ServiceNow SecOps

Create Integration User

Create a ServiceNow user with appropriate roles for security incident creation.

                # Create ServiceNow integration user:
# 1. Navigate to User Administration → Users
# 2. Create new user "dbaudit_integration"
# 3. Assign roles:
#    - sn_si.write (Security Incident write)
#    - itil (for incident management)
#    - cmdb_read (for CI lookup)
# 4. Set a strong password

# Or use OAuth for authentication:
# 1. Navigate to Application Registry
# 2. Create new OAuth API endpoint
# 3. Note the Client ID and Client Secret
# 4. Generate refresh token

# Required permissions:
# - Create Security Incidents
# - Read Configuration Items
# - Read Assignment Groups
              

Configure CMDB (Optional)

Set up Configuration Items for your databases in the CMDB.

                # Set up CMDB Configuration Items for databases:
# Navigate to Configuration → Servers → Database Servers

# Create CI for each monitored database:
{
  "name": "production-postgres",
  "dns_domain": "db.example.com",
  "ip_address": "10.0.1.100",
  "category": "Database Server",
  "subcategory": "PostgreSQL",
  "environment": "Production",
  "support_group": "Database Team",
  "u_db_audit_enabled": true
}

# Store the sys_id for each CI:
# Example: 8a5055c91b5b89100116f5c1b24bcb12

# Map databases to CIs in DB Audit configuration
              

Test API Connection

Verify the integration user can create security incidents.

                # Test ServiceNow API connection
curl -X GET "https://your-instance.service-now.com/api/now/table/sys_user?sysparm_limit=1" \
    -u "username:password" \
    -H "Accept: application/json"

# Test incident creation
curl -X POST "https://your-instance.service-now.com/api/now/table/sn_si_incident" \
    -u "username:password" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json" \
    -d '{
      "short_description": "Test incident from DB Audit",
      "description": "Test incident to verify integration",
      "category": "Database Security",
      "priority": "4"
    }'

# Expected response:
{
  "result": {
    "sys_id": "abc123...",
    "number": "SIN0010001",
    ...
  }
}
              

Configure in DB Audit

Add the ServiceNow SecOps integration in the DB Audit dashboard.

1. Navigate to Integrations → SIEM in DB Audit
2. Click Add SIEM Integration
3. Select ServiceNow SecOps as the provider
4. Enter your instance URL and credentials
5. Configure assignment group and CMDB CI mappings
6. Select event types to forward
7. Test the connection and save

Create Workflows (Optional)

Create Flow Designer workflows for automated incident handling.

                // ServiceNow Flow Designer - DB Audit Alert Workflow
// Flow Designer → New Flow

Flow Name: DB Audit Security Alert Processing

Trigger: Record Created
Table: Security Incident [sn_si_incident]
Condition: source = "DB Audit"

Actions:

1. Look Up CI
   - Table: Configuration Items
   - Query: name = trigger.u_database

2. If CI Found:
   - Update incident.cmdb_ci = CI.sys_id
   - Update incident.assignment_group = CI.support_group

3. If Priority = 1 (Critical):
   - Create Event
   - Send Notification to SOC team
   - Create PagerDuty incident

4. If Contains PII:
   - Add Work Note: "PII data access detected"
   - Notify Privacy team

5. Log Subflow Completion