ServiceNow Threat Intelligence Plugin for Threat Exchange

This document explains how to configure the ServiceNow Threat Intelligence v2.0.0 plugin with the Threat Exchange module of the Netskope Cloud Exchange platform. This plugin is used to pull indicators of type MD5, SHA256, URL, IPv4, IPv6, Domain, and FQDN from the ServiceNow Threat Intelligence Observables (sn_ti_observable) table, and shares indicators of the same types back to the Observables table. The plugin supports pull retraction and push retraction of indicators. This plugin requires a ServiceNow account with access to the Threat Intelligence Observables table.

Prerequisites

To complete this configuration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Threat Exchange plugin already configured.
• A File Profile on your Netskope tenant.
• A URL List on your Netskope tenant.
• A Destination Profile on your Netskope tenant.
• A Private App on your Netskope tenant.
• A DNS Profile on your Netskope Tenant.
• A ServiceNow instance with an account that has read, create, and delete access to the Threat Intelligence Observables table.
• Connectivity to the following host: https://<instance>.service-now.com

ServiceNow Threat Intelligence Plugin Support

This plugin is used to pull indicators of type MD5, SHA256, URL, IPv4, IPv6, Domain, and FQDN from the ServiceNow Threat Intelligence Observables (sn_ti_observable) table, and shares indicators of the same types back to the Observables table. The plugin supports pull retraction and push retraction of indicators. This plugin requires a ServiceNow account with access to the Threat Intelligence Observables table.

IoC Retraction

The plugin supports both pull retraction (time-based, configurable via “Retraction Interval (in days)”) and push retraction (controlled by the “Enable Push Retraction” configuration toggle).

IoC Source Labeling

Each observable pushed to ServiceNow by this plugin has its notes field prefixed with the label Shared by Netskope Cloud Exchange | <plugin config name> to identify its origin and prevent a push–pull–push loop.

Mappings

Pull Indicators Mappings

Push Indicators Mappings

Permissions

Here is the role that should be assigned to the User used in the plugin:

sn_ti.observable.admin

{
  "result": [
    {
      "value": "malware.veboz37.live",
      "type.value": "FQDN",
      "sys_id": "000014a2ab00001101f9f8d5f7fe0a1c",
      "sys_created_on": "2026-03-25 22:31:19",
      "sys_updated_on": "2026-03-25 22:34:31",
      "notes": "This attribute is observed in a threat feed.",
      "finding": "Malicious"
    }
  ]
}

{
  "value": "malware.veboz37.live",
  "notes": "Shared by Netskope Cloud Exchange | <plugin config name> | <comments>"
}

{
  "result": {
    "sys_id": "000014a2ab00001101f9f8d5f7fe0a1c",
    "value": "malware.veboz37.live"
  }
}

{}

Performance Matrix

This reading is conducted on a Large CE Stack with these specifications by pulling and pushing 100k IoCs.

User Agent

netskope-ce-6.1.0-cte-servicenow-threat-intelligence-v2.0.0

Workflow

1. Get ServiceNow Credentials
2. Configure Netskope Tenant
3. Configure Netskope Threat Exchange Plugin
4. Configure ServiceNow Threat Intelligence Plugin
5. Add a Business Rule
6. Configure Sharing
7. Validate on Netskope CE
8. Validate on ServiceNow

Watch a Video

Click play to watch a video.

Get the ServiceNow User ID and Password

1. Log in to your ServiceNow Instance with admin access.

2. Go to System Security > Users and Groups > Users.

3. Click New.

   

4. Enter the required information and make note of the User ID and Password. Click Submit.

   

5. On the Roles tab, click Edit.

6. Add the sn_ti.observable.admin role and click Save.

   

Configure the ServiceNow Threat Intelligence Plugin

1. In Cloud Exchange, go to Settings > Plugin Store. Search for and select the ServiceNow Threat Intelligence v2.0.0 (CTE) plugin.

   

2. Enter the Basic Information:

   • Configuration Name: Plugin configuration name.
   • Sync Interval: Interval to fetch data from this plugin and share data to this plugin from other sources.
   • Aging Criteria: Expire indicators after specific time.
   • Override Reputation: Set value to override reputation of indicators received from this configuration. Leave empty to keep default.
   • Tags Aggregate Strategy: Choose whether to append new tags to existing IoC(s) or overwrite them. This configuration parameter determines how tags are stored for indicators pulled for this configuration.
   • Enable SSL Validation: Enable SSL certificate verification.

   

3. Click Next and enter the Configuration Parameters:

   • ServiceNow Instance URL: ServiceNow instance URL. For example: https://<instance>.service-now.com.
   • Username: ServiceNow username with access to the Threat Intelligence Observables table.
   • Password: Password for the ServiceNow username.
   • Type of Threat Data to Pull: Indicator types to pull. If left blank, all supported indicator types are retrieved.
   • Type of Finding to Pull: ServiceNow finding statuses to pull. If left blank, findings with all statuses are retrieved.
   • Enable Polling: Enable/disable pulling indicators from ServiceNow. Disable if only pushing indicators to ServiceNow.
   • Enable Push Retraction: Enable/disable push retraction. When enabled, indicators previously pushed to ServiceNow are permanently deleted from the sn_ti_observable table when retracted in CE.
   • Retraction Interval (in days): Number of days used as the retraction window for pull retraction. Applies only when IOC(s) Retraction is enabled in Threat Exchange Settings. Valid range: 1–100000 days.
   • Initial Range (in days): Number of days to pull data for on the initial run. Valid range: 1–365 days.

   

   The Enable Push Retraction setting permanently deletes observables from ServiceNow when indicators are retracted in Cloud Exchange. Enable this only if you want pushed indicators to be removed from the ServiceNow sn_ti_observable table upon retraction.

4. Click Save. The plugin appears on the Plugins page.

   

Configure a Threat Exchange Business Rule for ServiceNow Threat Intelligence

To share indicators fetched from the ServiceNow Threat Intelligence to Cloud Exchange, you will need to have a business rule that will filter out the indicators that you want to share. To configure a business rule:

1. In Threat Exchange, go to Business Rules and click Create New Rule.

   

2. Add the filter according to your requirement in the rule, and then click Save.

   

Configure Sharing for ServiceNow Threat Intelligence

To share IoCs from the ServiceNow Threat Intelligence to Cloud Exchange:

1. In Threat Exchange, go to Sharing and click Add Sharing Configuration.

   

2. Select your Source Configuration (CTE Netskope Threat Exchange), Business Rule, Destination Configuration (ServiceNow Threat Intelligence), and Target.

   

3. Click Save.

   

Enabling IOC Retraction

Pull Retraction

To enable pull retraction for the ServiceNow Threat Intelligence plugin:

1. Set the Retraction Interval (in days) parameter in the plugin configuration.
2. Enable IoC(s) Retraction in Threat Exchange > Settings in Cloud Exchange.

Push Retraction

To enable pull retraction for the ServiceNow Threat Intelligence plugin, select Yes in Enable Push Retraction configuration parameter. When enabled, indicators previously pushed to ServiceNow are permanently deleted from the sn_ti_observable table when retracted in Cloud Exchange.

Validate the ServiceNow Threat Intelligence Plugin

Validate the Pull

Indicators from ServiceNow are pulled from Observables table

In your ServiceNow Console, go to Threat Intelligence > Observables.

You can also verify the indicators pulled in Cloud Exchange from the logs available in Logging.

Pulled data will be listed on the Threat IoCs page. You can filter the IoCs pulled from the platform using the filter: sources.source Like “<plugin configuration name>”.

For verifying the Retracted IoCs from ServiceNow, check the logs for IoC Retraction. For example: message Like “[Retraction]:” 

To validate the retracted IoCs on the Threat IoCs page, apply the filter: Retracted Is equal Yes, along with the source filter for the plugin configuration name.

Validate the Push

Shared IoCs to ServiceNow can be verified from logs available at Logging. 

Log in to ServiceNow and go to Threat Intelligence > Observables to verify the shared indicators appear in the sn_ti_observable table.

The IoC Labeling is added to each of the IoCs’ notes that are shared/pushed to ServiceNow from Cloud Exchange, and the format for the same will be Shared by Netskope Cloud Exchange | <plugin-name>.

When Enable Push Retraction is set to Yes in the plugin configuration, indicators pushed to ServiceNow are permanently deleted from the sn_ti_observable table when retracted in Cloud Exchange.

Go to Logging and search for the Retracted keyword to verify the deletion of indicators on ServiceNow.

Log in to ServiceNow and go to Threat Intelligence > Observables to confirm the observable has been removed from the sn_ti_observable table.

The Netskope Threat Exchange plugin supports push retraction, so the IoCs pulled from ServiceNow plugin and marked as retracted will be deleted from the Netskope Tenant, and this result can be verified from the retraction result field. Here the retraction result is CTE Netskope Threat Exchange: retracted, which means this IoC is deleted from the Netskope Tenant.

This is the Destination profile where the IoCs pulled from ServiceNow were shared.

As the IoCs pulled from ServiceNow was marked as retracted = Yes, and it was already shared to the destination profile on the Netskope tenant, it will get deleted from that destination profile and the status for it can be verified from retraction result. In this case, the retraction result is CTE Netskope Threat Exchange: retracted, which means it was deleted from the destination profile.

Here you can see the retracted IoCs were deleted from this destination profile.

Troubleshooting the ServiceNow Threat Intelligence Plugin

Plugin Fails to Validate Configuration

If the plugin fails during configuration validation, it could be due to one of these reasons:

• The ServiceNow Instance URL is incorrect or malformed.
• The configured username or password is incorrect.
• The configured account does not have access to the sn_ti_observable table.

What to do:

1. Verify the ServiceNow Instance URL includes the correct scheme and hostname (for example, https://<instance>.service-now.com).
2. Confirm the username and password are correct by logging in to ServiceNow directly.
3. Ensure the ServiceNow account has read, create, and delete access to the Threat Intelligence Observables (sn_ti_observable) table. Contact your ServiceNow administrator to verify the permissions.

Unable to pull IoCs from ServiceNow

If you are not able to pull IoCs from ServiceNow then this may be due to no IoCs present on the ServiceNow platform under the same interval used as the initial range in the plugin configuration.

What to do: Make sure the IoCs are present on the ServiceNow platform and the credentials used in the plugin configuration are correct. Refer to the Validate the Pull section.

Not able to enable the plugin after upgrade

If you are not able to enable the plugin after upgrade and clicked Skip, it might be due to new parameters not set in the configuration.

What to do:

Edit the configuration and set all the parameters again, and then enable the plugin.