Splunk Enterprise Security

Does the service now integration work as an ad hoc adaptive response?

BGrdickson
Explorer

Hi guys,

I have configured my servicenow integration with splunk and it works fine, we can create notables from any scheduled/correlation search. However, does anyone happen to know if we can use this integration to make a notable into a service now incident using an ad hoc adaptive response? It works if its configured as an alert action but we don't want every notable to go into servicenow. Our idea was that notables are tier 1 and then using this manual invocation of the adaptive response, they go into servicenow to become tier 2 events.

Does anyone know if this can be done? In this splunk dev article: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBE under the "Determine whether your action supports ad hoc invocation" it says any action that uses the SENDALERT action should support ad hoc invocation but I'm unsure how to properly check this.

Any advice would be greatly appreciated.

Thanks,

1 Solution

BGrdickson
Explorer

I don't have enough Karma points to attach files so I can't show you a screenshot to what it looks like when it works unfortunately.

I can't remember exactly how I came to this conclusion but I added the following config to alert_actions.conf on my deployer and pushed to our SHC.

[snow_incident]
param._cam = {\
"category" : ["others"],\
"task" : ["others"],\
"subject" : ["others"],\
"technology" : [{"vendor":"unknown", "product":"unknown"}],\
"supports_adhoc" : true\
}
param.state = 1
param.correlation_id = $job.sid$
param.configuration_item = splunk
param.contact_type =
param.assignment_group =
param.category =
param.subcategory =
param.account = splunk_integration
param.short_description =

All the param.* fields can be hard coded in this conf file to make the ad hoc invocation prepopulated if that's the way you want it. If you need any further help then let me know.

View solution in original post

AbhishekD
Engager

To send specific notable events from the Enterprise Security Incident Review page for investigation, an add-on called the ServiceNow Security Operations Add-on is available. This add-on allows Splunk ES analysts to create security-related incidents and events in ServiceNow. It features on-demand single ServiceNow event or incident creation from Splunk Event Scheduled Alerts, enabling the creation of both single and multiple ServiceNow events and incidents.

For Detailed integrations steps refer The reverse integration between ServiceNow and Splunk for incident management can be achieved using ... 

If this reply is helpful, karma would be appreciated 🙂.

0 Karma

BGrdickson
Explorer

I don't have enough Karma points to attach files so I can't show you a screenshot to what it looks like when it works unfortunately.

I can't remember exactly how I came to this conclusion but I added the following config to alert_actions.conf on my deployer and pushed to our SHC.

[snow_incident]
param._cam = {\
"category" : ["others"],\
"task" : ["others"],\
"subject" : ["others"],\
"technology" : [{"vendor":"unknown", "product":"unknown"}],\
"supports_adhoc" : true\
}
param.state = 1
param.correlation_id = $job.sid$
param.configuration_item = splunk
param.contact_type =
param.assignment_group =
param.category =
param.subcategory =
param.account = splunk_integration
param.short_description =

All the param.* fields can be hard coded in this conf file to make the ad hoc invocation prepopulated if that's the way you want it. If you need any further help then let me know.

rhirasin
Engager

Hi,

Can we do the same for BMC remedy add-on?

Does the BMC integration work as an ad hoc adaptive response?

 

0 Karma

burakatabay
Path Finder

My problem is same ? but ı use service manager.
I try this but, ı click the run adaptive response action on incident review page service manager not showing ?

0 Karma

xbp
New Member

Bump - I could use this integration as well .

Regex examples would be elite. If the strings or scripts required could be shared for service-now integration I'd be grateful.

0 Karma

BGrdickson
Explorer

I've got a solution to this now guys. I'll try and dig it out now.

0 Karma

aruneysoc
New Member

Hi ,
Can we know the solutions for this case

0 Karma

hettervik
Builder

Bump. I have the exact same problem.

0 Karma

BGrdickson
Explorer

I've got a solution to this now guys. I'll try and dig it out now.

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...