ServiceNow

Purpose

TrustCloud integrates with ServiceNow in the following ways:

1. TrustCloud can retrieve ServiceNow tickets as evidence for controls.
2. Tasks in TrustCloud can be pushed to ServiceNow and bi-directionally tracked to automate workflows such as gap remediation, risk treatment, and periodic evidence collection.
3. TrustCloud can retrieve asset inventories from ServiceNow CMDB for continuous control and asset monitoring.

The following sections describe how you can set up your TrustCloud integration with ServiceNow and enable each of these workflows.

Instructions to grant TrustCloud limited access to ServiceNow

Setting up a connection to ServiceNow involves a number of steps, and our detailed guide will give you everything you need to successfully setup your connection.

1. Choose a name for the connection
2. Login to your ServiceNow instance account as a user who has access to your System OAuth->Application Registry page
   
3. Open the System OAuth->Application Registry page and click the New button, then select the Create an OAuth API endpoint for external clients option to create a new OAuth Client.
   
4. On the create form, fill the name, ex. TrustCloud and set the Redirect URL to https://app.trustcloud.ai/trustcloud/integrations, then click Submit.
   
5. From the Application Registries page OAuth app list, click on the newly created OAuth Client to load the details page. Copy and save your newly created OAuth client application credentials, Client ID and Client Secret.
   
6. In the Refresh Token Lifespan and Access Token Lifespan fields, enter the value 8H (28 800) seconds. To specify the optimal expiration date for tokens.
   
7. Enter your organization’s ServiceNow instance URL
8. Enter the created OAuth client application Client ID
9. Enter the created OAuth client application, Client Secret

Data feeds

TrustCloud’s Hybrid Data Fabric can pull data from various SNOW workflows to help automate common controls. This will be dependent on your business processes, documentation and technical controls that rely on SNOW workflows for implementation. To meet such objectives, we can create deeper integrations to pull an inventory mapped to necessary workflows. Below is a sample of control testing that TrustCloud enables with SNOW:

1. Vulnerability Scanning & Remediation

To automate the continuous monitoring of above control, TrustCloud pulls the following types of data feeds from SNOW:

1. Servers
2. Incidents
3. Databases
4. Computers
5. Business Applications
6. Application Services

Sample of read-only data elements we pull from SNOW data feeds.

Read only: Servers
   - sys_ID
   - ParentCID
   - CIID
   - name
   - ipv4

Read only: Incidents
   - sys_ID
   - u_ci_id
   - CMDB_ci_business_app
   - Severity
   - priority
   - opened_at

Read only: Databases
   - u_ci_id
   - sys_id
   - name
   - fqdn
   - parent_sys_id
   - parent_sys_class_name
   - parent_name

Read only: Computers
   - u_ci_id
   - sys_id
   - name
   - u_vendor_name
   - model_name
   - serial_number
   - asset_tag

Read only: Business Applications
   - sys_id
   - u_ci_id
   - name
   - short_description
   - CIID
   - attested
   - attestation_date
   - attestation_status

Read only: Application Services
   - sys_id
   - ParentCIID
   - CIID
   - environment
   - name
   - type
   - short_description
   - parent name

Link ServiceNow issue as evidence

Issues in ServiceNow can be used to store & maintain compliance artifacts. TrustCloud can directly consume a ServiceNow issue & attach it as evidence for control(s). This can be done by providing a link to the issue in the evidence section for a test. TrustCloud will then automatically pull all the required fields from the issue & attach it as evidence.

Attaching a service now issue as evidence

1. Navigate to the issue in ServiceNow which is being used to store/maintain compliance artifacts. Copy the URL by clicking the additional options & selecting “Copy URL”.
2. Navigate to the test for which you want to associate the ServiceNow issue.
3. Select the “Project Management tool” option & provide the copied servicenow issue url.
4. Click on “Add Evidence”. TrustCloud will then fetch the required info from the ticket & store it as evidence for the test.

Attaching a service now issue as evidence

1. Navigate to the issue in ServiceNow which is being used to store/maintain compliance artifacts. Copy the URL by clicking the additional options & selecting “Copy URL”.
2. Navigate to the test for which you want to associate the ServiceNow issue.
3. Select the “Project Management tool” option & provide the copied servicenow issue url.
4. Click on “Add Evidence”. TrustCloud will then fetch the required info from the ticket & store it as evidence for the test.

Link Tasks to ServiceNow issues

Tasks in TrustCloud can also be linked directly into ServiceNow. In order to get started, make sure that you have properly configured your ServiceNow integration via the integrations page.

Creating an issue in ServiceNow for a TrustOps task

Tasks in TrustCloud can be linked to ServiceNow in two ways. The first is manual ticket creation, and the other is automatic ticket creation.

Automatic Ticket Creation

Ticket creation with ServiceNow can be fully automated with TrustOps. Any user can choose to create all their tasks automatically in ServiceNow. To create an issue in ServiceNow automatically, you need to change a few settings. Once this setting is enabled, any task that is assigned to a particular user will be created in ServiceNow.

To enable automatic ticket creation:

1. Navigate to the “Admin” tab in the left-hand side menu in TrustCloud.
2. Select “Connected Apps”.
3. Navigate to the Task Management section to configure automatically creating tickets in ServiceNow for selected projects.
4. Click on the “Configure” button.
5. Select Project, Issue Type, Reporter and Assignee.
6. Click on “Complete”. Now, if any task is assigned to you, it will be automatically created in ServiceNow.

Manual Ticket Creation

Tickets can be created manually in ServiceNow via the standard task flow. To create a ticket manually:

1. Navigate to any of the tasks in TrustOps & click on the “Create Issue with ServiceNow” button.
2. Enter all the key details, such as Project, Issue Type, Reporter, Assignee, Summary, and Description.
3. Click on the “Create Issue” button.
4. You can check the “Tickets” tab of the task to see the tickets linked to that particular task. It shows the current Status, Assignee, and Priority level. As the TrustOps-ServiceNow integration is bi-directional, changes made to the issue in ServiceNow will be reflected in the corresponding TrustOps task.
5. You can also unlink the task directly from this page by clicking on the “Unlink” button.

ServiceNow CMDB Data feeds

The ServiceNow integration will automate data feed generation for CMDB assets. The data feeds currently automated by the integration are –

1. Application Services
2. Business Applications
3. Computers
4. Databases
5. Incidents
6. Servers

Data feeds from the CMDB are automatically computed when an integration with ServiceNow is configured. These data feeds can be used to identify applications, assets, and data and map them to the control graph, so that you can monitor control effectiveness, security tool coverage, and measure the operational status of your IT environment.
Data feeds from ServiceNow can also be used to provide evidence for controls for regulatory compliance.

Once the integration has been setup, you’ll be able to provide ServiceNow tickets as evidence for controls in TrustCloud.