JAR file to resolve credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/external_cred_storage_configuration.md) -- Configure your instance to obtain credentials from a remote repository.\n          - [Import a JAR file to resolve credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/external_cred_storage_configuration.md) -- Configure your instance to obtain credentials from a remote repository.\n          - [Configure the credential identifier](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/external_cred_storage_configuration.md) -- Configure your instance to obtain credentials from a remote repository.\n          - [Configure the credential identifier for AWS](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/external_cred_storage_configuration.md) -- Configure your instance to obtain credentials from a remote repository.\n        - [CyberArk credential storage integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/c_CyberArkCredStorageIntegrate.md) -- The MID Server integration with the CyberArk vault enables ServiceNow Orchestration, ServiceNow Discovery, and ServiceNow Service Mapping to run without storing any credentials on the instance.\n          - [CyberArk integration configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/c_CyberArkIntegrationConfiguration.md) -- These procedures include both CyberArk and ServiceNow configuration tasks, including references to the appropriate CyberArk documentation.\n            - [Configure the CyberArk vault and install the AIM API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/t_InstallCyberArkAIMAPI.md) -- Configure the CyberArk vault to allow MID Server access and install the CyberArk AIM API on the MID Server machine.\n            - [Import the CyberArk JAR file](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/t_ImportTheCyberArkJARFile.md) -- Import the CyberArk JavaPasswordSDK.jar file into the instance to make it accessible to the MID Server.\n            - [Configure the MID Server for CyberArk AIM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/t_ConfigureTheMIDServerForCyberArk.md) -- Configure the config.xml file to grant the MID Server access to the CyberArk vault with AIM API.\n            - [Configure the MID Server for CyberArk CCP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/t_ConfigureTheMIDServerForCyberArkCCP.md) -- Configure the config.xml file to grant the MID Server access to the CyberArk CCP vault.\n            - [Configure CyberArk for SNMPv2 credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/t_ConfigCyberArkSNMPv2Cred.md) -- If your system uses SNMPv2, you can create a special file to map the attribute in a credential to the community string.\n            - [Configure the CyberArk credential identifier](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/t_ConfigCyberArkCredIdentifr.md) -- Create the unique key that CyberArk can use to identify specific credentials in the external repository.\n            - [Configure AWS credentials on a CyberArk vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/create-cred-AWS.md) -- Configure your CyberArk vault with the AWS credentials to be retrieved for use by your instance.\n              - [Configure AWS Credentials on a CyberArk Vault using Classic UI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/create-cred-AWS.md) -- Configure your CyberArk vault with the AWS credentials to be retrieved for use by your instance.\n            - [Configure Azure credentials on a CyberArk vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/create-cred-azure.md) -- Configure your CyberArk vault with the Azure credentials to be retrieved for use by your instance.\n        - [OAuth 2.0 authentication via MID Server using external credential storage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/oauth-2-0-support-in-external-credential.md) -- Store OAuth 2.0 credentials-client ID and client secret-in the CyberArk vault instead of the ServiceNow instance. The MID Server gets the credentials from the CyberArk vault, when required to get the OAuth token. The token is stored in the MID Server and refreshed automatically upon expiry.\n          - [Configure a JAR file and credential identifiers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/configure-and-import-jar-file.md) -- Configure a JAR file and credential identifiers so that the JAR file resolves the credential identifiers into actual credentials from the CyberArk external vault. The process enables the MID Server to get and include OAuth 2.0 credentials in the OAuth token request.\n          - [Configure CyberArk](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/configure-cyberark.md) -- Configure the CyberArk vault to store OAuth 2.0 credentials and respond to requests for OAuth 2.0 credentials from the MID Server.\n            - [Configure OAuth 2.0 credentials on CyberArk](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/configure-oauth-2-0-credentials-on-cyberark.md) -- Configure your CyberArk vault with OAuth 2.0 credentials that the ServiceNow instance requests.\n          - [Configure a connection to send OAuth request via the MID Server using external vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/configure-oauth-2-0-authentication.md) -- Configure a connection to send requests for OAuth 2.0 tokens to a third-party auth server via the MID Server. The MID Server adds OAuth 2.0 credentials (Client ID and Client Secret) from the CyberArk external vault, OAuth scope, and token URL from the instance to the request and sends them to the third-party auth server.\n    - [Authentication Algorithms](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/authentication-algorithms.md) -- Verify the identity of the sender using Authentication Algorithms\n      - [Configure an authentication algorithm](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/configure-authentication-algorithm.md) -- Configure an authentication algorithm so that you can sign outbound HTTP requests.\n      - [Configure an Amazon Signature based Custom Algorithm](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/configure-an-amazon-signature-based-custom-algorithm.md) -- Generate the Amazon Signature based data needed to authenticate to a web service by running script.\n      - [Configure a custom authentication algorithm](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/configure-a-custom-authentication-algorithm.md) -- Generate the custom data needed to authenticate to a web service by running script.\n      - [Check IP service affinity for Discovery and Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/connections-and-credentials/t_CheckIPServiceAffinity.md) -- You can check the IP Services table for a list of IP addresses that are associated with a protocol.\n  - [ServiceNow access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_SNCAccessControl.md) -- The SNC Access Control plugin (com.snc.snc_access_control) enables you to control which Customer Service and Support employees can access your instance, and when.\n    - [Explore ServiceNow access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/exploring-access-control.md) -- The SNC Access Control plugin (com.snc.snc_access_control) enables you to control which Customer Service and Support employees can access your instance, and when.\n    - [Activate ServiceNow access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ActivateSNCAccessControl.md) -- You request activation of the SNC Access Control plugin (com.snc.snc_access_control).\n    - [Configure ServiceNow access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_ConfigureAccessControl.md) -- Configure an access control record to specify one or more Customer Service and Support employees who have permission to log in your instance.\n    - [Audit logging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_AuditLogging.md) -- The following logging tracks logins and activity by ServiceNow employees.\n- [Identity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/identity-landing.md) -- Know more about the Identities in the instance.\n  - [Global Identity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/global-identity.md) -- Use ServiceNowGlobal Identity to help identify and manage users across multiple instances.\n    - [Exploring Federated ID](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/federated-id.md) -- The ServiceNow Identity system deduplicates users across multiple instances using their User ID and email, and assigns each resolved user a unique Federated ID for consistent identification.\n    - [Accessing Federated ID Criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/configure-federated-id-criteria.md) -- Access Federated ID Criteria to see the ID fields selected to generate the Federated ID unique identifier. The default setting is User ID and email.\n    - [Updating ID fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/updating-id-fields.md) -- To generate new Federated IDs, you can either use the existing user resolution search criteria or update the criteria before regeneration.\n  - [Identity and Access Audit](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/identity-audit.md) -- Use the Identity and Access Audit to understand changes made to users, groups, roles, and ACLs.\n    - [Exploring Identity and Access Audit](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/explore-identity-audit.md) -- Use Identity and Access Audit to understand changes made to users, groups, roles, and ACLs.\n    - [Identity Audit Results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/identity-audit-results.md) -- Displays all audits performed within the ServiceNow instance.\n      - [User Trails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/user-trails.md) -- Displays audits of users in the ServiceNow instance.\n      - [Group Trails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/group-trails.md) -- Displays audits of groups in the ServiceNow instance.\n      - [Role Trails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/role-trails.md) -- Displays audits of roles in the ServiceNow instance.\n      - [ACL Trails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/acl-trails.md) -- Displays audits of ACLs in the ServiceNow instance.\n    - [Security Auditable Fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/security-auditable-fields.md) -- Displays table and field level details that will be audited in the ServiceNow instance.\n      - [Configuring Tables and Fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/configure-tables-and-fields.md) -- Configure tables and fields for Identity and Access Audit.\n      - [Configuring Retention Period](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/configure-retention-period.md) -- Configure the retention period for Identity and Access Audit.\n    - [Supported and unsupported fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/allowed-fields-for-audit.md) -- A list of fields that support auditing and those that do not.\n  - [Identity Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/identity-center.md) -- Allows you to monitor, manage, and minimize identity-based risk and security gaps.\n    - [Exploring Identity Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/explore-identity-center.md) -- Identity Center is a collection of user attributes, access, devices, login history, security activity, and much more.\n    - [Activating the Identity Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/activate-the-identity-center.md) -- For Identity Center, install the Identity Center (com.snc.identity_center) plugin.\n    - [Identity Center for users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/identity-center-for-user.md) -- View the details about your active sessions, login history, and trusted devices with the Identity Center.\n      - [Viewing Active Sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/active-sessions.md) -- Displays the information about the user sessions.\n      - [Viewing Login History](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/login-history.md) -- Provides details about your login history.\n      - [Viewing Registered Mobile Devices](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/registered-mobile-devices.md) -- Provide details about your registered mobile on the ServiceNow instance.\n    - [Identity Metrics for administrators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/identity-center-for-admin.md) -- View trends of the users, privileged users, active sessions, and integrated account on your ServiceNow instance.\n  - [Machine Identity Console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/machine-identity-console.md) -- Manage your service accounts which are used for integrations with ServiceNow.\n    - [Exploring Machine Identity Console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/explore-machine-identity-console.md) -- Manage your service accounts, which are used for integrations with ServiceNow.\n      - [Inbound integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/inbound-integrations.md) -- Inbound Integrations in the machine identity console allows you to configure and manage external applications to access ServiceNow APIs.\n      - [Security findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/security-score.md) -- Provides Machine Identity security score and findings.\n        - [Accounts with no login for 100 days](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/accounts-with-no-login-for-100-days.md) -- Display the findings about the accounts that have not accessed any API in 100 days under the Security findings in the Machine Identity Console.\n        - [Accounts using Basic Authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/accounts-using-basic-authentication.md) -- Display the findings about the accounts that are using only basic authentication to authenticate the APIs under the Security findings in the Machine Identity Console.\n        - [Integration accounts with Web Service Access set to false](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/integration-accounts-wsa-false.md) -- Display the findings about the accounts that are authentication ServiceNow with the Web Service Access set to false under the Security findings in the Machine Identity Console.\n        - [Accounts performing both UI and API login](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/accounts-ui-and-api-logins.md) -- Display the findings about the accounts that are performing UI and API login under the Security findings in the Machine Identity Console.\n      - [Metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/machine-identity-metrics.md) -- Metrics of the machine identities.\n      - [Machine Identity Console Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/machine-identity-console-settings.md) -- Configure the Machine Identity security score settings.\n    - [Activating Machine Identity Console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/activate-machine-identity-console.md) -- Activate the Machine Identity Management com.glide.identity.machine_identity_management to manage your service accounts which are used for integrations with ServiceNow.\n    - [Using Machine Identity Console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/use-machine-identity-console.md) -- Manage your service accounts which are used for integrations with ServiceNow using the Machine Identity Console.\n  - [Role masking for AI agents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/role-masking.md) -- Role masking for AI agents and agentic workflows helps administrators enhance security by limiting the roles those agents use during tool execution, and by verifying that AI agents run with least-access privileges.\n    - [Agent Access Role Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/configure-role-masking.md) -- Restrict the roles that an AI agent uses at runtime by creating an Agent Access Role Configuration record that limits the agent to a defined set of roles.\n  - [System for Cross-domain Identity Management (SCIM)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/scim.md) -- The System for Cross-domain Identity Management (SCIM) API provides endpoints to create, read, update, and delete operations on users and groups using the SCIM protocol.\n    - [SCIM Provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/scim-provider.md) -- The Service Provider provisions users and groups using the SCIM API.\n      - [Exploring SCIM Provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/explore-scim-provider.md) -- The Service Provider provisions users and groups using the SCIM API.\n      - [Activating the SCIM plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/activate-scim-plugin.md) -- For SCIM activation, install the SCIM v2 - ServiceNow Cross-domain Identity Management (com.snc.integration.scim2) plugin.\n      - [Tutorial: Configure SCIM for user provisioning with a Provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/configure-scim-for-user-provisioning-with-azure-ad.md) -- Configuring SCIM automatically provisions and de-provisions users and groups to ServiceNow by using the providers provisioning service.\n        - [Provisioning user using Basic Authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/provisioning-user-basic-auth.md) -- Configuring SCIM automatically provisions and de-provisions users and groups to ServiceNow by using the providers' provisioning service with Basic Authentication.\n        - [Provisioning user using OAuth](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/provisioning-user-oauth.md) -- Configure the provider for SCIM automatically provisions and de-provisioning of users and groups to ServiceNow by using the providers provisioning service with OAuth.\n        - [SCIM Troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/scim-troubleshooting.md) -- Common error scenarios integrating with SCIM.\n      - [SCIM customization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/scim-customisation.md) -- Customize SCIM protocols for your identity management.\n        - [SCIM customization properties and schemas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/scim-customization-properties-and-schemas.md) -- The SCIM customization includes the following properties, supported schemas, and unsupported schemas.\n        - [Create a SCIM Extension schema](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/create-scim-extension-schemas.md) -- Create custom attributes to map to fields that are not mapped as part of either the core schema or the ServiceNow extension schema.\n        - [Create a SCIM ETL definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/create-scim-etl-definitions.md) -- Use the SCIM ETL definitions to map the custom attributes with the sys_user or sys_user_group tables.\n        - [Handling unmapped fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/handling-umapped-fields.md) -- You can handle unmapped fields in SCIM customization in different ways.\n      - [Creating a source definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/create-source-definition.md) -- Create a source definition to capture information about which identity source a resource is provisioned from.\n    - [SCIM Client](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/scim-client-app.md) -- The SCIM Client facilitates provisioning and updates on identity resources through CRUD operations exposed by SCIM endpoint on an external system.\n      - [Exploring SCIM Client](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/explore-scim-client.md) -- The SCIM Client facilitates provisioning and updates on identity resources through CRUD operations exposed by SCIM endpoint on an external system.\n      - [Activate the SCIM Client plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/activate-scim-client-plugin.md) -- For SCIM Client activation, install the SCIM v2 - ServiceNow Cross-domain Identity Management Client (com.snc.integration.scim2.client) plugin.\n      - [SCIM Client properties, tables, scriptable APIs, and logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/scim-client-properties.md) -- The SCIM v2 - ServiceNow Cross-domain Identity Management Client (com.snc.integration.scim2.client) plugin includes the following system properties, tables, scriptable APIs, and logs.\n      - [Create a REST message](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/create-a-rest-message.md) -- Configure a REST message for all outbound calls for a particular SCIM Provider.\n      - [Create a SCIM Provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/create-scim-provider.md) -- Create a SCIM Provider to fetch resource types and schemas information from the SCIM Provider with the REST message. Enable the configuration of the HTTP Method (PUT or PATCH) to update a resource in the SCIM Provider.\n      - [Create a SCIM Provider Resource Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/scim-provider-resource-mapping.md) -- Define the mappings of SCIM attributes to ServiceNow attributes for a particular resource type and SCIM Provider.\n        - [Create a SCIM attribute mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/create-scim-attribute-mappings.md) -- Create a SCIM attribute mapping and use it as a single source of resource to the ServiceNow table fields.\n        - [Attribute Mapping references](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/attribute-mapping-references.md) -- The attribute mappings enables you to use the attributes as a single source of resource to the ServiceNow table fields.\n      - [SCIM Client troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/identity/scim-client-troubleshooting.md) -- Troubleshooting actions can help resolve common issues when setting up or running the SCIM Client.\n- [Access observer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/access-observer.md) -- Use Access Observer to understand people and processes access data on your instance.\n  - [Configure access observation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/config-access-observation.md) -- Create an access observation record to review access to a data column during a specified time window.\n  - [Review Access Observer logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/review-access-obs-logs.md) -- Use information in the Access Observer log records for insights on how your data is accessed.\n- [Granular admin roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/granular-admin-roles.md) -- Granular admin roles enables you to verify proper access management by assigning roles that define user permissions and responsibilities. By doing so, organizations can maintain security, enforce conformance, and optimize their operations effectively.\n  - [Platform security granular admin roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platsec-granular-roles.md) -- Use granular admin roles to verify access management by assigning roles that define user permissions and responsibilities.\n- [Additional resources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/platsec-additional-resources.md) -- If you’re looking for Platform Security best practices, troubleshooting, or other implementation guidelines, select a feature or resource type to discover ServiceNow resources on other relevant websites.\n- [Virtual infrastructure security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/virtual-infrastructure-security.md) -- Use virtualization with the flexibility to install multiple MID Servers in virtualized operating systems and networks in shared physical hardware.\n- [Operating system security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/operating-system-security.md) -- Learn how the MID Server stores its ServiceNow AI Platform username and password in its configuration file, named config.xml, for secure authentication to the instance.\n- [Network security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/network-security.md) -- The MID Server communicates on port 443 using SSL to the instance and requires no inbound connections.\n- [Agentic AI security and governance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/now-assist-security.md) -- Now Assist AI agents operate securely within the boundaries you define. Layered controls govern who can invoke each agent, what data it can access, how interactions are monitored, and how your organization retains oversight.\n  - [Permissions-based access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-permissions-based-access-control.md) -- Use Agent Role Inheritance, identity types, and granular roles to verify your AI agents have only the permissions they need, and can act only within their intended boundaries.\n  - [Data protection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-data-protection.md) -- Learn how ServiceNow security tools such as the Key Management Framework, Field Encryption, and Data Classification work to keep your data secure.\n  - [Agent traceability and monitoring](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-auditing-and-monitoring.md) -- Learn how to use tools like AI Control Tower to track, monitor, and report on your AI assets.\n  - [Governance and admin safeguards](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-governance-and-admin-safeguards.md) -- Find guidance on preparing your instance for AI deployment, maintaining domain separation, and reducing risk across your Now Assist implementation.\n  - [AI threat protection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-threat-protection.md) -- Learn how Now Assist helps defend against AI-specific threats including offensive content, prompt injection, and sensitive subject detection using AI Guardian.\n  - [External AI agent security](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-3rd-party-security.md) -- Learn how to monitor and govern AI agents from external providers, with visibility into third-party data flows and assurances that sensitive data stays properly isolated across your AI ecosystem.\n  - [AI Guardian](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/now-assist-guardian.md) -- AI Guardian is built on the ServiceNow Small Language Model (SLM) and monitors generative AI interactions to detect offensive content, prompt injection attacks, and sensitive topics.\n    - [Activate offensiveness protection for generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/activate-offensiveness-protection-for-generative-ai.md) -- Activate offensiveness detection to log or block offensive content generated by Now Assist skills and workflows.\n    - [Configure prompt injection attack protection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-prompt-injection-attack-protection.md) -- Activate or deactivate prompt injection attack detection settings to protect all generative AI interactions on your instance from malicious inputs and unintended model behaviors.\n    - [Configure sensitive topic filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-sensitive-topic-filters.md) -- Set up filters in AI Guardian to redirect Virtual Agent users to a live agent or HR case when a sensitive subject is detected in a conversation.\n    - [Export AI Guardian logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/export-now-assist-guardian-logs.md) -- Export logs from AI Guardian to get insights into how often different guardrails are being detected and used.\n    - [Configuring a Guardrail Service Provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configuring-byog.md) -- AI Guardian supports default guardrails and third-party or custom guardrail service providers to extend AI content monitoring with your organization's AI governance policies.\n      - [Create a custom guardian](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-custom-guardian.md) -- Create your own custom guardian to monitor and detect requests sent to LLM.\n      - [Setup a Guardrail Service Provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/configure-guardrail-model.md) -- Select a guardrail service provider of your choice in AI Guardian to monitor and detect Now Assist interactions for harmful, offensive, and prompt injection content.\n  - [Create and secure an AI agent in Now Assist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-tutorial-overview.md) -- Plan, build, secure, test, and deploy a Now Assist AI agent.\n    - [Assess readiness](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-tutorial-assess-readiness.md) -- Verify that your instance is prepared for AI agent deployment, install the required applications, assign the required roles, and classify user identity types before you begin building.\n    - [Plan your agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-tutorial-plan-agent.md) -- Define your use case, decide between an base system and custom agent, choose an activation model, and set your success criteria before you begin building.\n    - [Build your agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-tutorial-build-agent.md) -- Create your agent in AI Agent Studio, configure its tools and knowledge sources, and set the access controls that determine who can invoke it and what data it can access.\n    - [Configure security controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-tutorial-configure-security.md) -- Set up AI Guardian guardrails and data privacy controls to protect your AI agent interactions before testing begins.\n    - [Test and validate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-tutorial-test-validate.md) -- Test your agent's execution and access controls, run automated evaluations, and review Guardian logs before approving the agent for production deployment.\n    - [Go live and monitor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/naai-tutorial-go-live-monitor.md) -- Deploy your agent to production, activate analytics and monitoring, and establish the ongoing review cadence that keeps your agent performing securely over time.\n"}}