| \n\nProperty\n\n | \n\nUsage\n\n |
|---|---|
| \n\nThe default category nodes that are displayed in the Relationship Graph tab within the Workspace. The default values represent the table names corresponding to the related records.sn\\_si\\_aw.defaultCategories\n\n | \n\n- **Type**: string\n- **Default value**: sn\\_ti\\_m2m\\_task\\_observables,sn\\_si\\_m2m\\_task\\_affected\\_user,sn\\_si\\_incident\n\n |
| \n\nDefault start time for all agents when no schedule is set, formatted as 08:00sn\\_si.default.start.time\n\n | \n\n- **Type**: string\n- **Default value**: 08:00\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nDefault end time for all agents when no schedule is set, formatted as 17:00sn\\_si.default.end.time\n\n | \n\n- **Type**: string\n- **Default value**: 17:00\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nInclude Destination type observables along with other context type observables in the security incident user and CI relationshipssn\\_si.link\\_dest\\_ip\n\n | \n\nDetermines whether a security incident observable with a context type of Destination is displayed under the **Configuration Items** or **Affected Users** tabs. By default, observables with a Destination context type are excluded. To include the observables, choose Yes.\n\n |
| \n\nAllow customization when creating a Problem or Change Request from a Security Incidentsn\\_si.popup\n\n | \n\nWhen a problem or change is created, this property opens a pop-up window to modify the request.\n\n If set to **false**, the problem or change request has the same priority, short description, and description as the security incident without the option to add or edit those fields.\n\n - **Type**: true \\| false\n- **Default value**: true\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nAssociate Sightings Search results with CIs in the CMDB.sn\\_si.associate\\_ci\\_with\\_sighting\\_search\n\n | \n\nWhen set to true, sightings search results include associated configuration items that are in your CMDB. - **Type**: true \\| false\n- **Default value**: true\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nRisk score in the range is highlighted green, formatted as 0-49sn\\_si.risk.score.green\n\n | \n\nIn the Security Incidents list, security incidents with a risk score between 0 and 49 are marked with a green dot.\n\n |
| \n\nRisk score in the range is highlighted orange, formatted as 50-79sn\\_si.risk.score.orange\n\n | \n\nIn the Security Incidents list, security incidents with a risk score between 50 and 79 are marked with an orange dot.\n\n |
| \n\nRisk score in the range is highlighted red, formatted as 80-100sn\\_si.risk.score.red\n\n | \n\nIn the Security Incidents list, security incidents with a risk score between 80 and 100 are marked with a red dot.\n\n |
| \n\nThis parameter enables or disables Sightings Search Configurations that have implemented this feature.sn\\_si.enable\\_sighting\\_search\n\n | \n\nWhen set to true, sightings searches can be performed on activated integrations. - **Type**: true \\| false\n- **Default value**: true\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nThe number of rows of raw data that are saved when a Sighting Search is performed. Range 0-100sn\\_si.sighting\\_search\\_raw\\_data\\_rows\n\n | \n\nThis property defaults to 50 rows of raw data. Half of the result rows are reported from the beginning of the search time frame and half from the end of the search time frame. So, if you select 50 rows, 25 come from the start of the search time frame and 25 from the end of the search time frame.\n\n |
| \n\nAutomatically advance the Incident State to Contain when a Response Task advances to Work In Progresssn\\_si.rollup\\_task\\_state\n\n | \n\nWhile using flows or workflows, consider setting this property to **false**. This enables you to control the Incident State from within flows or workflows. It also helps avoid any potential conflicts while transitioning from one incident state to another.- **Type**: true \\| false\n- **Default value**: true\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\n**Assignment properties for Security Incident Response**\n\n | |
| \n\nLocation Weightsn\\_si.location.weight\n\n | \n\nA rating used when calculating the criteria to use for auto-assigning a security analyst. If, for example, location is considered for a task, the location weight value is added to the security analyst rating.- **Type**: integer\n- **Default value**: 10\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nSkills Weightsn\\_si.skills.weight\n\n | \n\nA rating used when calculating the criteria to use for auto-assigning a security analyst. If, for example, skills are considered for a task, the skills weight value is added to the security analyst rating.- **Type**: integer\n- **Default value**: 10\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nSet the maximum number of security analysts to be processed by auto-assignment at a time sn\\_si.max.agents.processed\n\n | \n\nThe system has an absolute limit of 300 security analysts. If you specify more than 300, it sets the value to that level. The system cannot auto-dispatch a task for a dispatch group that contains more security analysts than the value configured.- **Type**: integer\n- **Default value**: 100\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nTime Zone Weightsn\\_si.timezone.weight\n\n | \n\nA rating used when calculating the criteria to use for auto-assigning a security analyst. If, for example, the security analyst time zone is considered for a task, the time zone weight value is added to the security analyst rating.- **Type**: integer\n- **Default value**: 10\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nAmount of time \\(in minutes\\) to add between the end of a task and the travel start of the next.sn\\_si.work.spacing\n\n | \n\nAn example of a valid time value is 10.- **Type**: integer\n- **Default value**: 0\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nSpecified journal fields containing `code` tags that render content as HTML.sn\\_si.journal\\_field.html\\_enabled\n\n | \n\n- **Type**: string\n- **Default value**: work\\_notes, comments\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nCalculate the Impacted services in background.sn\\_si.refresh\\_impacted.event\n\n | \n\nAffected Services/Impacted CIs related list is generated through events. When enabled the refresh gets executed in the background and security tags are added to the incident.Set the value to **true** to perform the operation in background.\n\n- **Type**: true \\| false\n- **Default value**: false\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nRetrieve the critical service from a pre-calculated data.sn\\_si.critical\\_service.calculator.use\\_cache\n\n | \n\nEnables the critical service calculator to use a pre-calculated data of configuration items.\n\n Set the value to **true** to lookup from a pre calculated data\n\n - **Type**: true \\| false\n- **Default value**: false\n- **Location**: **Security Incident** > **Administration** > **Properties**\n\n |
| \n\nRole title \\[name\\]\n\n | \n\nDescription\n\n | \n\nContains roles\n\n |
|---|---|---|
| \n\nSecurity Incident Administrator\\[sn\\_si.admin\\]\n\n | \n\nFull control over all Security Incident Response data. Also administers territories and skills, as needed.**Note:** In the base system, the administrator also has access to sn\\_si.admin. Security Incident Response can be restricted from the administrator as long as at least one other user is assigned the security administrator role.\n\n | \n\n- assessment\\_admin— Configure assessment metric types and manage assessments. **Access level:** Full admin.\n- catalog\\_admin— Manage Service Catalog items, categories, and variables. **Access level:** Full admin.\n- decision\\_table\\_admin— Create and manage Decision Tables used in flows and playbooks. **Access level:** Full admin.\n- decision\\_table\\_reader— View Decision Tables. **Access level:** Read-only.\n- filter\\_admin— Create and manage saved filters visible to other users. **Access level:** Full admin.\n- flow\\_designer— Create and manage Flow Designer flows, subflows, and actions. **Access level:** Full admin.\n- pd\\_author— Author and configure Process Automation Designer definitions. **Access level:** Author/configure.\n- pd\\_content\\_author— Author content used within Process Automation Designer definitions. **Access level:** Author/configure.\n- pd\\_operator— Run and operate Process Automation Designer definitions. **Access level:** Operate.\n- skill\\_admin— Manage skills used for agent and analyst assignment. **Access level:** Full admin.\n- skill\\_model\\_admin— Manage skill-matching models used in auto-assignment. **Access level:** Full admin.\n- sn\\_si.analyst\n- sn\\_si.ingestion\\_profile\\_admin\n- sn\\_si.knowledge\\_admin\n- sn\\_si.manager\n- sn\\_sec\\_cmn.admin— Administer shared Security Operations Common configuration. **Access level:** Full admin.\n- sn\\_secops\\_setup.admin\n- sn\\_si.restriction\\_access\\_manager\n- sn\\_si.special\\_access\\_read\\_manager\n- sn\\_si.special\\_access\\_write\\_manager\n- sn\\_ti.malicious\\_attachment\\_access— Access attachments flagged as malicious. **Access level:** Special access.\n- sn\\_ti.observable.admin— Manage Threat Intelligence observables. **Access level:** Full admin.\n- tags\\_admin— Manage tags across the platform. **Access level:** Full admin.\n- template\\_admin— Manage templates. **Access level:** Full admin.\n- territory\\_admin— Manage territories used for geolocation and dispatch. **Access level:** Full admin.\n- treemap\\_admin— Manage treemap indicators used on dashboards. **Access level:** Full admin.\n- user\\_admin— Create and manage user accounts and group membership. **Access level:** Full admin.\n\n |
| \n\nProfile Admin\\[sn\\_si.ingestion\\_profile\\_admin\\]\n\n | \n\nConfigure the plugins, create, edit, delete, and manage profiles for Splunk, Splunk ES, and Azure Sentinel Integration for Security Operations application.**Note:** Users with the sn\\_si.admin role can perform all operations available to a Profile Admin, as the sn\\_si.admin role inherits the required permissions by default.\n\nThe sn\\_si.ingestion\\_profile\\_admin role is assignable to users by the sn\\_si.admin.\n\n | \n\nN/A\n\n |
| \n\nSecurity Incident Analyst\\[sn\\_si.analyst\\]\n\n | \n\nManage security incidents. Underlying role for basic Security access. Users with this role can create and update security incidents, requests, and tasks, as well as problems, changes, and outages related to their incidents.\n\n | \n\n- pd\\_operator\n- snc\\_platform\\_rest\\_api\\_access\n- sn\\_msi.promoter\n- sn\\_msi.proposer\n- sn\\_si.basic\n- sn\\_ti.malicious\\_attachment\\_access\n- awa\\_agent\n\n |
| \n\nSecurity Incident Basic\\[sn\\_si.basic\\]\n\n | \n\nUnderlying role for basic Security access. Users with this role can create and update security incidents, requests, and tasks, as well as problems, changes, and outages related to their incidents.\n\n | \n\n- canvas\\_user\n- document\\_management\\_user\n- email\\_composer\n- flow\\_operator\n- inventory\\_user\n- pa\\_viewer\n- service\\_fullfiller\n- skill\\_user\n- sn\\_sec\\_cmn.write\n- sn\\_si.read\n- sn\\_ti.observable.read\n- sn\\_ti.observable.write\n- sn\\_ti.read\n- task\\_activity\\_writer\n- task\\_editor\n- treemap\\_user\n\n |
| \n\nChief Information Security Officer \\(CISO\\)\\[sn\\_si.ciso\\]\n\n | \n\nView and manipulate the CISO dashboard. Also, if the Vulnerability Response plugin is activated, users with this role can add vulnerability significance definition treemaps to the dashboard. You can also do the same with Security Incident Response plugin.\n\n | \n\n- pa\\_viewer\n- sn\\_si.basic\n- sn\\_si.read\n\n |
| \n\nSecurity Incident External\\[sn\\_si.external\\]\n\n | \n\nView any security incidents that belong to their particular group.**Note:** The following two rules are applicable throughout ServiceNow irrespective of scoped admin or scope app.\n\n- When you add any user to a group, you are also assigning roles to that group. Similarly, when you remove a user from a group, the inherited roles will also get removed.\n- Every role is assignable by some higher precedence role.\n\n | \n\nservice\\_fulfiller\n\n |
| \n\nSecurity Incident Integration User\\[sn\\_si.integration\\_user\\]\n\n | \n\nExternal tools can provide new security incident records and update security incident records.\n\n | \n\nimport\\_transformer\n\n |
| \n\nSecurity Incident Knowledge Administrator\\[sn\\_si.knowledge\\_admin\\]\n\n | \n\nManage, update, and delete the information in the Security Incident knowledge base.\n\n | \n\n- knowledge\\_admin\n- sn\\_si.read\n\n |
| \n\nSecurity Incident Manager\\[sn\\_si.manager\\]\n\n | \n\nSame access as security analysts.\n\n | \n\n- pd\\_author\n- pd\\_operator\n- sn\\_si.basic\n\n |
| \n\nSecurity Incident Read\\[sn\\_si.read\\]\n\n | \n\nRead security incidents.\n\n | \n\n- canvas\\_user\n- sn\\_sec\\_cmn.read\n- sn\\_templated\\_snip.template\\_snippet\\_reader\n- sn\\_ti.observable.read\n- workspace\\_user\n\n |
| \n\nSecurity Restriction Access Manager \\[sn\\_si.restriction\\_access\\_manager\\]\n\n | \n\nAllows users or groups to 'enforce restriction' on security incidents. This is applicable only for field change.\n\n | \n\nN/A\n\n |
| \n\nSecurity Incident Special Accesssn\\_si.special\\_access\n\n | \n\nProvides access to specific security incidents to users outside of the Security Operations organization.\n\n | \n\nN/A\n\n |
| \n\nSecurity Special Access Enabler \\[sn\\_si.special\\_access\\_enabler\\]\n\n | \n\nProvides special access role to a user outside of the Security Operations organization to specific security incidents.\n\n | \n\nN/A\n\n |
| \n\nSecurity Incident Special Access Read Manager \\[sn\\_si.special\\_access\\_read\\_manager\\]\n\n | \n\nManage the Security Incident Special Access \\[sn\\_si.special\\_access\\] role. Use this role to modify the **Read access** field in the security incident form. This role is assignable by sn\\_si.admin.\n\n | \n\nsn\\_si.special\\_access\\_enabler\n\n |
| \n\nSecurity Incident Special Access Writer Manager \\[sn\\_si.special\\_access\\_write\\_manager\\]\n\n | \n\nManage the Security Incident Special Access \\[sn\\_si.special\\_access\\] role. Use this role to modify the **Privileged access** field in the security incident form. This role is assignable by sn\\_si.admin.\n\n | \n\nsn\\_si.special\\_access\\_enabler\n\n |
| \n\nSecops Setup Assistant Administrator\\[sn\\_secops\\_setup.admin\\]\n\n | \n\nFull control over Setup Assistant configuration. This role is required to access the Setup Assistant UI and related REST endpoints.\n\n | \n\nN/A\n\n |
| \n\nTable\n\n | \n\nDescription\n\n |
|---|---|
| \n\nNews Feed Configuration\\[sn\\_si\\_feed\\_configuration\\]\n\n | \n\nConfiguration records used to define the content displayed in the security incident news feed.\n\n |
| \n\nPost Incident Review Assignment Rule\\[sn\\_si\\_pir\\_condition\\]\n\n | \n\nAutomates selection of participants of a post incident review survey when a security incident is closed.\n\n |
| \n\nSecurity Incident\\[sn\\_si\\_incident\\]\n\n | \n\nStores a security incident, the responses to the incident, all linked tasks, changes, problems, and incidents related to this security incident.\n\n |
| \n\nSecurity Incident Attack Vectors\\[sn\\_si\\_attack\\_vector\\]\n\n | \n\nAttack vector options.\n\n |
| \n\nSecurity Incident Audit Log\\[sn\\_si\\_audit\\_log\\]\n\n | \n\nStores security incident enrichment audit logs.\n\n |
| \n\nSecurity Incident Calculator\\[sn\\_si\\_calculator\\]\n\n | \n\nA calculator to set certain security incident fields when certain conditions are met.\n\n |
| \n\nSecurity Incident Calculator Group\\[sn\\_si\\_calculator\\_group\\]\n\n | \n\nA grouping of security incident calculators. The order of the calculator group determines which group is evaluated first, and in each group, one calculator at most is used.\n\n |
| \n\nSecurity Incident Enrichment Firewall\\[sn\\_si\\_enrichment\\_firewall\\]\n\n | \n\nExtends from the base table \\(sn\\_sec\\_cmn\\_enrichment\\_data\\_base\\) and includes all enrichment records specific to Palo Alto Networks Firewall.\n\n |
| \n\nSecurity Incident Enrichment Malware Results\\[sn\\_si\\_enrichment\\_malware\\]\n\n | \n\nExtends from the base table \\(sn\\_sec\\_cmn\\_enrichment\\_data\\_base\\) and includes all enrichment records specific to malware.\n\n |
| \n\nSecurity Incident Enrichment Network Statistics\\[sn\\_si\\_enrichment\\_network\\_statistics\\]\n\n | \n\nExtends from the base table \\(sn\\_sec\\_cmn\\_enrichment\\_data\\_base\\) and includes all enrichment records specific to network statistics.\n\n |
| \n\nSecurity Incident Enrichment Running Processes\\[sn\\_si\\_enrichment\\_running \\_processes\\]\n\n | \n\nExtends from the base table \\(sn\\_sec\\_cmn\\_enrichment\\_data\\_base\\) and includes all enrichment records specific to running processes.\n\n |
| \n\nSecurity Incident Enrichment Running Services\\[sn\\_si\\_enrichment\\_running\\_service\\]\n\n | \n\nExtends from the base table \\(sn\\_sec\\_cmn\\_enrichment\\_data\\_base\\) and includes all enrichment records specific to running services.\n\n |
| \n\nSecurity Incident Email Search\\[sn\\_si\\_m2m\\_incident\\_email\\_search\\]\n\n | \n\nMaps email search records to security incidents.\n\n |
| \n\nSecurity Incident Import\\[sn\\_si\\_incident\\_import\\]\n\n | \n\nImport table for security incidents. Used to create security incidents from external systems.\n\n |
| \n\nSecurity Incident Process Definition\\[sn\\_si\\_process\\_definition\\]\n\n | \n\nStores configuration for Security Incident process flows.\n\n |
| \n\nSecurity Incident Process Definition Selector\\[sn\\_si\\_process\\_definition\\_selector\\]\n\n | \n\nStores the Security Incident Process Definition to use for security incidents.\n\n |
| \n\nSecurity Incident Related Customer Service Case\\[sn\\_si\\_m2m\\_incident\\_customerservice\\_case\\]\n\n | \n\nMaps customer service cases and security incidents\n\n |
| \n\nSecurity Incident Related Enrichment Data\\[sn\\_si\\_m2m\\_incident\\_enrichment\\]\n\n | \n\nMaps security incidents and related enrichment data records.\n\n |
| \n\nSecurity Incident Response Task\\[sn\\_si\\_task\\]\n\n | \n\nManages subtasks related to handling a security incident. These tasks can be assigned to security personnel, or to people in other departments, to manage interdepartmental communication and task tracking.\n\n |
| \n\nSecurity Incident Response Task Template\\[sn\\_si\\_task\\_template\\]\n\n | \n\nUsed to create a Security Incident Response task. These templates are often used in catalog entries, to automatically create a set of appropriate subtasks for a particular type of security incident.\n\n |
| \n\nSecurity Incident Runbook Document\\[sn\\_si\\_runbook\\_document\\]\n\n | \n\nAssociates security incident conditions or filters with a knowledge article. Used to specify runbook procedures for security incident remediation.\n\n |
| \n\nSecurity Incident Template\\[sn\\_si\\_incident\\_template\\]\n\n | \n\nUsed to create a security incident. These templates are often used in catalog entries to create a prebuilt security incident.\n\n |
| \n\nSecurity Request\\[sn\\_si\\_request\\]\n\n | \n\nA security-related request to the security team.\n\n |
| \n\nSecurity Scan Request\\[sn\\_si\\_scan\\_request\\]\n\n | \n\nA request for a threat lookup.\n\n |
| \n\nSeverity Calculatorsn\\_si\\_severity\\_calculator\n\n | \n\nDefines the severity, impact, risk, and criticality values for a security incident.\n\n |
| \n\nTask Affected User\\[sn\\_si\\_m2m\\_task\\_affected\\_user\\]\n\n | \n\nA many-to-many table associating security incidents with affected users.\n\n |
| \n\nTemplate Workflow Activity Outcome Evaluator \\[sn\\_si\\_wf\\_activity\\_outcome\\_evaluator\\]\n\n | \n\nMaps a capability with an evaluation script. A new subflow can be added to a template workflow to set a response task outcome rather than having an analyst manually set it.\n\n |
| \n\nSetup Status\\[sn\\_secops\\_setup\\_status\\]\n\n | \n\nTracks the completion state of each Setup Assistant step. The key and complete fields are enforced as strict read-only.\n\n |