Using ServiceNow Security Operations Integration add-on

Create security events and incidents directly from Splunk alerts after setting up ServiceNow Security Operations Integration add-on.

Before you begin

Role required: sn_si.integration_user, sn_si.analyst

Procedure

1. Log in to Splunk Enterprise.

2. Navigate to Apps > Search & Reporting.

3. Enter a keyword in the New Search field.

   A list of events with the keyword show up.

4. Expand any of the events using (>) icon.

5. Select Event Actions.

   • Create ServiceNow Security Event: Events are stored in the em_event table.

     Note:

     Install Event Management plugin to access the em_event table.

   • Create ServiceNow Security Incident: Incidents are stored in the sn_si_incident table.

     Note: The mapping is pre defined as we don't have a profile for this add-on.