1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Alerts
    6. ServiceNow alerts
    End-of-Life (EoL)

    ServiceNow alerts

    ServiceNow is a workflow management platform. It offers a number of security operations applications. You can configure Prisma Cloud to route alerts to ServiceNow’s Vulnerability Response application.
    To integrate Prisma Cloud with ServiceNow, you’ll need to create a ServiceNow endpoint to consume findings from the Prisma Cloud scanner. The endpoint is created using ServiceNow’s Scripted REST API mechanism.
    Each vulnerability found by the Prisma Cloud scanner is mapped to a ServiceNow vulnerable item. Scanner data is mapped to vulnerable items as follows:
    Vulnerable items contain all CVEs reported by the Prisma Cloud scanner only if the corresponding CVEs also exist in ServiceNow’s vuln DB. If a CVE doesn’t exist in ServiceNow, the
    Vulnerability (Reference)
     field won’t list it.
    ServiceNow vulnerablity item field
    Field description
    Prisma Cloud scanner data
    Source
    The scanner that found this vulnerable item.
    Prisma Cloud Compute
    Vulnerability (Reference)
    ID of the vulnerability associated with this vulnerable item.
    Reference to CVE ID (if exists in ServiceNow’s vulnerabilities DB)
    State
    This field defaults to Open, but you can change it to Under Investigation if the vulnerability is ready for immediate remediation.
    Open (automatically set by ServiceNow)
    Assignment group
    Group selected to work on this vulnerability group.
    Assignment group set in the alert profile
    Assigned to
    Individual from the selected assignment group that works on this vulnerability.
    Assignee set in the alert profile
    Created
    The date this vulnerable item was created in your instance.
    Creation date of the vulnerable item (automatically set by ServiceNow)
    Additional comments
    Any relevant information.
    Vulnerabilities:
    • Image name
    • Severity
    • Package
    • Package version
    • Fix status
    • Project
    • Collections

    Configuring ServiceNow

    Create a ServiceNow endpoint to collect findings from the Prisma Cloud scanner.
    Prerequisites:
     Prisma Cloud Console is running.
    1. In ServiceNow, create a Scripted REST API. Name it
      Prisma Vulnerabilities Report
      .
      For more information, see the official documentation here.
    2. Create a new resource in your scripted REST service.
    3. In
      Name
      , enter
      report_findings
      .
    4. In
      HTTP method
      , select
      POST
      .
    5. Download the script that implements the endpoint from Prisma Cloud Console.
      1. Log into Prisma Cloud Console.
      2. Go to
        Manage > Alerts > Add Profile
        .
      3. Click
        Add Profile
        .
      4. In
        Provider
        , select
        ServiceNow
        .
      5. In
        Application
        , select
        Vulnerability Response
        .
      6. In
        Scripted REST API
        , click
        Copy
        .
      7. In ServiceNow, paste the script into
        Script
        .
    6. Click
      Submit
       to create the resource.
    7. Construct the URL for your resource (endpoint), then copy it, and set it aside. You’ll need when you configure Prisma Cloud to send findings to ServiceNow.
      The format for the base URL is: https://<SERVICENOW>/<BASE_API_PATH>
      Where:
      • SERVICENOW — URL for your ServiceNow instance.
      • BASE_API_PATH — Path to the scripted API service you just created.

    Configuring alert frequency

    You can configure the rate at which alerts are emitted. This is a global setting that controls the spamminess of the alert service. Alerts received during the specified period are aggregated into a single alert. For each alert profile, an alert is sent as soon as the first matching event is received. All subsequent alerts are sent once per period.
    1. Open Console, and go to
      Manage > Alerts
      .
    2. In
      Aggregate audits every
      , specify the maximum rate that alerts should be sent.
      You can specify
      Second
      ,
      Minute
      ,
      Hour
      ,
      Day
      .

    Sending findings to ServiceNow

    Alert profiles specify which events trigger the alert machinery, and to which channel alerts are sent. You can send alerts to any combination of channels by creating multiple alert profiles.
    Alert profiles consist of two parts:
    (1) Alert settings — Who should get the alerts, and on what channel?
     Configure Prisma Cloud to integrate with ServiceNow and specify the people or places where alerts should be sent. You can specify assignees and assignment groups.
    (2) Alert triggers — Which events should trigger an alert to be sent?
     Specify which of the rules that make up your overall policy should trigger alerts. For the Vulnerability Response application, you can send vulnerability and compliance alerts only.

    Create new alert profile

    Create a new alert profile.
    1. In
      Manage > Alerts
      , click
      Add profile
      .
    2. Enter a name for your alert profile.
    3. In
      Provider
      , select
      ServiceNow
      .

    Configure the channel

    Configure Prisma Cloud to send alerts to ServiceNow, then validate the setup by sending a test alert.
    Prerequisites:
     You’ve created a service account in ServiceNow with a base role of web_service_admin.
    1. In
      Application
      , select
      Vulnerability Response
      .
    2. In
      Scripted API URL
      , enter the url of the vulnerabilities reporting api defined in ServiceNow (see ServiceNow config above). e.g. https://ven03718.service-now.com/api/paan/prism