Focus

SaaS Security

Begin Scanning a ServiceNow App

Table of Contents

Begin Scanning a ServiceNow App

Learn how to add a ServiceNow app so that Data Security can protect your assets against data exfiltration and malware propagation.

Where Can I Use This?	What Do I Need?
Strata Cloud Manager	Data Security license Or any of the following licenses that include the Data Security license: CASB-X CASB-PA

Where Can I Use This?

What Do I Need?

Strata Cloud Manager

Data Security license

Or any of the following licenses that include the Data Security license:

CASB-X
CASB-PA

To connect ServiceNow to Data Security and begin scanning files and folders, you need to:

Ensure that you have a ServiceNow account which has sufficient privileges.
Grant Data Security access to ServiceNow.
Add the ServiceNow app to Data Security, providing Data Security information about your ServiceNow.

When you upgrade ServiceNow to a different version, you have to reauthenticate to resume scanning.

Support for automated remediation capabilities varies by SaaS application.

Supported Content
Add ServiceNow App
Customize ServiceNow App
Identify Risks
Tables Scanned by DLP

Supported Content

The following table lists the supported content for the ServiceNow app.

Support For	Details
Scan Content	Tables, Attachments
Backward Scan	Yes
Forward Scan	Yes
Rescan	No
Selective Scan	No
Exposure	All
Remediation Actions	User Quarantine—No Admin Quarantine—No Change Sharing—No
Post-Remediation Actions (Actions after Admin Quarantine): You can delete, restore, or download a quarantined file after performing a remediation action (for example quarantine or incident generation).	Delete—No Restore—No Download—No
Notifications	Notify File Owner—No Notify Via Slack—Yes (applicable only if you have onboarded Slack Enterprise or Slack Pro and Business)
User Activities	Activity Monitoring—Yes Activity Alerting—Yes Folder Monitoring—N/A
Snippet Support	Yes
Known License/Version restrictions	None
Caveats/Notes	None

Add ServiceNow App

In order for Data Security to scan assets, you must consent to specific permissions during the course of adding the ServiceNow app. Without the requested permissions, Data Security can't authenticate with ServiceNow and can't scan assets, even after you successfully install the ServiceNow app.

(Recommended) Add your ServiceNow app domain as an internal domain.
Register Data Security in the ServiceNow management console.
1. Log in to the ServiceNow management console as admin.
2. Click Start Building.
3. In the Request an Instance section, choose your release (for example, Yokohama) and click Request.
  
  It may take a few moments for the instance to build. Please wait.
4. After the instance build is ready, click Open Instance.
5. Select the ServiceNow menu AllSystem OAuthApplication Registry.
6. Select NewCreate an OAuth API endpoint for external clients.
7. Enter a unique Name for Data Security.
8. If you're using the Istanbul and later releases, enter a Redirect URI or URL. The redirect you enter depends on the Data Security location:
  For North America, use:
  
  https://app.aperture.paloaltonetworks.com/auth/servicenow/callback
  
  For Europe, use:
  
  https://app.aperture-eu.paloaltonetworks.com/auth/servicenow/callback
  
  For Asia-Pacific, use:
  
  https://app.aperture-apac.paloaltonetworks.com/auth/servicenow/callback
  
  For India, use:
  
  https://app.in1.prisma-saas.paloaltonetworks.com/auth/servicenow/callback
  
  For Japan, use:
  
  https://app.jp1.prisma-saas.paloaltonetworks.com/auth/servicenow/callback
  
  For UK, use:
  
  https://app.uk2.prisma-saas.paloaltonetworks.com/auth/servicenow/callback
  
  For Australia, use:
  
  https://app.au1.prisma-saas.paloaltonetworks.com/auth/servicenow/callback
9. To ensure a secure and successful integration without resorting to Broadly Scoped settings, you should manually attach the Useraccount Auth Scope when creating the application in the ServiceNow Application Registry. Adding this specific Auth Scope grants the application the necessary privileges of the user to perform required tasks while maintaining the preferred Securely Scoped restriction. If you previously attempted to fix this by toggling existing settings, you may need to recreate the Application Registry entry from scratch to ensure the new Auth Scope is applied correctly.
  
  Useraccount provides you with all permissions that the user has. Tenants need to make sure the user has rest_service access as well. Verify the user has access to the rest_service role to allow API integration. Go to Users<user_name>Roles and verify that the rest_service role is attached.
10. Submit your changes.
Log in to Strata Cloud Manager.
Select ConfigurationSaaS SecurityData SecurityApplicationsAdd ApplicationServiceNow.
1. Log in to the ServiceNow app.
  For Istanbul and later releases, enter the ServiceNow URL (for example, https://acmecorp.service-now.com/), Client ID, and Client Secret.
  For earlier releases (Fuji, Geneva, or Helsinki) enter the ServiceNow URL (for example, https://acmecorp.service-now.com/), Client ID, and Client Secret. Also, enter the Username and Password for your ServiceNow account.
  
  You can copy the client ID and client secret from the System OAuthApplication Registry page in the ServiceNow management console.
2. Click OK.
3. Allow Data Security access to the ServiceNow account.
  
  After authentication, the new ServiceNow app is added to the list of Cloud Apps as ServiceNow n, where n represents the number of ServiceNow app instances you have connected to Data Security. The instance displays a list of available tables.
Next step: Proceed to Customize ServiceNow App.

Customize ServiceNow App

Customizations include modifying your ServiceNow app name.

(Optional) Give a descriptive name to this app instance.
1. Select Settings and select the ServiceNow instance listed.
2. Enter a descriptive Name to differentiate this instance of ServiceNow from other instances.
(Recommended) Enter an Admin UserName (for example, admin@servicenow.com).
As a best practice, create a separate administrator account and use that email address for Data Security. If you opt to use an existing admin account instead of a new account, the administrator activities are not tracked on Data Security. Creating a separate account enables you to monitor events generated by ServiceNow administrators on ExploreActivities.
Click Done to save your changes.
Next step: Proceed to Identify Risks.

Identify Risks

When you add a new cloud app, then enable scanning, Data Security automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.

To start scanning the new ServiceNow app for risks, select ConfigurationSaaS SecurityData SecurityApplicationsServiceNowView Settings...Start Scanning.
Monitor the scan results.
During the discovery phase, as Data Security scans files and matches them against enabled policy rules, verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, proceed to next step to improve your results.
(Optional) Modify match criteria for existing policy rules.
(Optional) Add new policy rules.
Consider the business use of your cloud app, then identify risks unique to your enterprise. As necessary, add new:
- asset rules
- user activity rules
(Optional) Configure or edit a data pattern.
You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.

Tables Scanned by DLP

The DLP service scans the following database tables on ServiceNow. To enforce best practice, the SaaS Security web interface does not allow you to add or remove database tables from scans: SaaS administrators need to consult with the database administrator before adding or removing tables from scans. After consulting with your database administrator, contact Palo Alto Networks Customer Support to manually add or remove a table.

If ServiceNow does not expose a given database table, the DLP service can't scan it.

change_phase

change_request

change_request_imac

change_task

cmdb

incident

incident_task

kb_knowledge

kb_submission

problem

problem_task

release_phase

release_task

sc_req_item

sc_request

sc_task

sn_hr_core_beneficiary

sn_hr_core_benefit

sn_hr_core_benefit_provider

sn_hr_core_benefit_type

sn_hr_core_bonus

sn_hr_core_case

sn_hr_core_case_operations

sn_hr_core_case_payroll

sn_hr_core_case_relations

sn_hr_core_case_talent_management

sn_hr_core_case_total_rewards

sn_hr_core_case_workforce_admin

sysevent

sn_hr_core_direct_deposit

sn_hr_core_op_report

sn_hr_core_op_report_frequency

sn_hr_core_op_report_type

sn_hr_core_op_system

sn_hr_core_op_system_to_report_type

sn_hr_core_profile_bank_account

sn_hr_core_retirement_benefit

sn_hr_core_task

sn_hr_core_tuition_reimbursement

sn_si_incident

sn_si_request

sn_si_task

sysapproval_group

sys_attachment

sys_documentation

sys_user

task

ticket

Begin Scanning a Salesforce App

Begin Scanning a ShareFile App

SaaS Security Docs

Begin Scanning a ServiceNow App

SaaS Security Docs

Begin Scanning a ServiceNow App

Supported Content

Add ServiceNow App

Customize ServiceNow App

Identify Risks

Tables Scanned by DLP

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Visibility & Monitoring

Best Practices

Experts Corner