End-of-Life (EoL)

ServiceNow alerts

ServiceNow is a workflow management platform. It offers a number of security operations applications. You can configure Prisma Cloud to route alerts to ServiceNow’s Vulnerability Response application.
To integrate Prisma Cloud with ServiceNow, you’ll need to create a ServiceNow endpoint to consume findings from the Prisma Cloud scanner. The endpoint is created using ServiceNow’s Scripted REST API mechanism.
Each vulnerability found by the Prisma Cloud scanner is mapped to a ServiceNow vulnerable item. Scanner data is mapped to vulnerable items as follows:
Vulnerable items contain all CVEs reported by the Prisma Cloud scanner only if the corresponding CVEs also exist in ServiceNow’s vuln DB. If a CVE doesn’t exist in ServiceNow, the
Vulnerability (Reference)
field won’t list it.
ServiceNow vulnerablity item field
Field description
Prisma Cloud scanner data
The scanner that found this vulnerable item.
Prisma Cloud Compute
Vulnerability (Reference)
ID of the vulnerability associated with this vulnerable item.
Reference to CVE ID (if exists in ServiceNow’s vulnerabilities DB)
This field defaults to Open, but you can change it to Under Investigation if the vulnerability is ready for immediate remediation.
Open (automatically set by ServiceNow)
Assignment group
Group selected to work on this vulnerability group.
Assignment group set in the alert profile
Assigned to
Individual from the selected assignment group that works on this vulnerability.
Assignee set in the alert profile
The date this vulnerable item was created in your instance.
Creation date of the vulnerable item (automatically set by ServiceNow)
Additional comments
Any relevant information.
  • Image name
  • Severity
  • Package
  • Package version
  • Fix status
  • Project
  • Collections

Configuring ServiceNow

Create a ServiceNow endpoint to collect findings from the Prisma Cloud scanner.
Prisma Cloud Console is running.
  1. In ServiceNow, create a Scripted REST API. Name it
    Prisma Vulnerabilities Report
    For more information, see the official documentation here.
  2. Create a new resource in your scripted REST service.
  3. In
    , enter
  4. In
    HTTP method
    , select
  5. Download the script that implements the endpoint from Prisma Cloud Console.
    1. Log into Prisma Cloud Console.
    2. Go to
      Manage > Alerts > Add Profile
    3. Click
      Add Profile
    4. In
      , select
    5. In
      , select
      Vulnerability Response
    6. In
      Scripted REST API
      , click
    7. In ServiceNow, paste the script into
  6. Click
    to create the resource.
  7. Construct the URL for your resource (endpoint), then copy it, and set it aside. You’ll need when you configure Prisma Cloud to send findings to ServiceNow.
    The format for the base URL is: https://<SERVICENOW>/<BASE_API_PATH>
    • SERVICENOW — URL for your ServiceNow instance.
    • BASE_API_PATH — Path to the scripted API service you just created.

Configuring alert frequency

You can configure the rate at which alerts are emitted. This is a global setting that controls the spamminess of the alert service. Alerts received during the specified period are aggregated into a single alert. For each alert profile, an alert is sent as soon as the first matching event is received. All subsequent alerts are sent once per period.
  1. Open Console, and go to
    Manage > Alerts
  2. In
    Aggregate audits every
    , specify the maximum rate that alerts should be sent.
    You can specify

Sending findings to ServiceNow

Alert profiles specify which events trigger the alert machinery, and to which channel alerts are sent. You can send alerts to any combination of channels by creating multiple alert profiles.
Alert profiles consist of two parts:
(1) Alert settings — Who should get the alerts, and on what channel?
Configure Prisma Cloud to integrate with ServiceNow and specify the people or places where alerts should be sent. You can specify assignees and assignment groups.
(2) Alert triggers — Which events should trigger an alert to be sent?
Specify which of the rules that make up your overall policy should trigger alerts. For the Vulnerability Response application, you can send vulnerability and compliance alerts only.

Create new alert profile

Create a new alert profile.
  1. In
    Manage > Alerts
    , click
    Add profile
  2. Enter a name for your alert profile.
  3. In
    , select

Configure the channel

Configure Prisma Cloud to send alerts to ServiceNow, then validate the setup by sending a test alert.
You’ve created a service account in ServiceNow with a base role of web_service_admin.
  1. In
    , select
    Vulnerability Response
  2. In
    Scripted API URL
    , enter the url of the vulnerabilities reporting api defined in ServiceNow (see ServiceNow config above). e.g. https://ven03718.service-now.com/api/paan/prisma_vulnerabilities_report
  3. In
    , click
    Add New
    1. In
      , select
      Basic authentication
      This is currently the only auth method supported.
    2. Enter a username and password.
  4. (Optional) In
    , enter the name of a user in ServiceNow that will be assigned the Vulnerable Items.
    The assignee name isn’t case-sensitive.
  5. (Optional) In
    Assignment Group
    , enter the name of a group in ServiceNow that will be assigned the Vulnerable Items.
  6. (Optional) In
    CA certificate
    , enter a CA certificate in PEM format. Relevant only for on-premises deployments of ServiceNow.
  7. Click
    Send Test Alert
    . If everything looks good, and you get an alert in ServiceNow, save the profile.

Configure the triggers

Configure how the alert is triggered.
  1. Under
    Alert Types
    , check the boxes types of events that should trigger an alert.
  2. For additional configuration options, click
  3. To specify specific rules that should trigger an alert, deselect
    All rules
    , and then select any individual rules.
  4. Click

Recommended For You