ServiceNow alerts

ServiceNow is a workflow management platform. It offers a number of security operations applications. You can configure Prisma Cloud to route alerts to ServiceNow’s Vulnerability Response application.
To integrate Prisma Cloud with ServiceNow, you’ll need to create a ServiceNow endpoint to consume findings from the Prisma Cloud scanner. The endpoint is created using ServiceNow’s Scripted REST API mechanism.
Each vulnerability found by the Prisma Cloud scanner is mapped to a ServiceNow vulnerable item. Scanner data is mapped to vulnerable items as follows:
Vulnerable items contain all CVEs reported by the Prisma Cloud scanner only if the corresponding CVEs also exist in ServiceNow’s vuln DB. If a CVE doesn’t exist in ServiceNow, the
Vulnerability (Reference)
field won’t list it.
ServiceNow vulnerablity item field
Field description
Prisma Cloud scanner data
Source
The scanner that found this vulnerable item.
Prisma Cloud Compute
Vulnerability (Reference)
ID of the vulnerability associated with this vulnerable item.
Reference to CVE ID (if exists in ServiceNow’s vulnerabilities DB)
State
This field defaults to Open, but you can change it to Under Investigation if the vulnerability is ready for immediate remediation.
Open (automatically set by ServiceNow)
Assignment group
Group selected to work on this vulnerability group.
Assignment group set in the alert profile
Assigned to
Individual from the selected assignment group that works on this vulnerability.
Assignee set in the alert profile
Created
The date this vulnerable item was created in your instance.
Creation date of the vulnerable item (automatically set by ServiceNow)
Additional comments
Any relevant information.
Vulnerabilities:
  • Image name
  • Severity
  • Package
  • Package version
  • Fix status
  • Project
  • Collections

Configuring ServiceNow

Create a ServiceNow endpoint to collect findings from the Prisma Cloud scanner.
Prerequisites:
Prisma Cloud Console is running.
  1. In ServiceNow, create a Scripted REST API. Name it
    Prisma Vulnerabilities Report
    .
    For more information, see the official documentation here.
  2. Create a new resource in your scripted REST service.
  3. In
    Name
    , enter
    report_findings
    .
  4. In
    HTTP method
    , select
    POST
    .
  5. Download the script that implements the endpoint from Prisma Cloud Console.
    1. Log into Prisma Cloud Console.
    2. Go to
      Manage > Alerts > Add Profile
      .
    3. Click
      Add Profile
      .
    4. In
      Provider
      , select
      ServiceNow
      .
    5. In
      Application
      , select
      Vulnerability Response
      .
    6. In
      Scripted REST API
      , click
      Copy
      .
    7. In ServiceNow, paste the script into
      Script
      .
  6. Click
    Submit
    to create the resource.
  7. Construct the URL for your resource (endpoint), then copy it, and set it aside. You’ll need when you configure Prisma Cloud to send findings to ServiceNow.
    The format for the base URL is: https://<SERVICENOW>/<BASE_API_PATH>
    Where:
    • SERVICENOW — URL for your ServiceNow instance.
    • BASE_API_PATH — Path to the scripted API service you just created.

Configuring alert frequency

You can configure the rate at which alerts are emitted. This is a global setting that controls the spamminess of the alert service. Alerts received during the specified period are aggregated into a single alert. For each alert profile, an alert is sent as soon as the first matching event is received. All subsequent alerts are sent once per period.
  1. Open Console, and go to
    Manage > Alerts
    .
  2. In
    Aggregate audits every
    , specify the maximum rate that alerts should be sent.
    You can specify
    Second
    ,
    Minute
    ,
    Hour
    ,
    Day
    .

Sending findings to ServiceNow

Alert profiles specify which events trigger the alert machinery, and to which channel alerts are sent. You can send alerts to any combination of channels by creating multiple alert profiles.
Alert profiles consist of two parts:
(1) Alert settings — Who should get the alerts, and on what channel?
Configure Prisma Cloud to integrate with ServiceNow and specify the people or places where alerts should be sent. You can specify assignees and assignment groups.
(2) Alert triggers — Which events should trigger an alert to be sent?
Specify which of the rules that make up your overall policy should trigger alerts. For the Vulnerability Response application, you can send vulnerability and compliance alerts only.

Create new alert profile

Create a new alert profile.
  1. In
    Manage > Alerts
    , click
    Add profile
    .
  2. Enter a name for your alert profile.
  3. In
    Provider
    , select
    ServiceNow
    .

Configure the channel

Configure Prisma Cloud to send alerts to ServiceNow, then validate the setup by sending a test alert.
Prerequisites:
You’ve created a service account in ServiceNow with a base role of web_service_admin.
  1. In
    Application
    , select
    Vulnerability Response
    .
  2. In
    Scripted API URL
    , enter the url of the vulnerabilities reporting api defined in ServiceNow (see ServiceNow config above). e.g. https://ven03718.service-now.com/api/paan/prisma_vulnerabilities_report
  3. In
    Credential
    , click
    Add New
    .
    1. In
      Type
      , select
      Basic authentication
      .
      This is currently the only auth method supported.
    2. Enter a username and password.
  4. (Optional) In
    Assignee
    , enter the name of a user in ServiceNow that will be assigned the Vulnerable Items.
    The assignee name isn’t case-sensitive.
  5. (Optional) In
    Assignment Group
    , enter the name of a group in ServiceNow that will be assigned the Vulnerable Items.
  6. (Optional) In
    CA certificate
    , enter a CA certificate in PEM format. Relevant only for on-premises deployments of ServiceNow.
  7. Click
    Send Test Alert
    . If everything looks good, and you get an alert in ServiceNow, save the profile.

Configure the triggers

Configure how the alert is triggered.
  1. Under
    Alert Types
    , check the boxes types of events that should trigger an alert.
  2. For additional configuration options, click
    Edit
    .
  3. To specify specific rules that should trigger an alert, deselect
    All rules
    , and then select any individual rules.
  4. Click
    Save
    .

Map Vulnerable Items to Configuration Items (optional)

Adjust your Scripted REST API to map each vulnerable item to its configuration item (CI) in ServiceNow’s CMDB.
  1. Create a Discovery Source in ServiceNow for Prisma Cloud Compute:
    1. Navigate to
      System Definition > Fix Script
      .
    2. Click
      New
      .
    3. Name your Fix Script appropriately.
    4. Ensure
      Run once
      is selected .
    5. Execute the following code with the appropriate value for your Discovery Source name: “SG-PrismaCloudCompute”.
      Source var dsUtil = new global.CMDBDataSourceUtil(); dsUtil.addDataSource("SG-PrismaCloudCompute");
      Code copied to clipboard
      Unable to copy due to lack of browser support.
    6. Your fix script should look like this:
    7. Ensure your discovery source has fewer than 40 characters.
    8. After you have saved your fix script, navigate to it again and click
      Run Fix Script
      .
  2. Create an Identification Rule in ServiceNow:
    1. Navigate to
      Configuration > CI Class Manager
      .
    2. In the CI Classes hierarchy, choose
      Docker Image
      .
    3. Navigate to
      Class Info > Identification Rule
      .
    4. Add an identification rule to identify the image by the
      Image id
      attribute.
  3. Use the enhanced script in place of the standard script you copy from Console when setting up the Scripted REST API.

Suggested script

The following script maps vulnerable items to configuration items. Use it in place of the script you copy from Console when setting up the Scripted REST API in Configuring ServiceNow. To use the script, you must first set up a discovery source and identification rule.
The script in this section extends the standard script to:
  • Implement CI mapping — Finds the relevant CI (from type docker image), or creates one if it doesn’t exist, and references it in the Vulnerable Item.
  • Create a vulnerability placeholder — Creates an empty vulnerability in ServiceNow’s vulnerabilities DB when the CVE ID sent by Prisma Cloud Compute can’t be found in ServiceNow.
The following listing shows the script in its entirety. Copy and use this listing when setting up the vulnerable item to configuration item mapping.
(function process( /*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) { var vulnerabilities = request.body.data.vulnerabilities; response.setContentType('application/JSON'); var writer = response.getStreamWriter(); for (var i in vulnerabilities) { var vulnItemRecord = new GlideRecord('sn_vul_vulnerable_item'); var vulnEntryRecord = new GlideRecord('sn_vul_entry'); var userGroupsRecord = new GlideRecord('sys_user_group'); var vulnerability = vulnerabilities[i]; // the id field is the name (a string) of the cve if (!vulnEntryRecord.get('id', vulnerability.cve)) { // The following code inserts the placeholder vulnerability in sn_vul_nvd_entry. The other attributes will be filled once the NVD import run's var nvd_entry = new GlideRecord("sn_vul_nvd_entry"); nvd_entry.initialize(); nvd_entry.setValue("id", vulnerability.cve); var vulEntry = nvd_entry.insert(); vulnEntryRecord = new GlideRecord('sn_vul_entry'); vulnEntryRecord.get(vulEntry); } if (!userGroupsRecord.get('name', vulnerability.assignment_group)) { userGroupsRecord.sys_id = ""; } vulnItemRecord.initialize(); // The following block of code is to create a CI using IRE if (vulnerability.imageName && vulnerability.imageID) { // Step 1: construct the payload // Step 2: Encode the payload as JSON // Step 3: create CI using createOrUpdateCIEnhanced API. This API requires discovery source that needs to be created var payload = { "items": [{ "className": "cmdb_ci_docker_image", // update the cmdb unmatched class name here "values": { "image_id": vulnerability.imageID, // update the correct values that needs to be populated and any additional fields "name": vulnerability.imageName }, "sys_object_source_info": { // optional, used to optimize the fetch to get CIs from this specific source only "source_native_key": vulnerability.imageID, // unique key/id for the item from the source "source_name": "SG-PrismaCloudCompute" // The discovery source of the CI information } }] }; var inputPayload = new JSON().encode(payload); var cmdb = SNC.IdentificationEngineScriptableApi.createOrUpdateCI("SG-PrismaCloudCompute",inputPayload); // CMDB discovery source name var output = JSON.parse(cmdb); vulnItemRecord.cmdb_ci.setDisplayValue(output.items[0].sysId); // This will assign CMDB_ci item to vuln item. } else if (vulnerability.imageName != "Prisma Test Alert") { gs.log("missing image name or image id"); } vulnItemRecord.Description = vulnerability.description; vulnItemRecord.assigned_to = vulnerability.assigned_to; // sys_id is the unique id of a record (like an internal service now GUID), used to link records in different tables vulnItemRecord.assignment_group.setDisplayValue(userGroupsRecord.sys_id); vulnItemRecord.source = vulnerability.source; vulnItemRecord.vulnerability.setDisplayValue(vulnEntryRecord.sys_id); vulnItemRecord.comments.setJournalEntry(vulnerability.comments); vulnItemRecord.insert(); vulnItemRecord.query(); writer.writeString(JSON.stringify(vulnItemRecord)); } response.setStatus(201); })(request, response);
Code copied to clipboard
Unable to copy due to lack of browser support.
The following excerpt shows the part of the listing that implements the CI mapping:
// The following block of code is to create a CI using IRE if (vulnerability.imageName && vulnerability.imageID) { // Step 1: construct the payload // Step 2: Encode the payload as JSON // Step 3: create CI using createOrUpdateCIEnhanced API. This API requires discovery source that needs to be created var payload = { "items": [{ "className": "cmdb_ci_docker_image", // update the cmdb unmatched class name here "values": { "image_id": vulnerability.imageID, // update the correct values that needs to be populated and any additional fields "name": vulnerability.imageName }, "sys_object_source_info": { // optional, used to optimize the fetch to get CIs from this specific source only "source_native_key": vulnerability.imageID, // unique key/id for the item from the source "source_name": "SG-PrismaCloudCompute" // The discovery source of the CI information } }] }; var inputPayload = new JSON().encode(payload); var cmdb = SNC.IdentificationEngineScriptableApi.createOrUpdateCI("SG-PrismaCloudCompute",inputPayload); // CMDB discovery source name var output = JSON.parse(cmdb); vulnItemRecord.cmdb_ci.setDisplayValue(output.items[0].sysId); // This will assign CMDB_ci item to vuln item. } else if (vulnerability.imageName != "Prisma Test Alert") { gs.log("missing image name or image id"); }
Code copied to clipboard
Unable to copy due to lack of browser support.
The following excerpt shows the part of the listing that creates the vulnerability placeholder:
if (!vulnEntryRecord.get('id', vulnerability.cve)) { // The following code inserts the placeholder vulnerability in sn_vul_nvd_entry. The other attributes will be filled once the NVD import run's var nvd_entry = new GlideRecord("sn_vul_nvd_entry"); nvd_entry.initialize(); nvd_entry.setValue("id", vulnerability.cve); var vulEntry = nvd_entry.insert(); vulnEntryRecord = new GlideRecord('sn_vul_entry'); vulnEntryRecord.get(vulEntry); }
Code copied to clipboard
Unable to copy due to lack of browser support.

Recommended For You