{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41804,"path":"platform-security/security-center/auditor.md","title":"Security Center Scan Suites","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Center Scan Suites\n\nUse the Auditor suite to SecureCheck to detect misconfiguration that can impact the security posture of your instance.\n\n## Security Center Scan Suites\n\nSecurity Center provides 4 scan suites that provide schedules to run checks at different cadences. The suites are:\n\n- Security Center- daily\n- Security Center- weekly\n- Security Center- monthly\n- Security Center- quarterly\n\nYou can add custom checks to these suites to automatically perform on the respective cadence.\n\n## Check information\n\n\n
\n\nCadence\n\n\n\nCheck Name\n\n\n\nDescription\n\n\n\nScan finding type\n\n
\n\nDaily\n\n\n\nReview public knowledge base articles\n\n\n\nIdentifies knowledge bases and knowledge base Articles configured to enable access to unauthenticated users.\n\n Review and confirm that the current configuration aligns with your business needs.\n\n\n\nReview and Decide\n\n
\n\nReview public knowledge bases\n\n\n\nIdentifies public Knowledge Bases to be reviewed for confirmation that the current configuration aligns with your business needs.\n\n\n\nReview and Decide\n\n
\n\nUsers with Direct Role Assignments \\(Bypassing Groups\\)\n\n\n\nIdentifies users with roles assigned directly instead of through group inheritance. Direct assignments reduce visibility and complicate access audits — group-based access is preferred for governance.\n\n\n\nResolution Recommended\n\n
\n\nInactive Users with Assigned Roles\n\n\n\nIdentifies user accounts that are inactive but still holds active role assignments. These should be reviewed and removed to prevent unauthorized access via dormant accounts.\n\n\n\nResolution Recommended\n\n
\n\nExternal users with access to classified data\n\n\n\nExternal users are typically given limited access using the snc\\_external role. This external user currently has access to one or more classified or sensitive data tables/fields. Such access is needs to be reviewed for external accounts and may result in unauthorized data exposure.\n\n\n\nResolution Recommended\n\n
\n\nAccess controls on Tables\n\n\n\nChecks for tables without ACLs.\n\n\n\nTables should be secured with ACLs. Access to data stored in tables should be limited only to users that need it.\n\n
\n\nAccess controls on UI pages\n\n\n\nChecks for UI Pages that aren't secured by ACLs.\n\n\n\nWithout an ACL securing access to a UI Page, that UI Page is accessible to all logged-in internal users. Without any restrictions logged-in users can potentially make unauthorized changes.\n\n
\n\nAccess Controls on Client callable Script Includes\n\n\n\nChecks for client-callable script includes that aren't secured by ACLs.\n\n\n\nAll client callable script includes should be secured with an ACL using required roles.\n\n
\n\nWeekly\n\n\n\nReview client callable script includes with no corresponding ACL\n\n\n\nIdentifies client callable script includes that don’t have a corresponding ACL. These scripts use the default \\(\"\\*\"\\) client callable script include ACL.\n\n For these scripts, create ACLs that defines the appropriate criteria for access to verify that only expected users can interact with the functionality provided.\n\n\n\nResolution Recommended\n\n
\n\nDormant user account\n\n\n\nIdentified active users with no activity in a certain time frame is considered a dormant user. Dormant accounts without proper review can lead to unmanaged, fragmented, or untracked access risks.This flagged user has not logged into the system for configured time frame.\n\n\n\nResolution Recommended\n\n
\n\nUser Account shouldn't have both internal and external roles\n\n\n\nChecks for user records with both internal and external roles assigned.\n\n\n\nInternal user roles are intended for users within your company. External user roles are intended for external personnel, such as customers and partners.\n\n
\n\nMonthly\n\n\n\nReview custom tables with record producers and no business rule\n\n\n\nIdentifies record producers that don’t have additional server-side validation. This check identifies custom tables with a Record Producer but without an associated business rule.\n\n These may enable users to submit unexpected data into the associated table.\n\n\n\nResolution Recommended\n\n
\n\nReview fields with HTML Sanitization inactive\n\n\n\nIdentifies HTML fields where [HTML Sanitization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/c_HTMLSanitizer.md) is inactive.\n\n HTML sanitization removes or replaces potentially harmful elements and attributes within HTML code. Review HTML fields where sanitization is inactive to confirm whether this configuration is necessary.\n\n\n\nResolution Recommended\n\n
\n\nReview inactive security feature plugins\n\n\n\nIdentifies plugins that aren’t activated that provide additional, configurable security controls. The findings produced by this check are provided for informational purposes.\n\n Before enabling one of the identified plugins, verify that the plugin meets your use cases or requirements. You can mute these findings if you don't have a use case for the identified.\n\n\n\nInform\n\n
\n\nReview large allowed IP address ranges\n\n\n\nIdentifies IP Address Access Control Ranges that contain many IP Addresses.\n\n **Note:**\n\nIf you’re seeing many false positives, consider adjusting the largestExpectedCIDRBlock variable for your specific business needs.\n\nClassless Inter-Domain Routing \\(CIDR\\) blocks contain a larger amount of IP addresses as the number decreases. For example, the CIDR block size 8 is larger \\(contains more IP addresses\\) than the CIDR block size 16.\n\n Review and confirm that the current configuration aligns with your business needs.\n\n\n\nReview and Decide\n\n
\n\nReview public GraphQL schemas\n\n\n\nIdentifies public GraphQL schemas in the GraphQL API \\[sys\\_graphql\\_schema\\] table.\n\n These schemas can be configured to be available without authentication. Depending on the endpoint's functionality, this may allow unauthenticated users to perform unexpected actions or interact with unexpected data.\n\n\n\nReview and Decide\n\n
\n\nIdentify out of date store apps\n\n\n\nIdentifies apps activated on your instance that have updated versions available.\n\n Verify you’re running to the most up-to-date versions of store applications, which can include fixes to potential security issues.\n\n\n\nResolution Recommended\n\n
\n\nInsecure GlideRecord calls\n\n\n\nIdentifies scripts that are directly invokable by end users \\(such as Client-Callable Script Includes, Widgets, Processors, REST Endpoints\\)\n\n These scripts should respect ACLs and use GlideRecordSecure or GlideRecord with canRead, canWrite, canCreate, canDelete.\n\n\n\nResolution Recommended\n\n
\n\nReview public REST API endpoints\n\n\n\nIdentifies Rest API Endpoints in the Scripted REST Resource \\[sys\\_ws\\_operation\\] table that are configured to be available without authentication.\n\n Depending on the endpoint's functionality, this may allow unauthenticated users to perform unexpected actions or interact with unexpected data.\n\n\n\nReview and Decide\n\n
\n\nReview public Service Portal pages\n\n\n\nIdentifies Service Portal pages that are made public. Service Portal pages are made available to unauthenticated users by setting the \"public\" field to \"true.\"\n\n Review and confirm that the current configuration aligns with your business needs.\n\n\n\nReview and Decide\n\n
\n\nReview public UI Pages\n\n\n\nIdentifies UI Pages that are made public. UI Pages can be made available to unauthenticated users using the \\[sys\\_public\\] page.\n\n Review and confirm that the current configuration aligns with your business needs.\n\n\n\nReview and Decide\n\n
\n\nReview roles that contain the 'admin' role\n\n\n\nIdentifies any roles \\(Roles \\[sys\\_user\\_role\\] table\\) that contains the **admin** role.\n\n The **admin** role grants users administrative privileges and should be used only when necessary. Review and confirm that the current configuration aligns with your business needs. If this is an intentional configuration, this check can be muted.\n\n\n\nReview and Decide\n\n
\n\nReview UI Pages without corresponding ACLs\n\n\n\nIdentifies UI Pages that don’t have an ACL for that UI Page.\n\n UI Pages that don’t have a specific ACL default to a generic UI Page ACL, which may grant access to unintended users.\n\n\n\nResolution Recommended\n\n
\n\nReview users with valid local passwords\n\n\n\nIdentifies users with locally set passwords.\n\n Users with local passwords may interact with the instance via APIs using the local credentials, even if local logins are disallowed. This password configuration is needed for integration user accounts to function correctly.\n\n Review these user accounts to verify that only intended users \\(such as integration accounts\\) can authenticate with local authentication.\n\n\n\nReview and Decide\n\n
\n\nRotate passwords stored with outdated hashing algorithms\n\n\n\nIdentifies user accounts with passwords created in previous versions of the ServiceNow AI Platform, which may have used what is now considered a legacy or outdated hashing algorithm.\n\n Accounts created on old platform versions that haven’t rotated their passwords may still have passwords stored with a legacy hashing algorithm. Review the identified accounts created consider password resets.\n\n\n\nResolution Recommended\n\n
\n\nReview public REST API endpoints\n\n\n\nIdentifies Rest API Endpoints in the Scripted REST Resource \\[sys\\_ws\\_operation\\] table that are configured to be available without authentication.\n\n Depending on the endpoint's functionality, this may allow unauthenticated users to perform unexpected actions or interact with unexpected data.\n\n\n\nReview and Decide\n\n
\n\nUI action visibility\n\n\n\nIdentifies UI actions that can be accessed by a user with no roles who doesn’t have read access to the table.\n\n These users may be able to alter data on a table they don’t have access to via these UI actions. Verify that UI actions are only available to users with access to the table they affect.\n\n\n\nResolution Recommended\n\n
\n\nPublicly accessible knowledge base and articles\n\n\n\nChecks for publicly accessible knowledge bases and knowledge base articles\n\n\n\nPublicly accessible knowledge bases and articles are visible to all users in the instance. Increase security by limiting knowledge bases and articles to the specific audience that needs them.\n\n
\n\nCan Contribute / Cannot Contribute user criteria to be defined on each knowledge\n\n\n\nChecks for knowledge base records that don't have Can Contribute or Cannot Contribute user criteria defined.\n\n\n\nEach knowledge base should have either Can Contribute or Cannot Contribute user criteria defined. Otherwise, any user can contribute content to a knowledge base with no Contribute criteria defined.\n\n
\n\nAll Processors of type - SCRIPT must be protected with CSRF Token\n\n\n\nChecks for Processors with the SCRIPT type that aren't protected with a CSRF token.\n\n\n\nAll Processors with the SCRIPT type should be protected with a Cross-site Request Forgery \\(CSRF\\) token. These processors should have the CSRF option checked, which prohibits the processor from running unless the instance uses a CSRF token.\n\n
\n\nQuarterly\n\n\n\nReview allowed JavaScript libraries\n\n\n\nIdentifies scripts where JavaScript Content Access Control is used to allow or deny specific third-party JavaScript libraries.\n\n Review instance customizations to verify that libraries aren’t in use before blocking access. The JavaScript Content provider Access Tracking \\[sys\\_js\\_content\\_provider\\_access\\_tracking\\] table can be reviewed to see the last date that the library was accessed.\n\n **Note:** This check can be ignored in instances initially provisioned on Tokyo or later. Records on the associated table have deny rules set by default. In instances initially provisioned before Tokyo, there may be allow rules in the JavaScript Access Control tables.\n\n\n\nResolution Recommended\n\n
\n\nSecuring record producers\n\n\n\nIdentifies insecure record producers.\n\n If not assigned to appropriate roles unauthorized users can access them, potentially revealing sensitive information. Assign appropriate roles to record producers to verify that they’re accessible only to users that need them.\n\n\n\nResolution Recommended\n\n
\n\nDeactivated security controls\n\n\n\nIdentifies new Security Controls that have been introduced, but could impact to your instance. This is flagged to enable you to review the security control and test it against your instances before activating it.\n\n\n\nResolution Recommended\n\n
**Parent Topic:**[Scan suites](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/security-center/sec-center-suites.md)\n\n"}}