{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43643,"path":"security-management/c_TypesOfIntegrationsProv.md","title":"Types of ServiceNow integrations provided","bundle":null,"doc_type":null,"release":"australia","body":"\n# Types of ServiceNow integrations provided\n\nThe Security Operations applications \\(Security Incident Response, Threat Intelligence, and Vulnerability Response\\) can be seamlessly integrated with other ServiceNow applications to enhance their functionality.\n\nThe following integrations are provided in the Security Operations base system.\n\n## Security Incident Response – Event Management integration\n\nThe capabilities of the Event Management application have been expanded to support Security Incident Response. The Security Incident Response Event Management support plugin automatically parses the contents of events in Event Management to populate fields in security incidents.\n\nUse case covered:\n\nCreation of security events in the Event Management system from Security Information and Event Management \\(SIEM\\) tools\n\nUseful capabilities provided:\n\n-   Event management functionality – event correlation, event rules, and alert rules\n-   Automatic mapping of additional\\_information values to resulting security incident\n\nResources:\n\n[Security Incident event management support documentation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/c_ScIncdUseAlrts.md)\n\n[Event Management documentation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/it-operations-management/c_EM.md)\n\n## Security Incident Response - Import Set API integration\n\nIn addition to using Event Management to push security-related events, the Security Incident Response application provides an Import Set API that allows direct creation of security incidents. The REST endpoint for the Security Incident Import Set is http://localhost:8080/api/now/import/sn\\_si\\_incident\\_import.\n\nThis integration technique is useful when a\\) Event Management is not installed, or b\\) it is desired to simply create Security Incidents without going through the event > alert > Security Incident flow that is required when using Event Management.\n\nUse case covered:\n\nCreation of security incidents directly from SIEM tools.\n\nUseful capabilities provided:\n\nAutomatic CI matching on Security Incident creation based on IP, NetBIOS, or fully qualified domain name.\n\nResources:\n\n[Platform Import Set API documentation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/api-reference/c_ImportSetAPI.md)\n\n[Security Incident Web Service Import Set documentation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/c_3rdPartyAlertMonToolInteg.md)\n\n## Threat Intelligence - lookup source integration\n\nLookup sources provide the ability to send data to external lookup sources to determine if that data is malicious. Generally, that data is an IP address, URL, file, or file hash.\n\nUse case covered:\n\nLookup an IP address, URL, file, or hash with an external lookup service.\n\nUseful capabilities provided:\n\n-   Consistent way to request lookups from catalog items and security incidents.\n-   Rate limiting and throttling capabilities provided with little/no coding.\n-   Automatic creation of Indicators of Compromise \\(IoC\\) observable entries for any issues found by lookup sources.\n\n## Threat Intelligence - threat source integration\n\nThreat Sources provide the ability to pull in data from external threat intelligence repositories. This data is then imported into the various Indicators of Compromise tables that exist within the system. TAXII collections and simple blocklists are supported natively. To add new TAXII collections \\(or profiles based on a discovery or collection management service\\), it is as simple as adding an entry. Similarly, adding a new simple, single column blocklist is a matter of entering a new record and providing the URL of the blocklist. For more complicated sets of data, a custom integration can be provided to make a call to a URL and parse the response.\n\nUse case covered:\n\nRetrieve data from a threat intelligence source to load into IoC tables.\n\nUseful capabilities provided:\n\n-   Support for simple blocklists and TAXII collections with no coding.\n-   Simple mechanism for executing REST messages for retrieving data.\n-   Decoupled data retrieval/processing for integration component reusability.\n-   Native support for processing passing data returned to data sources \\(and import sets/transform maps\\).\n-   Supports multiple data requests per integration \\(for paginated calls\\) with the ability to pass context to subsequent calls\n\nResources:\n\n[Define a threat source](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/c_GetStartedWithThreatIntel.md)\n\n## Vulnerability Response - scanner invocation integration\n\nVulnerability Scanner Invocation is a lightweight integration entry point that supports invoking vulnerability scans from the instance. A third-party vulnerability scanner is called asynchronously to schedule a scan for configuration items or IP addresses.\n\nUse case covered:\n\nMake request to third-party scanner to scan a CI \\(using host information derived from CI\\) or IP address/IP addresses.\n\nUseful capabilities provided:\n\n-   Simple framework for defining scanner implementations.\n-   Consistent way to request scans from catalog items, security incidents, and vulnerable items.\n-   Automatic updating of tasks with result of scan invocation.\n\n## Vulnerability Response - data integration\n\nVulnerability data integrations are intended to retrieve vulnerability data from third-party vulnerability systems. The expected outputs from these integrations are vulnerability entries and vulnerable items. This integration allows third-party vulnerability scanners to function independently, with the expectation that vulnerabilities can be worked and tracked within the instance.\n\nUse cases covered:\n\n-   Retrieve vulnerability libraries\n-   Retrieve vulnerability/CI pairings\n-   Synchronize CIs with vulnerability management system\n\nUseful capabilities provided:\n\n-   Decoupled data retrieval/processing for integration component reusability.\n-   Native support for processing passing data returned to data sources \\(and import sets/transform maps\\).\n-   Supports multiple data requests per integration \\(for paginated calls\\) with the ability to pass context to subsequent calls.\n\nResources:\n\n[Vulnerability data integration documentation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/c_VulnerabilityIntegrations.md)\n\n**Parent Topic:**[ServiceNow Security Operations integration development guidelines](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/c_IntegrationWritingGuidelines.md)\n\n**Related topics**  \n\n\n[Security Operations Integration Configurations]()\n\n[Tips for writing integrations]()\n\n[Integration troubleshooting]()\n\n"}}