Plugin ServiceNow pour Ticket Orchestrator - Documentation technique Netskope

Ce document explique comment configurer votre plugin ServiceNow v2.2.0 avec le module Ticket Orchestrator de la plateforme Netskope Cloud Exchange. Ce plugin est utilisé pour créer des incidents sur la page Incident > All, des incidents de sécurité sur la page Incident de sécurité > Incidents > Show All Incidents, des problèmes GRC sur la page Politique et conformité > Problèmes > Tous les problèmes et des enregistrements sur la page Custom Table record de la plateforme ServiceNow. Il permet également de mettre à jour les incidents/problèmes et de synchroniser leur statut. Ce plugin n'est PAS identique au produit DLP (Prévention des pertes de données) Incident Response de ServiceNow, et ce plugin ne fonctionne pas avec cette solution.

Conditions préalables

Pour compléter cette configuration, vous avez besoin de :

Un locataire Netskope (ou plusieurs, par exemple des instances de production et de développement/test).
Un locataire Netskope Cloud Exchange avec le plugin Tenant et le plugin Ticket Orchestrator déjà configurés.
Un compte ServiceNow.
Les permissions nécessaires pour le plugin sont itil ou sn_incident_write, sn_incident_read, personalize_dictionary, sn_si.admin, sn_grc.business_user, et admin.
Connectivité avec l'hôte suivant : https://<instance>.service-now.com/
Pour la création d'une question GRC, le plugin GRC : Policy and Compliance Management (App id : sn_compliance) doit être installé sur votre Instance ServiceNow.

Support du plugin ServiceNow

Ce plugin est utilisé pour créer des incidents sur les enregistrements Incident, Incident de sécurité, Problèmes GRC et Table personnalisée sur ServiceNow.

Types d'alerte pris en charge pour les tickets	Types d'événements pris en charge pour les billets
Compromised Credentials, policy, malsite, Malware, DLP (Prévention des pertes de données), Security Assessment, watchlist, quarantine, Remediation, UBA, CTEP, périphérique, Content	Point final, incident

Mises en correspondance

Mises en file d'attente

Champs cibles	Values
Brève description	Nom de l'alerte Netskope $appCategory : $alertName Nom de l'événement : $alert_name
Description	Alerte/identification de l'événement : $id Alerte/événement App : $appAlert/Event User : $userAlert Name : $alertNameAlert Type : Type d'alerte : $alertTypeAlert Catégorie de l'application : $appCategoryNom de l'événement : Nom de l'alerte Type d'alerte Type d'événement : $eventType

Default Status Mappings

Ce mappage est utilisé pour mapper le statut Netskope CE au statut ServiceNow. Vous pouvez trouver le statut ServiceNow disponible en allant dans Définitions du système > Tables> [Nom de la table] > [Nom de la colonne du statut] > Choix.

Statut de Cloud Exchange	Value	Statut ServiceNow
Nouveau	1	Nouveau
En cours	2	En cours
En attente	3	En attente
Closed	7	Closed
Deleted	–	(Le champ par défaut sera vide) Vous pouvez créer des champs personnalisés sur ServiceNow pour les mapper.
Autres	–	(Default will be blank)

Default Severity Mappings

Ce mappage est utilisé pour faire correspondre la gravité de Netskope CE à la gravité de ServiceNow. Vous pouvez trouver les valeurs de sévérité ServiceNow disponibles en allant dans Définitions du système > Tables > [Nom de la table] > [Nom de la colonne de sévérité] > Choix.

Gravité de Cloud Exchange	Value	ServiceNow Severity
Critique	–	(Default will be blank) Vous pouvez créer des champs personnalisés sur ServiceNow pour les mapper.
Haut	1	Haut
Moyen	2	Moyen
Faible	3	Faible
Information	–	(Default will be blank) Vous pouvez créer des champs personnalisés sur ServiceNow pour les mapper.
Autres	–	(Default will be blank)

Note

L'état par défaut et la correspondance de gravité dans le plugin ServiceNow peuvent varier, car ces champs peuvent être personnalisés dans la plateforme. Tout statut ou gravité qui n'est pas mis en correspondance avec les champs correspondants de Netskope CE sera marqué comme autre.

Champs pris en charge dans une file d'attente Configuration des tables par défaut

Voici la liste des champs pris en charge dans la Configuration de la file d'attente pour les tables par défaut que vous pouvez mapper lors de la création de l'incident sur ServiceNow.

Incident de sécurité

Nom du champ	Type de champ
Malware hash	String
MITRE ATT&CK Procedure (Malware)	String
Dernière mise à jour de la source	Choice
Number	String
Platforms(MITRE)	String
Incident de sécurité chez les parents	Reference
Utilisateur concerné	Reference
Règle d'alerte	String
New répondants	Glide_list
Apprentissage automatique Prédiction	String
IP de destination	String
Problem	Reference
Service	Reference
Nombre effectif	String
Offre de services	Reference
Rejet goto	Reference
Malware URL	String
Affecté à	Reference
Escalation	Integer
Temps de travail	Timer
Liste de cessionnaires supplémentaires	Glide_list
ID de corrélation	String
MITRE ATT&CK Tactic	String
Phish Email	Reference
Variables	Variables
Capteur d’alerte	Reference
Commentaires supplémentaires	Journal_input
Urgency	Integer
Opened	Glide_date_time
Liste de surveillance	Glide_list
SLA due	Due_date
Contract	Reference
Actif	Boolean
État	Integer
Notes de travail	Journal_input
Clôturé par	Reference
Suivi	Glide_date_time
Élément de configuration	Reference
Historique des approbations	Journal
Durée de l’activité	Glide_duration
Location	Reference
Entrée de l'utilisateur	User_input
Source IP	String
Demande de modification	Reference
Risk	Integer
Activité de flux de travail	Reference
Changement de risque	String
MITRE ATT&CK Data Source	String
Liste de notes de travail	Glide_list
Skills	Glide_list
Vecteur d'attaque	Glide_list
MITRE ATT&CK Technique	String
Groupes autorisés	Glide_list
Activité d’automatisation	Journal
Impact sur les entreprises	Integer
Code de fermeture	String
Accès en lecture	Glide_list
Accès privilégié	Glide_list
score de risque	Integer
Étiquettes de sécurité	Glide_list
Sévérité	Integer
incident de sécurité auto	Reference
Incident	Reference
Commentaires et notes de travail	Journal_list
MITRE ATT&CK Adversary Group	String
Description	String
Impact	Integer
Closed	Glide_date_time
Liste des groupes	Glide_list
Activity due	Due_date
MITRE ATT&CK Procedure (Tool)	String
Évaluations sur demande	Glide_list
Membres autorisés	Glide_list
Parent	Reference
Priorité	Integer
Notes de clôture	String
Nombre de réaffectations	Integer
Due date	Glide_date_time
Order	Integer
Brève description	String
Company	Reference
Ensemble d’approbation	Glide_date_time
Ouvert par	Reference
Type de contact	String
SLA réalisé	Boolean
Après le rapport d’incident	Html
Groupe d’affectation	Reference
Approval	String
Duration	Glide_duration
Knowledge	Boolean
Affichage de corrélation	String
Autres IoC	String
URL du référent	String
Score de confiance	Decimal
Department	Glide_list
Vulnerability	Reference
tâche de livraison	Reference
Actual end	Glide_date_time
Demande universelle	Reference
Début prévu	Glide_date_time
Actual start	Glide_date_time
Après approbation	String
Raison du transfert	Integer
Faire respecter la restriction	Boolean
URL externe	Url
Plan de livraison	Reference
Après rejet	String
Score de risque de dépassement	Boolean

Incident

Nom du champ	Type de champ
Impact sur les entreprises	String
Cause probable	String
Rouvrir le compte	Integer
Number	String
Incident parental	Reference
Service	Reference
Demande de modification	Reference
Nombre effectif	String
Offre de services	Reference
État de l'incident	Integer
Délai de résolution	Integer
Rejet goto	Reference
Tableau d'origine	Table_name
Résolu par	Reference
Chronique d'un incident	Reference
Affecté à	Reference
Escalation	Integer
Temps de travail	Timer
Liste de cessionnaires supplémentaires	Glide_list
ID de corrélation	String
Variables	Variables
Incidents liés à l’enfance	Integer
Commentaires supplémentaires	Journal_input
Urgency	Integer
Opened	Glide_date_time
Liste de surveillance	Glide_list
SLA due	Due_date
Contract	Reference
Actif	Boolean
État	Integer
Notes de travail	Journal_input
Clôturé par	Reference
Suivi	Glide_date_time
Élément de configuration	Reference
Historique des approbations	Journal
Durée de l’activité	Glide_duration
Location	Reference
Entrée de l'utilisateur	User_input
Catégorie	String
délai de résolution des affaires	Integer
Origin	Document_id
Activité de flux de travail	Reference
Causé par le changement	Reference
Liste de notes de travail	Glide_list
Code de fermeture	String
Skills	Glide_list
Resolved	Glide_date_time
URL Splunk	Url
Dernière réouverture à	Glide_date_time
Problem	Reference
Caller	Reference
Subcategory	String
Commentaires et notes de travail	Journal_list
Description	String
Impact	Integer
Closed	Glide_date_time
Liste des groupes	Glide_list
Activity due	Due_date
Parent	Reference
Priorité	Integer
Notes de clôture	String
Nombre de réaffectations	Integer
Due date	Glide_date_time
Order	Integer
Brève description	String
Company	Reference
Ensemble d’approbation	Glide_date_time
Ouvert par	Reference
Type de contact	String
SLA réalisé	Boolean
En attente pour raison	Integer
Groupe d’affectation	Reference
Approval	String
Duration	Glide_duration
Knowledge	Boolean
Affichage de corrélation	String
tâche de livraison	Reference
Actual end	Glide_date_time
Demande universelle	Reference
Début prévu	Glide_date_time
Notify	Integer
Actual start	Glide_date_time
Après approbation	String
Sévérité	Integer
Raison du transfert	Integer
Plan de livraison	Reference
Après rejet	String
Dernière réouverture par	Reference

Questions relatives au CRG

Nom du champ	Type de champ
Le groupe de reparentage est-il	Boolean
Document d'autorité	Reference
Objet	Reference
Responsable du dossier	Reference
Notation de l'enjeu	Reference
Méthode de gestion	String
Document	Reference
Explanation	String
Recommendation	String
Plan d'action	Html
Substate	String
Question des parents	Reference
Objectif de contrôle / Déclaration de risque	Reference
Entity	Reference
Domaine fonctionnel	Glide_list
Statut de la hiérarchie des utilisateurs	String
Le groupe est-il	Boolean
Règle du groupe de questions	Reference
Groupe de gestionnaires d'enjeux	Reference
Classification	String
Groupes autorisés	Glide_list
Source du numéro	Glide_list
Hiérarchie des utilisateurs 2	Reference
Hiérarchie utilisateur 1	Reference
Politique	Reference
Confidential	Boolean
Response	Integer
Date confirmée	Glide_date_time
Issue type	String
Utilisateurs autorisés	Glide_list
Créé manuellement	Boolean
Niveau de groupe	String
Actual end	Glide_date_time
Company	Reference
Number	String
Impact	Integer
Brève description	String
Ensemble d’approbation	Glide_date_time
Description	String
Closed	Glide_date_time
Ouvert par	Reference
SLA réalisé	Boolean
Liste des groupes	Glide_list
Type de contact	String
Activity due	Due_date
Activité de flux de travail	Reference
Rejet goto	Reference
Après rejet	String
Contract	Reference
Escalation	Integer
Nombre effectif	String
Actif	Boolean
Notes de travail	Journal_input
Affecté à	Reference
Temps de travail	Timer
Service aux entreprises	Reference
État	Integer
Liste de cessionnaires supplémentaires	Glide_list
Suivi	Glide_date_time
ID de corrélation	String
Liste de notes de travail	Glide_list
Demande universelle	Reference
Clôturé par	Reference
Plan de livraison	Reference
Après approbation	String
Parent	Reference
Notes de clôture	String
Groupe d’affectation	Reference
Duration	Glide_duration
Priorité	Integer
Approval	String
Due date	Glide_date_time
Affichage de corrélation	String
Nombre de réaffectations	Integer
Order	Integer
Knowledge	Boolean
Offre de services	Reference
tâche de livraison	Reference
Élément de configuration	Reference
Commentaires et notes de travail	Journal_list
Urgency	Integer
Historique des approbations	Journal
Commentaires supplémentaires	Journal_input
Opened	Glide_date_time
Durée de l’activité	Glide_duration
Entrée de l'utilisateur	User_input
Variables	Variables
Liste de surveillance	Glide_list
Location	Reference
SLA due	Due_date
Actual start	Glide_date_time
Début prévu	Glide_date_time
Raison du transfert	Integer
Skills	Glide_list

Permissions

Permission d'envoyer des données à l'URL du flux de travail.
- Rôles requis lorsque l'option Incidents est configurée dans le paramètre Table de destination :
  - itil or sn_incident_write, sn_incident_read
  - personalize_dictionary
- Rôle requis lorsque l'option Incidents de sécurité est configurée dans le paramètre Table de destination :
  - sn_si.admin
- Rôles requis lorsque GRC Issues est configuré dans le paramètre Table de destination :
  - sn_grc.business_user (Les utilisateurs ne peuvent consulter que les issues qu’ils ont elles-mêmes créées ou qui leur ont été assignées)
  - admin (Cette autorisation est nécessaire pour consulter tous les problèmes GRC, quel que soit le créateur ou le destinataire)
- Rôle requis lorsque la table personnalisée est configurée dans le paramètre Table de destination :
  - admin

Détails de l'API

List of APIs used

Point final de l'API	Méthode	Cas d'utilisation
/api/now/table/sysdictionnaire	OBTENIR	Obtenir un incident ou un incident de sécurité ou un problème GRC ou des champs de table personnalisés
/api/now/table/sysGroupe d'utilisateurs	OBTENIR	Obtenir les groupes ServiceNow en tant que file d'attente
/api/now/table/<table>	PUBLIER	Créer un enregistrement d'incident, d'incident de sécurité, de problème GRC ou de tableau personnalisé
/api/now/table/<table>	OBTENIR	Obtenir l'enregistrement d'un incident ou d'un incident de sécurité ou d'un problème de GRC ou d'un tableau personnalisé
/api/now/table/<table>/<incident_id>	PATCH	Mise à jour d'un incident ou d'un incident de sécurité ou d'un problème de GRC ou d'un enregistrement de tableau personnalisé
/api/now/table/sysutilisateur	OBTENIR	Récupérer les utilisateurs assignés

Get Incident or Security Incident or GRC Issue or Custom Table Fields

API Endpoint: <Instance URL><URL d’instance >/api/now/table/sys_dictionary

Method: OBTENIR

Parameters

Clé	Value
sysparm_query	nom=<table_name>^OU nom=tâche^type_interne!=collection Pour une table personnalisée : nom=<nom_table_personnalisée><custom_table_name>
sysparm_fields	column_label,element
sysparm_limit	1000
sysparm_offset	0

Headers

Clé	Value
User-Agent	netskope-ce-6.0.0-cto-servicenow-v2.2.0
Authorization	Base <username:password>

Sample API Response (Security Incident) (Status Code: 200)


{
    "result": [
        {
            "column_label": "Malware hash",
            "element": "malware_hash"
        },
        {
            "column_label": "MITRE ATT&CK Procedure (Malware)",
            "element": "mitre_malware"
        },
        {
            "column_label": "Last Updated From Source",
            "element": "last_updated_from_src"
        },
        {
            "column_label": "Number",
            "element": "number"
        },
        {
            "column_label": "Platforms(MITRE)",
            "element": "mitre_platform"
        },
        {
            "column_label": "Parent security incident",
            "element": "parent_security_incident"
        },
        {
            "column_label": "Affected user",
            "element": "affected_user"
        },
        {
            "column_label": "Alert Rule",
            "element": "alert_rule"
        },
        {
            "column_label": "New respondents",
            "element": "new_pir_respondents"
        },
        {
            "column_label": "Machine learning Prediction",
            "element": "prediction"
        },
        {
            "column_label": "Destination IP",
            "element": "dest_ip"
        },
        {
            "column_label": "Problem",
            "element": "problem"
        },
        {
            "column_label": "Service",
            "element": "business_service"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "Effective number",
            "element": "task_effective_number"
        },
        {
            "column_label": "Service offering",
            "element": "service_offering"
        },
        {
            "column_label": "Rejection goto",
            "element": "rejection_goto"
        },
        {
            "column_label": "Malware URL",
            "element": "malware_url"
        },
        {
            "column_label": "Assigned to",
            "element": "assigned_to"
        },
        {
            "column_label": "Escalation",
            "element": "escalation"
        },
        {
            "column_label": "Time worked",
            "element": "time_worked"
        },
        {
            "column_label": "Additional assignee list",
            "element": "additional_assignee_list"
        },
        {
            "column_label": "Correlation ID",
            "element": "correlation_id"
        },
        {
            "column_label": "Updated by",
            "element": "sys_updated_by"
        },
        {
            "column_label": "MITRE ATT&CK Tactic",
            "element": "mitre_tactic"
        },
        {
            "column_label": "Phish Email",
            "element": "phish_email"
        },
        {
            "column_label": "Variables",
            "element": "variables"
        },
        {
            "column_label": "Alert Sensor",
            "element": "alert_sensor"
        },
        {
            "column_label": "Additional comments",
            "element": "comments"
        },
        {
            "column_label": "Urgency",
            "element": "urgency"
        },
        {
            "column_label": "Opened",
            "element": "opened_at"
        },
        {
            "column_label": "Watch list",
            "element": "watch_list"
        },
        {
            "column_label": "SLA due",
            "element": "sla_due"
        },
        {
            "column_label": "Contract",
            "element": "contract"
        },
        {
            "column_label": "Active",
            "element": "active"
        },
        {
            "column_label": "State",
            "element": "state"
        },
        {
            "column_label": "Work notes",
            "element": "work_notes"
        },
        {
            "column_label": "Closed by",
            "element": "closed_by"
        },
        {
            "column_label": "Follow up",
            "element": "follow_up"
        },
        {
            "column_label": "Domain",
            "element": "sys_domain"
        },
        {
            "column_label": "Updates",
            "element": "sys_mod_count"
        },
        {
            "column_label": "Configuration item",
            "element": "cmdb_ci"
        },
        {
            "column_label": "Approval history",
            "element": "approval_history"
        },
        {
            "column_label": "Business duration",
            "element": "business_duration"
        },
        {
            "column_label": "Location",
            "element": "location"
        },
        {
            "column_label": "User input",
            "element": "user_input"
        },
        {
            "column_label": "Created by",
            "element": "sys_created_by"
        },
        {
            "column_label": "Source IP",
            "element": "source_ip"
        },
        {
            "column_label": "Change request",
            "element": "change_request"
        },
        {
            "column_label": "Risk",
            "element": "risk"
        },
        {
            "column_label": "Workflow activity",
            "element": "wf_activity"
        },
        {
            "column_label": "Risk change",
            "element": "risk_change"
        },
        {
            "column_label": "MITRE ATT&CK Data Source",
            "element": "mitre_data_source"
        },
        {
            "column_label": "Work notes list",
            "element": "work_notes_list"
        },
        {
            "column_label": "Skills",
            "element": "skills"
        },
        {
            "column_label": "Attack Vector",
            "element": "attack_vector"
        },
        {
            "column_label": "MITRE ATT&CK Technique",
            "element": "mitre_technique"
        },
        {
            "column_label": "Allowed groups",
            "element": "allowed_groups"
        },
        {
            "column_label": "Automation activity",
            "element": "automation_activity"
        },
        {
            "column_label": "Business impact",
            "element": "business_criticality"
        },
        {
            "column_label": "Close code",
            "element": "close_code"
        },
        {
            "column_label": "Read access",
            "element": "special_access_read"
        },
        {
            "column_label": "Privileged access",
            "element": "special_access_write"
        },
        {
            "column_label": "Risk score",
            "element": "risk_score"
        },
        {
            "column_label": "Security tags",
            "element": "security_tags"
        },
        {
            "column_label": "Severity",
            "element": "severity"
        },
        {
            "column_label": "Security incident self",
            "element": "security_incident_self"
        },
        {
            "column_label": "Incident",
            "element": "incident"
        },
        {
            "column_label": "Comments and Work notes",
            "element": "comments_and_work_notes"
        },
        {
            "column_label": "MITRE ATT&CK Adversary Group",
            "element": "mitre_group"
        },
        {
            "column_label": "Description",
            "element": "description"
        },
        {
            "column_label": "Impact",
            "element": "impact"
        },
        {
            "column_label": "Closed",
            "element": "closed_at"
        },
        {
            "column_label": "Group list",
            "element": "group_list"
        },
        {
            "column_label": "Activity due",
            "element": "activity_due"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "MITRE ATT&CK Procedure (Tool)",
            "element": "mitre_tool"
        },
        {
            "column_label": "Request assessments",
            "element": "pir_respondents"
        },
        {
            "column_label": "Allowed members",
            "element": "allowed_members"
        },
        {
            "column_label": "Task type",
            "element": "sys_class_name"
        },
        {
            "column_label": "Parent",
            "element": "parent"
        },
        {
            "column_label": "Priority",
            "element": "priority"
        },
        {
            "column_label": "Close notes",
            "element": "close_notes"
        },
        {
            "column_label": "Reassignment count",
            "element": "reassignment_count"
        },
        {
            "column_label": "Due date",
            "element": "due_date"
        },
        {
            "column_label": "Order",
            "element": "order"
        },
        {
            "column_label": "Short description",
            "element": "short_description"
        },
        {
            "column_label": "Company",
            "element": "company"
        },
        {
            "column_label": "Approval set",
            "element": "approval_set"
        },
        {
            "column_label": "Opened by",
            "element": "opened_by"
        },
        {
            "column_label": "Contact type",
            "element": "contact_type"
        },
        {
            "column_label": "Made SLA",
            "element": "made_sla"
        },
        {
            "column_label": "Created",
            "element": "sys_created_on"
        },
        {
            "column_label": "Post incident report",
            "element": "pir"
        },
        {
            "column_label": "Assignment group",
            "element": "assignment_group"
        },
        {
            "column_label": "Approval",
            "element": "approval"
        },
        {
            "column_label": "Duration",
            "element": "calendar_duration"
        },
        {
            "column_label": "Knowledge",
            "element": "knowledge"
        },
        {
            "column_label": "Correlation display",
            "element": "correlation_display"
        },
        {
            "column_label": "Updated",
            "element": "sys_updated_on"
        },
        {
            "column_label": "Other IoC",
            "element": "other_ioc"
        },
        {
            "column_label": "Referrer URL",
            "element": "referrer_url"
        },
        {
            "column_label": "Confidence score",
            "element": "confidence_score"
        },
        {
            "column_label": "Department",
            "element": "department"
        },
        {
            "column_label": "Vulnerability",
            "element": "vulnerability"
        },
        {
            "column_label": "Delivery task",
            "element": "delivery_task"
        },
        {
            "column_label": "Actual end",
            "element": "work_end"
        },
        {
            "column_label": "Domain Path",
            "element": "sys_domain_path"
        },
        {
            "column_label": "Universal Request",
            "element": "universal_request"
        },
        {
            "column_label": "Expected start",
            "element": "expected_start"
        },
        {
            "column_label": "Actual start",
            "element": "work_start"
        },
        {
            "column_label": "Upon approval",
            "element": "upon_approval"
        },
        {
            "column_label": "Transfer reason",
            "element": "route_reason"
        },
        {
            "column_label": "Enforce restriction",
            "element": "enforce_restriction"
        },
        {
            "column_label": "External URL",
            "element": "external_url"
        },
        {
            "column_label": "Delivery plan",
            "element": "delivery_plan"
        },
        {
            "column_label": "Upon reject",
            "element": "upon_reject"
        },
        {
            "column_label": "Override risk score",
            "element": "risk_score_override"
        }
    ]
}

Sample API Response (Incident) (Status Code: 200)


{
    "result": [
        {
            "column_label": "Business impact",
            "element": "business_impact"
        },
        {
            "column_label": "Probable cause",
            "element": "cause"
        },
        {
            "column_label": "Reopen count",
            "element": "reopen_count"
        },
        {
            "column_label": "Number",
            "element": "number"
        },
        {
            "column_label": "Parent Incident",
            "element": "parent_incident"
        },
        {
            "column_label": "Service",
            "element": "business_service"
        },
        {
            "column_label": "Change Request",
            "element": "rfc"
        },
        {
            "column_label": "Effective number",
            "element": "task_effective_number"
        },
        {
            "column_label": "Service offering",
            "element": "service_offering"
        },
        {
            "column_label": "Incident state",
            "element": "incident_state"
        },
        {
            "column_label": "Resolve time",
            "element": "calendar_stc"
        },
        {
            "column_label": "Rejection goto",
            "element": "rejection_goto"
        },
        {
            "column_label": "Origin table",
            "element": "origin_table"
        },
        {
            "column_label": "Resolved by",
            "element": "resolved_by"
        },
        {
            "column_label": "Assigned to",
            "element": "assigned_to"
        },
        {
            "column_label": "Escalation",
            "element": "escalation"
        },
        {
            "column_label": "Time worked",
            "element": "time_worked"
        },
        {
            "column_label": "Additional assignee list",
            "element": "additional_assignee_list"
        },
        {
            "column_label": "Correlation ID",
            "element": "correlation_id"
        },
        {
            "column_label": "Updated by",
            "element": "sys_updated_by"
        },
        {
            "column_label": "Variables",
            "element": "variables"
        },
        {
            "column_label": "Child Incidents",
            "element": "child_incidents"
        },
        {
            "column_label": "Additional comments",
            "element": "comments"
        },
        {
            "column_label": "Urgency",
            "element": "urgency"
        },
        {
            "column_label": "Opened",
            "element": "opened_at"
        },
        {
            "column_label": "Watch list",
            "element": "watch_list"
        },
        {
            "column_label": "SLA due",
            "element": "sla_due"
        },
        {
            "column_label": "Contract",
            "element": "contract"
        },
        {
            "column_label": "Active",
            "element": "active"
        },
        {
            "column_label": "State",
            "element": "state"
        },
        {
            "column_label": "Work notes",
            "element": "work_notes"
        },
        {
            "column_label": "Closed by",
            "element": "closed_by"
        },
        {
            "column_label": "Follow up",
            "element": "follow_up"
        },
        {
            "column_label": "Domain",
            "element": "sys_domain"
        },
        {
            "column_label": "Updates",
            "element": "sys_mod_count"
        },
        {
            "column_label": "Configuration item",
            "element": "cmdb_ci"
        },
        {
            "column_label": "Approval history",
            "element": "approval_history"
        },
        {
            "column_label": "Business duration",
            "element": "business_duration"
        },
        {
            "column_label": "Location",
            "element": "location"
        },
        {
            "column_label": "User input",
            "element": "user_input"
        },
        {
            "column_label": "Created by",
            "element": "sys_created_by"
        },
        {
            "column_label": "Category",
            "element": "category"
        },
        {
            "column_label": "Chronicle Incident",
            "element": "x_cdsp_chroni_itsm_chronicle_incident_ref"
        },
        {
            "column_label": "Business resolve time",
            "element": "business_stc"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "Origin",
            "element": "origin_id"
        },
        {
            "column_label": "Workflow activity",
            "element": "wf_activity"
        },
        {
            "column_label": "Caused by Change",
            "element": "caused_by"
        },
        {
            "column_label": "Work notes list",
            "element": "work_notes_list"
        },
        {
            "column_label": "Close code",
            "element": "close_code"
        },
        {
            "column_label": "Skills",
            "element": "skills"
        },
        {
            "column_label": "Resolved",
            "element": "resolved_at"
        },
        {
            "column_label": "Splunk URL",
            "element": "x_splu2_splunk_ser_splunk_url"
        },
        {
            "column_label": "Last reopened at",
            "element": "reopened_time"
        },
        {
            "column_label": "Problem",
            "element": "problem_id"
        },
        {
            "column_label": "Caller",
            "element": "caller_id"
        },
        {
            "column_label": "Subcategory",
            "element": "subcategory"
        },
        {
            "column_label": "Comments and Work notes",
            "element": "comments_and_work_notes"
        },
        {
            "column_label": "Description",
            "element": "description"
        },
        {
            "column_label": "Impact",
            "element": "impact"
        },
        {
            "column_label": "Closed",
            "element": "closed_at"
        },
        {
            "column_label": "Group list",
            "element": "group_list"
        },
        {
            "column_label": "Activity due",
            "element": "activity_due"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "Task type",
            "element": "sys_class_name"
        },
        {
            "column_label": "Parent",
            "element": "parent"
        },
        {
            "column_label": "Priority",
            "element": "priority"
        },
        {
            "column_label": "Close notes",
            "element": "close_notes"
        },
        {
            "column_label": "Reassignment count",
            "element": "reassignment_count"
        },
        {
            "column_label": "Due date",
            "element": "due_date"
        },
        {
            "column_label": "Order",
            "element": "order"
        },
        {
            "column_label": "Short description",
            "element": "short_description"
        },
        {
            "column_label": "Company",
            "element": "company"
        },
        {
            "column_label": "Approval set",
            "element": "approval_set"
        },
        {
            "column_label": "Opened by",
            "element": "opened_by"
        },
        {
            "column_label": "Contact type",
            "element": "contact_type"
        },
        {
            "column_label": "Made SLA",
            "element": "made_sla"
        },
        {
            "column_label": "Created",
            "element": "sys_created_on"
        },
        {
            "column_label": "On hold reason",
            "element": "hold_reason"
        },
        {
            "column_label": "Assignment group",
            "element": "assignment_group"
        },
        {
            "column_label": "Approval",
            "element": "approval"
        },
        {
            "column_label": "Duration",
            "element": "calendar_duration"
        },
        {
            "column_label": "Knowledge",
            "element": "knowledge"
        },
        {
            "column_label": "Correlation display",
            "element": "correlation_display"
        },
        {
            "column_label": "Updated",
            "element": "sys_updated_on"
        },
        {
            "column_label": "Delivery task",
            "element": "delivery_task"
        },
        {
            "column_label": "Actual end",
            "element": "work_end"
        },
        {
            "column_label": "Domain Path",
            "element": "sys_domain_path"
        },
        {
            "column_label": "Universal Request",
            "element": "universal_request"
        },
        {
            "column_label": "Expected start",
            "element": "expected_start"
        },
        {
            "column_label": "Notify",
            "element": "notify"
        },
        {
            "column_label": "Actual start",
            "element": "work_start"
        },
        {
            "column_label": "Upon approval",
            "element": "upon_approval"
        },
        {
            "column_label": "Severity",
            "element": "severity"
        },
        {
            "column_label": "Transfer reason",
            "element": "route_reason"
        },
        {
            "column_label": "Delivery plan",
            "element": "delivery_plan"
        },
        {
            "column_label": "Upon reject",
            "element": "upon_reject"
        },
        {
            "column_label": "Last reopened by",
            "element": "reopened_by"
        }
    ]
}

Sample API Response (GRC Issues) (Status Code: 200)


{
    "result": [
        {
            "column_label": "Is reparenting group",
            "element": "is_reparenting_group"
        },
        {
            "column_label": "Authority document",
            "element": "authority_document"
        },
        {
            "column_label": "Item",
            "element": "item"
        },
        {
            "column_label": "Issue manager",
            "element": "issue_manager"
        },
        {
            "column_label": "Issue rating",
            "element": "issue_rating"
        },
        {
            "column_label": "Management method",
            "element": "management_method"
        },
        {
            "column_label": "Document",
            "element": "document"
        },
        {
            "column_label": "Explanation",
            "element": "explanation"
        },
        {
            "column_label": "Recommendation",
            "element": "recommendation"
        },
        {
            "column_label": "Action plan",
            "element": "action_plan"
        },
        {
            "column_label": "Substate",
            "element": "substate"
        },
        {
            "column_label": "Parent issue",
            "element": "parent_issue"
        },
        {
            "column_label": "Control objective/Risk statement",
            "element": "content"
        },
        {
            "column_label": "Entity",
            "element": "profile"
        },
        {
            "column_label": "Functional domain",
            "element": "functional_domain"
        },
        {
            "column_label": "User hierarchy status",
            "element": "user_hierarchy_status"
        },
        {
            "column_label": "Is group",
            "element": "is_group"
        },
        {
            "column_label": "Issue group rule",
            "element": "issue_group_rule"
        },
        {
            "column_label": "Issue manager group",
            "element": "issue_manager_group"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "Classification",
            "element": "classification"
        },
        {
            "column_label": "Allowed groups",
            "element": "confidential_user_groups"
        },
        {
            "column_label": "Issue source",
            "element": "issue_source"
        },
        {
            "column_label": "User hierarchy 2",
            "element": "user_hierarchy_2"
        },
        {
            "column_label": "User hierarchy 1",
            "element": "user_hierarchy_1"
        },
        {
            "column_label": "Policy",
            "element": "policy"
        },
        {
            "column_label": "Confidential",
            "element": "is_confidential"
        },
        {
            "column_label": "Response",
            "element": "response"
        },
        {
            "column_label": "Confirmed date",
            "element": "confirmed_date"
        },
        {
            "column_label": "Issue type",
            "element": "issue_type"
        },
        {
            "column_label": "Allowed users",
            "element": "confidential_users"
        },
        {
            "column_label": "Created manually",
            "element": "created_manually"
        },
        {
            "column_label": "Group level",
            "element": "group_level"
        },
        {
            "column_label": "Actual end",
            "element": "work_end"
        },
        {
            "column_label": "Company",
            "element": "company"
        },
        {
            "column_label": "Task type",
            "element": "sys_class_name"
        },
        {
            "column_label": "Number",
            "element": "number"
        },
        {
            "column_label": "Impact",
            "element": "impact"
        },
        {
            "column_label": "Short description",
            "element": "short_description"
        },
        {
            "column_label": "Approval set",
            "element": "approval_set"
        },
        {
            "column_label": "Description",
            "element": "description"
        },
        {
            "column_label": "Closed",
            "element": "closed_at"
        },
        {
            "column_label": "Opened by",
            "element": "opened_by"
        },
        {
            "column_label": "Made SLA",
            "element": "made_sla"
        },
        {
            "column_label": "Group list",
            "element": "group_list"
        },
        {
            "column_label": "Contact type",
            "element": "contact_type"
        },
        {
            "column_label": "Activity due",
            "element": "activity_due"
        },
        {
            "column_label": "Created by",
            "element": "sys_created_by"
        },
        {
            "column_label": "Workflow activity",
            "element": "wf_activity"
        },
        {
            "column_label": "Rejection goto",
            "element": "rejection_goto"
        },
        {
            "column_label": "Upon reject",
            "element": "upon_reject"
        },
        {
            "column_label": "Contract",
            "element": "contract"
        },
        {
            "column_label": "Escalation",
            "element": "escalation"
        },
        {
            "column_label": "Effective number",
            "element": "task_effective_number"
        },
        {
            "column_label": "Active",
            "element": "active"
        },
        {
            "column_label": "Work notes",
            "element": "work_notes"
        },
        {
            "column_label": "Assigned to",
            "element": "assigned_to"
        },
        {
            "column_label": "Time worked",
            "element": "time_worked"
        },
        {
            "column_label": "Business service",
            "element": "business_service"
        },
        {
            "column_label": "Domain Path",
            "element": "sys_domain_path"
        },
        {
            "column_label": "State",
            "element": "state"
        },
        {
            "column_label": "Additional assignee list",
            "element": "additional_assignee_list"
        },
        {
            "column_label": "Follow up",
            "element": "follow_up"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "Correlation ID",
            "element": "correlation_id"
        },
        {
            "column_label": "Created",
            "element": "sys_created_on"
        },
        {
            "column_label": "Work notes list",
            "element": "work_notes_list"
        },
        {
            "column_label": "Universal Request",
            "element": "universal_request"
        },
        {
            "column_label": "Closed by",
            "element": "closed_by"
        },
        {
            "column_label": "Domain",
            "element": "sys_domain"
        },
        {
            "column_label": "Delivery plan",
            "element": "delivery_plan"
        },
        {
            "column_label": "Upon approval",
            "element": "upon_approval"
        },
        {
            "column_label": "Parent",
            "element": "parent"
        },
        {
            "column_label": "Close notes",
            "element": "close_notes"
        },
        {
            "column_label": "Assignment group",
            "element": "assignment_group"
        },
        {
            "column_label": "Duration",
            "element": "calendar_duration"
        },
        {
            "column_label": "Priority",
            "element": "priority"
        },
        {
            "column_label": "Approval",
            "element": "approval"
        },
        {
            "column_label": "Due date",
            "element": "due_date"
        },
        {
            "column_label": "Updated by",
            "element": "sys_updated_by"
        },
        {
            "column_label": "Correlation display",
            "element": "correlation_display"
        },
        {
            "column_label": "Updates",
            "element": "sys_mod_count"
        },
        {
            "column_label": "Reassignment count",
            "element": "reassignment_count"
        },
        {
            "column_label": "Order",
            "element": "order"
        },
        {
            "column_label": "Knowledge",
            "element": "knowledge"
        },
        {
            "column_label": "Service offering",
            "element": "service_offering"
        },
        {
            "column_label": "Delivery task",
            "element": "delivery_task"
        },
        {
            "column_label": "Configuration item",
            "element": "cmdb_ci"
        },
        {
            "column_label": "Comments and Work notes",
            "element": "comments_and_work_notes"
        },
        {
            "column_label": "Urgency",
            "element": "urgency"
        },
        {
            "column_label": "Approval history",
            "element": "approval_history"
        },
        {
            "column_label": "Additional comments",
            "element": "comments"
        },
        {
            "column_label": "Opened",
            "element": "opened_at"
        },
        {
            "column_label": "Business duration",
            "element": "business_duration"
        },
        {
            "column_label": "User input",
            "element": "user_input"
        },
        {
            "column_label": "Variables",
            "element": "variables"
        },
        {
            "column_label": "Watch list",
            "element": "watch_list"
        },
        {
            "column_label": "Location",
            "element": "location"
        },
        {
            "column_label": "SLA due",
            "element": "sla_due"
        },
        {
            "column_label": "Updated",
            "element": "sys_updated_on"
        },
        {
            "column_label": "Actual start",
            "element": "work_start"
        },
        {
            "column_label": "Expected start",
            "element": "expected_start"
        },
        {
            "column_label": "Transfer reason",
            "element": "route_reason"
        },
        {
            "column_label": "Skills",
            "element": "skills"
        }
    ]
}

Get ServiceNow groups as Queue

API Endpoint: <Instance URL><URL de l'instance>/api/now/table/sys_user_group

Method: OBTENIR

Parameters

Clé	Value
sysparm_fields	nom,sys_id
sysparm_limit	1000
sysparm_offset	0

Headers

Clé	Value
User-Agent	netskope-ce-6.0.0-cto-servicenow-v2.2.0
Authorization	Base <username:password>

Sample API Response (Status Code: 200)


{ "result": [ { "sys_id": "01336b6347332100158b949b6c9a71b5", "name": "Finance Vendors" }, …. ] }

Create Incident or Security Incident or GRC Issue or Custom Table record

API Endpoint: <Instance URL><URL d’instance >/api/now/table/<table>

Method: PUBLIER

Path Parameters

Clé	Value
table	incident sn_si_incident sn_grc_issue custom_table_name

Headers

Clé	Value
User-Agent	netskope-ce-6.0.0-cto-servicenow-v2.2.0
Authorization	Base <username:password>

Body


{
    "short_description": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name",
    "description": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType",
    "assignment_group": "<group_sys_id>"
}

Sample API Response (Security Incident) (Status Code: 201)


{
    "result": {
        "parent": "",
        "sla_suspended_reason": "",
        "watch_list": "",
        "upon_reject": "cancel",
        "sys_updated_on": "2024-10-25 10:46:39",
        "qualification_group": "",
        "expected_end": "",
        "enforce_restriction": "false",
        "approval_history": "",
        "source_ip": "",
        "skills": "",
        "number": "SIR1083059",
        "problem": "",
        "previous_agent": "",
        "state": "10",
        "sys_created_by": "user1.abc",
        "template_workflow_invoked": "false",
        "knowledge": "false",
        "order": "",
        "phish_email": "",
        "cmdb_ci": "",
        "delivery_plan": "",
        "contract": "",
        "impact": "3",
        "active": "true",
        "work_notes_list": "",
        "vulnerability": "",
        "priority": "4",
        "sys_domain_path": "/",
        "sla_suspended": "false",
        "business_duration": "",
        "group_list": "",
        "special_access_write": "",
        "dest_ip": "",
        "mitre_platform": "",
        "approval_set": "",
        "risk_change": "up",
        "malware_url": "",
        "universal_request": "",
        "last_updated_from_src": "",
        "template": "",
        "short_description": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name",
        "correlation_display": "",
        "delivery_task": "",
        "work_start": "",
        "request_type": "",
        "affected_user": "",
        "other_ioc": "",
        "additional_assignee_list": "",
        "alert_sensor": "",
        "assigned_vendor": "",
        "service_offering": "",
        "sys_class_name": "sn_si_incident",
        "closed_by": "",
        "follow_up": "",
        "mitre_group": "",
        "sla_suspended_on": "",
        "estimated_end": "",
        "vendor_reference": "",
        "reassignment_count": "0",
        "assigned_to": "",
        "request_category": "",
        "requested_due_by": "",
        "mitre_malware": "",
        "sla_suspended_for": "",
        "business_criticality": "3",
        "sla_due": "",
        "opened_for": {
            "link": "https://service-now.com/api/now/table/sys_user/c813b7cb1b8342148f4aedb8b04bcb91",
            "value": "c813b7cb1b8342148f4aedb8b04bcb91"
        },
        "comments_and_work_notes": "",
        "mitre_technique": "",
        "special_access_read": "",
        "substate": "",
        "escalation": "0",
        "upon_approval": "proceed",
        "allowed_groups": "",
        "correlation_id": "",
        "asset": "",
        "mitre_tool": "",
        "spam": "false",
        "referrer_url": "",
        "made_sla": "true",
        "mitre_tactic": "",
        "is_catalog": "false",
        "malware_hash": "",
        "alert_rule": "",
        "task_effective_number": "SIR1083059",
        "external_url": "",
        "sys_updated_by": "user1.abc",
        "opened_by": {
            "link": "https://service-now.com/api/now/table/sys_user/c813b7cb1b8342148f4aedb8b04bcb91",
            "value": "c813b7cb1b8342148f4aedb8b04bcb91"
        },
        "user_input": "",
        "sys_created_on": "2024-10-25 10:46:39",
        "sys_domain": {
            "link": "https://service-now.com/api/now/table/sys_user_group/global",
            "value": "global"
        },
        "pir": "",
        "route_reason": "",
        "closed_at": "",
        "allowed_members": "",
        "business_service": "",
        "attack_vector": "",
        "time_worked": "",
        "expected_start": "",
        "opened_at": "2024-10-25 10:46:39",
        "task_created": "false",
        "x_cdsp_chroni_sir_chronicle_si": "",
        "work_end": "",
        "confidence_score": "",
        "prediction": "",
        "automation_activity": "",
        "subcategory": "",
        "work_notes": "",
        "security_tags": "",
        "risk_score_override": "false",
        "initiated_from": "",
        "close_code": "",
        "assignment_group": {
            "link": "https://service-now.com/api/now/table/sys_user_group/<group_sys_id>",
            "value": "<group_sys_id>"
        },
        "description": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType",
        "calendar_duration": "",
        "close_notes": "",
        "pir_respondents": "",
        "sys_id": "f25adc501b255a549f2eeb98b04bcb56",
        "contact_type": "",
        "urgency": "3",
        "secure_notes": "",
        "company": "",
        "new_pir_respondents": "",
        "department": "",
        "activity_due": "",
        "severity": "2",
        "comments": "",
        "risk_score": "40",
        "approval": "not requested",
        "due_date": "",
        "sys_mod_count": "0",
        "parent_security_incident": "",
        "sys_tags": "",
        "billable": "false",
        "mitre_data_source": "",
        "caller": "",
        "location": "",
        "risk": "3",
        "category": "",
        "incident": "",
        "change_request": "",
        "security_incident_self": {
            "link": "https://service-now.com/api/now/table/sn_si_incident/f25adc501b255a549f2eeb98b04bcb56",
            "value": "f25adc501b255a549f2eeb98b04bcb56"
        }
    }
}

Sample API Response (Incident) (Status Code: 201)


{
    "result": {
        "parent": "",
        "made_sla": "true",
        "caused_by": "",
        "watch_list": "",
        "upon_reject": "cancel",
        "sys_updated_on": "2024-10-25 10:44:54",
        "child_incidents": "0",
        "hold_reason": "",
        "origin_table": "",
        "task_effective_number": "INC0923990",
        "approval_history": "",
        "skills": "",
        "number": "INC0923990",
        "resolved_by": "",
        "sys_updated_by": "user1.abc",
        "opened_by": {
            "link": "https://service-now.com/api/now/table/sys_user/c813b7cb1b8342148f4aedb8b04bcb91",
            "value": "c813b7cb1b8342148f4aedb8b04bcb91"
        },
        "user_input": "",
        "sys_created_on": "2024-10-25 10:44:54",
        "sys_domain": {
            "link": "https://service-now.com/api/now/table/sys_user_group/global",
            "value": "global"
        },
        "state": "1",
        "route_reason": "",
        "sys_created_by": "user1.abc",
        "knowledge": "false",
        "order": "",
        "calendar_stc": "",
        "x_cdsp_chroni_itsm_chronicle_incident_ref": "",
        "closed_at": "",
        "cmdb_ci": "",
        "delivery_plan": "",
        "contract": "",
        "impact": "3",
        "active": "true",
        "work_notes_list": "",
        "business_service": "",
        "business_impact": "",
        "priority": "5",
        "sys_domain_path": "/",
        "rfc": "",
        "time_worked": "",
        "expected_start": "",
        "opened_at": "2024-10-25 10:44:54",
        "business_duration": "",
        "group_list": "",
        "work_end": "",
        "caller_id": "",
        "reopened_time": "",
        "resolved_at": "",
        "approval_set": "",
        "subcategory": "",
        "work_notes": "",
        "universal_request": "",
        "short_description": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name",
        "close_code": "",
        "correlation_display": "",
        "delivery_task": "",
        "work_start": "",
        "assignment_group": {
            "link": "https://service-now.com/api/now/table/sys_user_group/<group_sys_id>",
            "value": "<group_sys_id>"
        },
        "additional_assignee_list": "",
        "business_stc": "",
        "cause": "",
        "description": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType",
        "origin_id": "",
        "calendar_duration": "",
        "close_notes": "",
        "notify": "1",
        "service_offering": "",
        "sys_class_name": "incident",
        "closed_by": "",
        "follow_up": "",
        "parent_incident": "",
        "sys_id": "d1f994dc1be15a549f2eeb98b04bcb71",
        "contact_type": "",
        "reopened_by": "",
        "incident_state": "1",
        "urgency": "3",
        "problem_id": "",
        "company": "",
        "reassignment_count": "0",
        "activity_due": "",
        "assigned_to": "",
        "severity": "3",
        "comments": "",
        "approval": "not requested",
        "sla_due": "",
        "comments_and_work_notes": "",
        "due_date": "",
        "sys_mod_count": "0",
        "reopen_count": "0",
        "sys_tags": "",
        "escalation": "0",
        "upon_approval": "proceed",
        "correlation_id": "",
        "location": "",
        "category": "inquiry"
    }
}

Sample API Response (GRC Issue) (Status Code: 201)


{
    "result": {
        "parent": "",
        "shadow": "false",
        "watch_list": "",
        "authority_document": "",
        "recommendation": "",
        "wbs": "",
        "upon_reject": "cancel",
        "sys_updated_on": "2024-10-25 10:46:11",
        "explanation": "",
        "approval_history": "",
        "rollup": "false",
        "skills": "",
        "number": "IPT0020059",
        "schedule_start_date": "2024-10-25 10:46:11",
        "capex_cost": "0",
        "state": "1",
        "sys_created_by": "user1.abc",
        "knowledge": "false",
        "order": "",
        "work_duration": "",
        "item": "",
        "budget_cost": "0",
        "cmdb_ci": "",
        "dependency": "",
        "contract": "",
        "impact": "3",
        "key_milestone": "false",
        "profile": "",
        "remaining_effort": "",
        "active": "true",
        "work_notes_list": "",
        "functional_domain": "",
        "classification": "",
        "priority": "4",
        "sys_domain_path": "/",
        "version": "",
        "business_duration": "",
        "group_list": "",
        "override_status": "false",
        "approval_set": "",
        "critical_path": "false",
        "status": "green",
        "universal_request": "",
        "end_date": "2024-10-26 10:46:11",
        "short_description": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name",
        "correlation_display": "",
        "work_start": "",
        "top_task": {
            "link": "https://service-now.com/api/now/table/planned_task/444a541847e5161034d5e0d3706d4326",
            "value": "444a541847e5161034d5e0d3706d4326"
        },
        "parent_issue": "",
        "time_constraint": "asap",
        "document": "",
        "additional_assignee_list": "",
        "service_offering": "",
        "sys_class_name": "sn_grc_issue",
        "closed_by": "",
        "follow_up": "",
        "calculation_type": "automatic",
        "confidential_user_groups": "",
        "reassignment_count": "0",
        "schedule_end_date": "2024-10-26 10:46:11",
        "assigned_to": "",
        "policy": "",
        "start_date": "2024-10-25 10:46:11",
        "mpp_task_id": "",
        "sub_tree_root": "",
        "sla_due": "",
        "comments_and_work_notes": "",
        "remaining_duration": "",
        "has_conflict": "false",
        "substate": "",
        "allow_dates_outside_schedule": "false",
        "escalation": "0",
        "upon_approval": "proceed",
        "issue_manager": "",
        "correlation_id": "",
        "group_level": "",
        "made_sla": "true",
        "user_hierarchy_2": "",
        "user_hierarchy_1": "",
        "wbs_order": "",
        "task_effective_number": "IPT0020059",
        "work_effort": "",
        "sys_updated_by": "user1.abc",
        "opened_by": {
            "link": "https://service-now.com/api/now/table/sys_user/dadb5bc43be9d210c71edd6aa5e45a1b",
            "value": "dadb5bc43be9d210c71edd6aa5e45a1b"
        },
        "user_input": "",
        "sys_created_on": "2024-10-25 10:46:11",
        "sys_domain": {
            "link": "https://service-now.com/api/now/table/sys_user_group/global",
            "value": "global"
        },
        "route_reason": "",
        "start_date_derived_from": "",
        "orig_sys_id": "",
        "closed_at": "",
        "is_reparenting_group": "false",
        "level": "",
        "business_service": "",
        "confidential_users": "",
        "is_confidential": "false",
        "relation_applied": "",
        "time_worked": "",
        "expected_start": "",
        "issue_group_rule": "",
        "opened_at": "2024-10-25 10:46:11",
        "task": "Netskope $appCategory alert name: $alertName, Event Name: $alert_nameIPT0020059",
        "work_end": "",
        "run_calc_brs": "true",
        "work_notes": "",
        "work_cost": "0",
        "assignment_group": "",
        "orig_top_task_id": "",
        "user_hierarchy_status": "2",
        "software_model": "",
        "created_manually": "true",
        "description": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType",
        "effort": "",
        "calendar_duration": "",
        "end_date_derived_from": "",
        "close_notes": "",
        "content": "",
        "duration": "1970-01-02 00:00:00",
        "issue_manager_group": "",
        "sys_id": "444a541847e5161034d5e0d3706d4326",
        "contact_type": "",
        "urgency": "3",
        "constraint_date": "",
        "company": "",
        "end": "2024-10-25",
        "activity_due": "",
        "comments": "",
        "cost": "0",
        "approval": "not requested",
        "due_date": "",
        "issue_type": "",
        "start": "2024-10-25",
        "sys_mod_count": "0",
        "management_method": "",
        "confirmed_date": "",
        "model_id": "",
        "opex_cost": "0",
        "sys_tags": "",
        "time_zone": "",
        "html_description": "",
        "percent_complete": "0",
        "is_group": "false",
        "milestone": "false",
        "issue_source": "44ab97f6c75200107e299e0703c2602a",
        "action_plan": "",
        "response": "",
        "issue_rating": "",
        "location": ""
    }
}

Get Incident or Security Incidents or GRC Issues or Custom Table Record

API Endpoint: <Instance URL><URL d’instance >/api/now/table/<table>

Method: OBTENIR

Path Parameters

Clé	Value
table	incident sn_si_incident sn_grc_issue custom_table_name

Parameters

Clé	Value
sysparm_fields	sys_id,state,severity,assigned_to
sysparm_query	sys_idIN<incident_sys_id>

Headers

Clé	Value
User-Agent	netskope-ce-6.0.0-cto-servicenow-v2.2.0
Authorization	Base <username:password>

Sample API Response (Status Code: 200)


{
    "result": [
        {
            "severity": "2",
            "sys_id": "f25adc501b255a549f2eeb98b04bcb56",
            "state": "10",
            "assigned_to": {
                "link": "https://<Instance URL>/api/now/table/sys_user/324sndm",
                "value": "324sndm"
            }
        }
    ]
}

Sample API Response (GRC Issue) (Status Code: 200)


{
    "result": [
        {
            "sys_id": "444a541847e5161034d5e0d3706d4326",
            "impact": "3",
            "state": "1",
            "assigned_to": ""
        }
    ]
}

Update Incident or Security Incident or GRC Issue or Custom Table record

API Endpoint: <Instance URL><URL d’instance >/api/now/table/<table>

Method: PATCH

Path Parameters

Clé	Value
table	incident sn_si_incident sn_grc_issue custom_table_name

Headers

Clé	Value
User-Agent	netskope-ce-6.0.0-cto-servicenow-v2.2.0
Authorization	Base <username:password>

Body


{
    "work_notes": "Received new alert with Alert ID: $id and Alert Name: $alertName in Cloud Exchange."
}

Sample API Response (Status Code: 200)


{
    "result": {
        "parent": "",
        "sla_suspended_reason": "",
        "watch_list": "",
        "upon_reject": "cancel",
        "sys_updated_on": "2024-10-25 11:56:25",
        "qualification_group": "",
        "expected_end": "",
        "enforce_restriction": "false",
        "approval_history": "",
        "source_ip": "",
        "skills": "",
        "number": "SIR1083059",
        "problem": "",
        "previous_agent": "",
        "state": "10",
        "sys_created_by": "user1.abc",
        "template_workflow_invoked": "false",
        "knowledge": "false",
        "order": "",
        "phish_email": "",
        "cmdb_ci": "",
        "delivery_plan": "",
        "contract": "",
        "impact": "3",
        "active": "true",
        "work_notes_list": "",
        "vulnerability": "",
        "priority": "4",
        "sys_domain_path": "/",
        "sla_suspended": "false",
        "business_duration": "",
        "group_list": "",
        "special_access_write": "",
        "dest_ip": "",
        "mitre_platform": "",
        "approval_set": "",
        "risk_change": "up",
        "malware_url": "",
        "universal_request": "",
        "last_updated_from_src": "automation",
        "template": "",
        "short_description": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name",
        "correlation_display": "",
        "delivery_task": "",
        "work_start": "",
        "request_type": "",
        "affected_user": "",
        "other_ioc": "",
        "additional_assignee_list": "",
        "alert_sensor": "",
        "assigned_vendor": "",
        "service_offering": "",
        "sys_class_name": "sn_si_incident",
        "closed_by": "",
        "follow_up": "",
        "mitre_group": "",
        "sla_suspended_on": "",
        "estimated_end": "",
        "vendor_reference": "",
        "reassignment_count": "0",
        "assigned_to": "",
        "request_category": "",
        "requested_due_by": "",
        "mitre_malware": "",
        "sla_suspended_for": "",
        "business_criticality": "3",
        "sla_due": "",
        "opened_for": {
            "link": "https://service-now.com/api/now/table/sys_user/c813b7cb1b8342148f4aedb8b04bcb91",
            "value": "c813b7cb1b8342148f4aedb8b04bcb91"
        },
        "comments_and_work_notes": "",
        "mitre_technique": "",
        "special_access_read": "",
        "substate": "",
        "escalation": "0",
        "upon_approval": "proceed",
        "allowed_groups": "",
        "correlation_id": "",
        "asset": "",
        "mitre_tool": "",
        "spam": "false",
        "referrer_url": "",
        "made_sla": "true",
        "mitre_tactic": "",
        "is_catalog": "false",
        "malware_hash": "",
        "alert_rule": "",
        "task_effective_number": "SIR1083059",
        "external_url": "",
        "sys_updated_by": "user1.abc",
        "opened_by": {
            "link": "https://service-now.com/api/now/table/sys_user/c813b7cb1b8342148f4aedb8b04bcb91",
            "value": "c813b7cb1b8342148f4aedb8b04bcb91"
        },
        "user_input": "",
        "sys_created_on": "2024-10-25 10:46:39",
        "sys_domain": {
            "link": "https://service-now.com/api/now/table/sys_user_group/global",
            "value": "global"
        },
        "pir": "",
        "route_reason": "",
        "closed_at": "",
        "allowed_members": "",
        "business_service": "",
        "attack_vector": "",
        "time_worked": "",
        "expected_start": "",
        "opened_at": "2024-10-25 10:46:39",
        "task_created": "false",
        "x_cdsp_chroni_sir_chronicle_si": "",
        "work_end": "",
        "confidence_score": "",
        "prediction": "",
        "automation_activity": "",
        "subcategory": "",
        "work_notes": "",
        "security_tags": "",
        "risk_score_override": "false",
        "initiated_from": "",
        "close_code": "",
        "assignment_group": {
            "link": "https://service-now.com/api/now/table/sys_user_group/<group_sys_id>",
            "value": "<group_sys_id>"
        },
        "description": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType",
        "calendar_duration": "",
        "close_notes": "",
        "pir_respondents": "",
        "sys_id": "f25adc501b255a549f2eeb98b04bcb56",
        "contact_type": "",
        "urgency": "3",
        "secure_notes": "",
        "company": "",
        "new_pir_respondents": "",
        "department": "",
        "activity_due": "",
        "severity": "2",
        "comments": "",
        "risk_score": "40",
        "approval": "not requested",
        "due_date": "",
        "sys_mod_count": "2",
        "parent_security_incident": "",
        "sys_tags": "",
        "billable": "false",
        "mitre_data_source": "",
        "caller": "",
        "location": "",
        "risk": "3",
        "category": "",
        "incident": "",
        "change_request": "",
        "security_incident_self": {
            "link": "https://service-now.com/api/now/table/sn_si_incident/f25adc501b255a549f2eeb98b04bcb56",
            "value": "f25adc501b255a549f2eeb98b04bcb56"
        }
    }
}

Fetch Assignee Users

API Endpoint: <Instance URL><URL de l'instance>/api/now/table/sys_user

Method: OBTENIR

Parameters

Clé	Value
sysparm_query	sys_id,user_name
sysparm_fields	sys_idIN<user_sys_id>

Headers

Clé	Value
User-Agent	netskope-ce-6.0.0-cto-servicenow-v2.2.0
Authorization	Base <username:password>

Sample API Response (Status Code: 200)


{
    "result": [
        {
            "sys_id": "800b174138d089c868d09de320f9833b",
            "user_name": "user.abc"
        }
    ]
}

Matrice de performance

Ces relevés sont effectués sur une pile CE de grande taille répondant à ces spécifications.

Exécution de la performance pour la table personnalisée sur l'instance ServiceNow.

Description	Spécifications
Détails de la pile	Taille : Grand RAM : 32 GO CPU : 16 cœurs
Billets créés par minute	~ 160 incidents/min

Description

Spécifications

Détails de la pile

Taille : Grand

RAM : 32 GO

CPU : 16 cœurs

Billets créés par minute

~ 160 incidents/min

Agent utilisateur

netskope-ce-6.0.0-cto-servicenow-v2.2.0

Workflow

Créez un utilisateur New dans ServiceNow
Attribuer un rôle à l'utilisateur
Configurer le plugin ServiceNow
Ajoutez une règle de gestion pour ServiceNow.
Ajouter une file d'attente pour ServiceNow.
Validez le plugin.

Regardez une vidéo

Cliquer sur « play » pour regarder une vidéo.

Créez un utilisateur New

Connectez-vous à ServiceNow.
Aller à System Security > Users and Groups > Users.
Click New.
Saisissez les informations requises et faites une copie de l'ID utilisateur. Cliquez sur Submit.
Sur la page Utilisateurs , recherchez votre identifiant utilisateur et cliquez sur votre utilisateur (comme montré ci-dessous).
Cliquez sur Set Password.
Cliquez Generate. Copiez le mot de passe, puis cliquez sur Save Password et Close.

Attribuer un rôle à l'utilisateur

Scroll down to Roles and click Edit.
Add roles per your requirements:
Roles required when Incidents is configured in the Destination Table parameter:
- itil ou sn_incident_write, sn_incident_read
  personalize_dictionary
Role required when Security Incidents is configured in the Destination Table parameter:
- sn_si.admin
Roles required when GRC Issues is configured in the Destination Table parameter:
- sn_grc.business_user (Les utilisateurs ne peuvent voir que les issues qu’ils ont elles-mêmes créées ou qui leur ont été attribuées) admin (Cette autorisation est nécessaire pour voir tous les problèmes GRC, quel que soit le créateur ou le destinataire)
Role required when Custom Table is configured in the Destination Table parameter:
- admin
Click Save.

Note

L'autorisation d'administrateur n'est requise que pour accéder à toutes les questions de GRC, quels qu'en soient le créateur et l'attributaire.
Cliquez sur Update.

Configurer le plugin ServiceNow

Dans Cloud Exchange, allez sur Settings > Plugin Store. Cherchez et sélectionnez ServiceNow v2.2.0 (CTO) boîte de plugin.
Indiquez un nom de configuration et modifiez l'intervalle de synchronisation en fonction de vos besoins.
Cliquez sur Next et entrez les paramètres d'authentification :
- Instance URL: URL de l'instance ServiceNow.
- Username: Nom d'utilisateur de l'instance.
- Password: Mot de passe d’instance.
- Destination Table: Nom du tableau où les incidents seront créés.
Entrez les paramètres de configuration. Pour la table personnalisée, mappez ces champs en fonction de vos besoins.
- Custom Table Name: Indiquez le nom de votre table personnalisée.
- Custom Status: Champ Statut Nom de colonne de votre table personnalisée.
- Custom Severity: Champ Sévérité Nom de colonne de votre table personnalisée.
- Custom Assignee: Assignee field Nom de colonne de votre table personnalisée si elle fait référence à la table 'sys_user_' de ServiceNow.
- Custom Group: Group field Nom de colonne de votre table personnalisée si elle fait référence à la table 'sys_user_group' de ServiceNow.
- Custom Update: Champ de mise à jour Nom de colonne de votre table personnalisée. Ce champ sera utilisé pour ajouter un message lorsque la règle de déduplication est exécutée.
Note

Aucun champ ne sera mappé par défaut pour la table personnalisée dans la configuration de la file d'attente. Cependant, si vous spécifiez le champ Mise à jour personnalisée, un mappage par défaut des champs de déduplication sera fourni lors de la création de la file d'attente.

Use Default Mappings: Select Yes pour l'option Pas de file d'attente (Pas de file d'attente utilise les mappages par défaut pour la file d'attente et ne nécessite pas d'accès élevé) sur la page de configuration de la file d'attente ; sinon, sélectionnez No.

Oui : ces mappages par défaut seront utilisés pour l'option Pas de file d'attente.

Champs cibles	Values
Brève description	Nom de l'alerte Netskope $appCategory : $alertName Nom de l'événement : $alert_name
Description	Alerte/identification de l'événement : $id Application de l'alerte/événement : $appAlert/Event Utilisateur : $userAlert Nom : $alertName $alertName Type d'alerte : Type d'alerte : $alertType Catégorie de l'application d'alerte : $appCategory Nom de l'événement : $alert_name Type d'événement : $eventType

Non : vous pouvez créer des correspondances personnalisées.

Select la configuration du mappage à partir des champs suivants.
Voici le mappage par défaut pour les mappages d'état et de gravité :
Pour créer un statut personnalisé, cliquez sur Add en bas de la page.
Cliquez sur Add New pour créer un champ Cloud Exchange.
Indiquez le nom du champ et cliquez Add Field. Mappe-le au statut de votre choix.
Cliquez sur Save.

Ajouter une règle de gestion Ticket Orchestrator pour ServiceNow

Créez une règle de gestion basée sur les filtres dont vous avez besoin pour créer des incidents dans le plugin ServiceNow.

Dans Ticket Orchestrator, je dois Business Rules et cliquer sur Create New Rule.
Saisissez un nom de règle et créez la condition de requête de filtre appropriée sur le ou les champs de la règle métier. Vous pouvez également saisir la requête manuellement en cliquant sur Filter Query.
Cliquez sur Save.

Ajouter une file d'attente Ticket Orchestrator pour ServiceNow

Dans Ticket Orchestrator, allez à Queues et cliquez sur Add Queue Configuration.
Select la règle de gestion, la configuration du plugin et la file d'attente dans les menus déroulants.

Note

Les champs cibles de la section Map Fields seront extraits de l'instance ServiceNow en fonction de la table de destination sélectionnée lors de la configuration du plugin.
Cliquez Save et synchronisez la file si vous avez déjà les alertes/événements affichés.

Valider le plugin ServiceNow

Valider dans Cloud Exchange

Pour valider le site workflow, vous devez déjà avoir Netskope Alerts/Events.

Pour afficher la liste des tickets créés sur ServiceNow, accédez à Tickets dans Ticket Orchestrator.

Note

Tout statut qui n'est pas mis en correspondance avec les champs correspondants de Cloud Exchange ne synchronisera pas le statut du ticket.

Vérifiez la création/synchronisation du ticket en allant sur Logging.

Valider dans ServiceNow

Pour valider la création de l'incident, allez sur Tickets dans Ticket Orchestrator, et ouvrez le lien externe du ticket.
Assurez-vous d'être connecté à ServiceNow.

Ticket d'incident de sécurité :

Ticket d'incident :

Billet d'information du GRC :

Ticket de table personnalisé :

Dépannage du plugin ServiceNow

Impossible de mettre à jour la table Destination vers la table Custom lors de la mise à jour du plugin

Lors de la mise à jour du plugin de l'ancienne version vers la v2.1.0, vous pouvez rencontrer cette erreur si vous sélectionnez la table personnalisée dans le champ Table de destination:


CTO ServiceNow [CTO ServiceNow]: Validation error occurred. Custom Table Name is required Configuration Parameter.

What to do: Vous devez utiliser le bouton Skip, puis modifier la configuration du plugin à partir de la page des plugins pour utiliser la table personnalisée.

Impossible de configurer le plugin CTO ServiceNow

Si vous ne parvenez pas à configurer le plugin ServiceNow, cela peut être dû à l'une des raisons suivantes :

Les informations d'identification fournies sont incorrectes.
L'utilisateur ne dispose pas des autorisations nécessaires.
L'URL de l'instance fournie est incorrecte.

What to do:

Veillez à fournir les informations d'identification correctes. Suivez les étapes pour créer un utilisateur.
Assurez-vous que l'utilisateur dispose des autorisations nécessaires. Suivez les étapes pour attribuer un rôle à l'utilisateur.
Assurez-vous que l'URL de l'instance est correcte.

Impossible de créer un incident à l'aide du plugin

Si vous ne parvenez pas à créer un incident dans le plugin, cela peut être dû à l'une des raisons suivantes :

Aucune alerte ou aucun événement n'est disponible dans Cloud Exchange, ou aucune alerte ou aucun événement de New n'est tiré.
La règle de gestion n'a pas d'alertes/événements filtrés.
L'utilisateur n'a pas le rôle requis pour créer des incidents.

What to do: Trouvez la cause première et choisissez la solution la mieux adaptée.

Vérifiez si les alertes/événements sont disponibles dans la page Alertes/Événements. Si aucune alerte/événement n'est disponible, le ticket ne sera pas créé. Configurez le locataire ou toute autre configuration requise pour créer des alertes/événements dans Ticket Orchestrator.
Vérifiez la règle de gestion et testez-la pour confirmer qu'elle filtre les alertes. Si aucune alerte n'est disponible dans le filtrage, mettez à jour la règle de gestion.
Assurez-vous que les utilisateurs ont les rôles requis. Suivez les étapes pour attribuer un rôle à l'utilisateur.

Comportement connu

Nous avons observé que dans la table Incidents, lorsqu'un incident est créé et que le champ Assignee est mappé dans le mappage Queue, l'incident est automatiquement assigné à l'état In Progress, même lorsque l'événement d'incident récupéré du Netskope Tenant a un statut de New.