1. Overview

ServiceNow is a workflow management platform. It offers a number of security operations applications. You can configure Prisma Cloud to route alerts to ServiceNow’s Vulnerability Response application.

To integrate Prisma Cloud with ServiceNow, you’ll need to create a ServiceNow endpoint to consume findings from the Prisma Cloud scanner. The endpoint is created using ServiceNow’s Scripted REST API mechanism.

Each vulnerability found by the Prisma Cloud scanner is mapped to a ServiceNow vulnerable item. Scanner data is mapped to vulnerable items as follows:

Vulnerable items contain all CVEs reported by the Prisma Cloud scanner only if the corresponding CVEs also exist in ServiceNow’s vuln DB. If a CVE doesn’t exist in ServiceNow, the Vulnerability (Reference) field won’t list it.
ServiceNow vulnerablity item field Field description Prisma Cloud scanner data

Source

The scanner that found this vulnerable item.

Prisma Cloud Compute

Vulnerability (Reference)

ID of the vulnerability associated with this vulnerable item.

Reference to CVE ID (if exists in ServiceNow’s vulnerabilities DB)

State

This field defaults to Open, but you can change it to Under Investigation if the vulnerability is ready for immediate remediation.

Open (automatically set by ServiceNow)

Assignment group

Group selected to work on this vulnerability group.

Assignment group set in the alert profile

Assigned to

Individual from the selected assignment group that works on this vulnerability.

Assignee set in the alert profile

Created

The date this vulnerable item was created in your instance.

Creation date of the vulnerable item (automatically set by ServiceNow)

Additional comments

Any relevant information.

Vulnerabilities:

  • Image name

  • Severity

  • Package

  • Package version

  • Fix status

  • Project

  • Collections

2. Configuring ServiceNow

Create a ServiceNow endpoint to collect findings from the Prisma Cloud scanner.

Prerequisites: Prisma Cloud Console is running.

  1. In ServiceNow, create a Scripted REST API. Name it Prisma Vulnerabilities Report.

    For more information, see the official documentation here.

  2. Create a new resource in your scripted REST service.

    alerts servicenow new resource
  3. In Name, enter report_findings.

  4. In HTTP method, select POST.

  5. Download the script that implements the endpoint from Prisma Cloud Console.

    1. Log into Prisma Cloud Console.

    2. Go to Manage > Alerts > Add Profile.

    3. Click Add Profile.

    4. In Provider, select ServiceNow.

    5. In Application, select Vulnerability Response.

    6. In Scripted REST API, click Copy.

    7. In ServiceNow, paste the script into Script.

  6. Click Submit to create the resource.

  7. Construct the URL for your resource (endpoint), then copy it, and set it aside. You’ll need when you configure Prisma Cloud to send findings to ServiceNow.

    The format for the base URL is: https://<SERVICENOW>/<BASE_API_PATH>

    For example: https://ena03291.service-now.com/api/paan/prisma_vulnerabilities_report

    Where:

    • SERVICENOW — URL for your ServiceNow instance.

    • BASE_API_PATH — Path to the scripted API service you just created.

      alerts servicenow base api path

2.1. Configuring alert frequency

You can configure the rate at which alerts are emitted. This is a global setting that controls the spamminess of the alert service. Alerts received during the specified period are aggregated into a single alert. For each alert profile, an alert is sent as soon as the first matching event is received. All subsequent alerts are sent once per period.

  1. Open Console, and go to Manage > Alerts.

  2. In Aggregate audits every, specify the maximum rate that alerts should be sent.

    You can specify Second, Minute, Hour, Day.

    frag configure alerts

3. Sending findings to ServiceNow

Alert profiles specify which events trigger the alert machinery, and to which channel alerts are sent. You can send alerts to any combination of channels by creating multiple alert profiles.

Alert profiles consist of two parts:

(1) Alert settings — Who should get the alerts, and on what channel? Configure Prisma Cloud to integrate with ServiceNow and specify the people or places where alerts should be sent. You can specify assignees and assignment groups.

(2) Alert triggers — Which events should trigger an alert to be sent? Specify which of the rules that make up your overall policy should trigger alerts. For the Vulnerability Response application, you can send vulnerability and compliance alerts only.

servicenow vr config

4. Create new alert profile

Create a new alert profile.

  1. In Manage > Alerts, click Add profile.

  2. Enter a name for your alert profile.

  3. In Provider, select ServiceNow.

5. Configure the channel

Configure Prisma Cloud to send alerts to ServiceNow, then validate the setup by sending a test alert.

Prerequisites: You’ve created a service account in ServiceNow with a base role of web_service_admin.

  1. In Application, select Vulnerability Response.

  2. In Scripted API URL, enter the url of the vulnerabilities reporting api defined in ServiceNow (see ServiceNow config above). e.g. https://ven03718.service-now.com/api/paan/prisma_vulnerabilities_report

  3. In Credential, click Add New.

    1. In Type, select Basic authentication.

      This is currently the only auth method supported.

    2. Enter a username and password.

  4. (Optional) In Assignee, enter the name of a user in ServiceNow that will be assigned the Vulnerable Items.

    The assignee name isn’t case-sensitive.

  5. (Optional) In Assignment Group, enter the name of a group in ServiceNow that will be assigned the Vulnerable Items.

  6. (Optional) In CA certificate, enter a CA certificate in PEM format. Relevant only for on-premises deployments of ServiceNow.

  7. Click Send Test Alert. If everything looks good, and you get an alert in ServiceNow, save the profile.

5.1. Configure the triggers

Configure how the alert is triggered.

  1. Under Alert Types, check the boxes types of events that should trigger an alert.

  2. For additional configuration options, click Edit.

  3. To specify specific rules that should trigger an alert, deselect All rules, and then select any individual rules.

    frag config servicenow vr triggers
  4. Click Save.