Onboard a ServiceNow App to SSPM

1. From SSPM, get the redirect URLs that you will need when you register your OAuth 2.0 application in ServiceNow.

   For onboarding, you must specify the redirect URL for onboarding for scans. If you also want to enable ServiceNow ticketing from SSPM, you must also specify the redirect URL for ticketing. To get the redirect URL, you will begin the onboarding procedure in SSPM, but you will not complete the procedure.

   1. Log in to Strata Cloud Manager.
   2. Select ConfigurationSaaS SecurityPosture SecurityApplicationsAdd Application and click the ServiceNow tile.
   3. On the Posture Security tab, Add New instance.
   4. OAuth 2.0.

      SSPM displays a configuration page for onboarding a ServiceNow instance. The Redirect URL field displays the redirect URL value.
   5. Copy the redirect URL and paste it into a text file.

      Don’t continue to the next step unless you have copied the redirect URL. You will need to specify this URL later when you're configuring your OAuth 2.0 integration application.

   If you also want to link SSPM to the ServiceNow instance for ticketing, get the redirect URL for ticketing. To get this redirect URL, you will begin the procedure for linking SSPM to ServiceNow for ticketing, but you will not complete the procedure.

   1. Select ConfigurationSaaS SecuritySettings Workflow Ticketing Settings.
   2. Add Link for ServiceNow.

      The login page for linking to a ServiceNow instance is displayed. The Redirect URL field displays the redirect URL value. Copy the redirect URL and paste it into a text file.

      Don’t continue to the next step unless you have copied the redirect URL. You will need to specify this URL later when you're configuring your OAuth 2.0 integration application.
2. Create an authentication scope to limit access to ServiceNow REST APIs.

   During onboarding, you will log in to a ServiceNow account and will grant SSPM access to that account. SSPM will get access to your ServiceNow account through an OAuth 2.0 integration application that you will create. By default, the OAuth token will have full access to the REST APIs that the ServiceNow account can access. Although SSPM will access only the Table API, the OAuth token will allow more access than SSPM requires. Before you create the OAuth 2.0 integration application, create an authentication scope, which will limit SSPM's access to only the Table API. You can create a scope that allows SSPM read-access only or full read and write access to the Table API. Later, you will assign this scope to your OAuth 2.0 application.

   1. Log in to ServiceNow as an administrator.
   2. Make sure the REST API Auth Scope plugin (com.glide.rest.auth.scope) is activated in ServiceNow. To verify that the plugin is activated, navigate to System Definition Plugins and use the search field to locate the plugin. If the plugin isn’t installed, refer to the ServiceNow documentation to install and activate the REST API Auth Scope plugin.
   3. Create the authentication scope.

      1. Navigate to the Authentication Scopes table (sys_auth_scope.list) by using the filter navigator.
      2. Click New to define the authentication scope.
      3. Specify a meaningful Name for your authentication scope, such as SSPM Connector. You can optionally specify a longer Description.
         Make note of the authentication scope name. You will need to specify this name later when you're configuring a REST API Auth Scope and your OAuth 2.0 integration application.
      4. Submit.
   4. Create a REST API Auth Scope and link it to your authentication scope.

      The REST API Auth Scope is where you will limit SSPM access to the Table API only. You can allow SSPM full read and write access to perform all HTTP methods, or you can limit SSPM to read-only access (GET method only).

      1. Navigate to the REST API Auth Scopes list (System Web ServicesAPI Auth ScopesREST API Auth Scope).
      2. Click New to define the REST API Auth Scope.
      3. In the Name field, specify a name for your REST API Auth Scope.
      4. From the REST API list, select Table API.
      5. Configure the REST API Auth Scope to allow SSPM full read and write access (all HTTP methods) to the Table API, or read-only access (HTTP GET method only).
         • Read-only Access: Configuring the REST API Auth Scope for reduced, read-only access will enable SSPM to perform configuration scans, account scans, and third-party plugin scans. However, SSPM will not be able to perform automated remediation of misconfigured settings.
           To configure the REST API Auth Scope for read-only access, complete the following steps:

           1. Deselect the Apply auth scope to all http methods in this API check box.
           2. From the HTTP Method list, select GET.

         • Read and Write Access: Configuring the REST API Auth Scope for full read and write access will enable SSPM to perform configuration scans, account scans, and third-party plugin scans. It will also enable SSPM to perform automated remediation of misconfigured settings.
           To configure the REST API Auth Scope for Read and Write access, select the Apply auth scope to all http methods in this API check box.

      6. In the Auth Scope field, specify the name of the authentication scope that you created earlier. This specification links the REST API Auth Scope to the authentication scope.
      7. Submit.
3. Create your OAuth 2.0 application in ServiceNow.

   1. Log in to ServiceNow as an administrator.
   2. Navigate to the Application Registries page (System OAuth Application Registry).
   3. From the Application Registries page, create a New application.

   4. ServiceNow prompts you to select the type of OAuth application that you want to create. Specify that you want to Create an OAuth API endpoint for external clients.

      ServiceNow displays a dialog for configuring your OAuth 2.0 application.

   5. Fill in your OAuth 2.0 application details using the fields that ServiceNow provides.

      • Specify the Redirect URL for onboarding ServiceNow, and, optionally, the redirect URL for linking to ServiceNow for ticketing. If you're adding both redirect URLs, separate the two URLs with a comma.
      • Under Auth Scopes, add the authentication scope that you created earlier.
      • If the form includes an Enforce Token Restrictions checkbox, make sure it is not selected. Depending on your ServiceNow version and installed security plugins, the form might not include this checkbox.
   6. Submit.

      ServiceNow registers your new OAuth 2.0 application and displays the Application Registries page. The Application Registries page now lists your OAuth 2.0 application.
   7. Open your OAuth 2.0 application and copy the Client ID and Client Secret into a text file.

      Don’t continue to the next step unless you have copied the Client ID and Client Secret. You must provide this information to SSPM during the onboarding process.
4. Ensure that SSPM can access ServiceNow tables.

   For SSPM to complete its scans, SSPM must be able to access the following tables in ServiceNow.

   • sys_plugins
   • sys_properties
   • sys_scope
   • sys_user
   • sys_user_has_role
   • sys_user_role
   • oauth_entity
   • oauth_credential
   • v_plugin
   • sys_db_object
   • pwd_reset_request

   To ensure that SSPM can access these tables, open the table definition record for each table and verify that external systems can access the table through the ServiceNow REST Table API.

   1. Navigate to the Tables page ( System Definition Tables).
   2. For each of the tables that SSPM must be able to access, complete the following steps:

      1. Locate the table record in the list of tables and click its name to open the table record. To quickly locate a table record, you can use the Search field to filter the list.
      2. In the table record, select the Application Access tab.
      3. In the table record, verify that the Allow access to this table via web services checkbox is selected. If necessary, select the Allow access to this table via web services checkbox and click Update to save your changes.

5. Connect SSPM to your ServiceNow instance.

   In SSPM, complete the following steps to enable SSPM to connect to your ServiceNow instance.

   1. Log in to Strata Cloud Manager.
   2. Select ConfigurationSaaS SecurityPosture SecurityApplicationsAdd Application and click the ServiceNow tile.
   3. On the Posture Security tab, Add New instance.
   4. OAuth 2.0.
   5. On the configuration page, enter your Instance URL and the application credentials (Client ID and Client Secret).
   6. Specify whether you're granting SSPM Read Permissions only or Read and Write Permissions.

      The option you choose depends on how you configured the authentication scope to limit access. If you configured the authentication scope to allow only the GET method, select Read Permissions. If you configured the authentication scope to allow access to all HTTP methods, select Read and Write Permissions.

      The onboarding page lists the API scopes that SSPM will access to complete scans and to perform automated remediation.
   7. Connect.

      SSPM redirects you to the ServiceNow login page.
   8. Log in using a ServiceNow administrator account.

      The account you use must be assigned to the admin role in ServiceNow. Make sure the account is not also assigned to the snc_read_only role, which will restrict the account to read-only access. If the account is restricted to read-only access, onboarding will fail.

      After onboarding is complete, you can restrict the account to read-only access. Full read and write access is required only to during onboarding and reauthentication to grant access to the requested scopes.

      ServiceNow displays a consent form.
   9. Review the consent form and Allow access to the account.
   10. If you also want to create ServiceNow tickets from SSPM, link SSPM to the ServiceNow instance. You link SSPM to ServiceNow from the Ticketing Settings page (ConfigurationSaaS SecuritySettings Workflow Ticketing Settings).