ServiceNow vulnerability

ServiceNow Vulnerability Response is a module within the ServiceNow platform that helps organizations manage the lifecycle of vulnerabilities, including identification, prioritization, remediation, and verification.

ServiceNow Configuration

The scope is a mechanism to let an application request limited access to a user’s data. ServiceNow platform supports authentication scopes to allow admins to limit access of an OAuth client application to a specific REST API. 

Prerequisite Role required:  choose the admin role for Create an OAuth API endpoint for external clients.

Navigate to System OAuth > Application Registry and then click New. On the "interceptor" page, click Create an OAuth API endpoint for external clients and then fill in the form.

For OAuth, the 'grant type' will be Password credentials, the 'scope' will be useraccount and the 'token URL' will be https://instance.service-now.com/oauth_token.do.

Create User

We will need to create a user for API access. The prerequisite Role required to create user is “user_admin”.

To create user

• Navigate to All > User Administration > Users.

• Select New

• Set the following fields:

• Time Zone set to “UTC”. This will provide a UTC date in API response

• Date format should be “System(yyyy-MM-dd)”.

• Active checkbox. Ensure this is selected.

• Locked out. Ensure checkbox this is NOT selected.

  • These settings are needed so that the access token for OAuth will be generated

• Web service access only. Ensure this checkbox is selected

• Navigate to the Roles tab below and click Edit to assign role to the user

  

• Search for the sn_vul.read_all role and assign it to the user. This is needed to get the CMDB data

DataBee Configuration

• Log into the DataBee console and navigate to the Data tab. Click Add New Data Source

  

• Search and select ServiceNow CMDB

  

• Click on API Ingest button

  

• In the contact information, dialog boxes enter a name for the datasource and owner information

• In the configuration dialog box, enter the following:

  • Authorization Method: OAuth2

  • Username / Password: Enter the API username/password created earlier.

  • Client Secret: Paste the Client Secret generated earlier

  • Client Key: Paste the Client ID generated earlier

  • Auth URL: https://<instance>.service-now.com/oauth_token.do

  • API URL:  

  • https://<instance>.service-now.com/api/now/table/cmdb_ci

  • https://<instance>.service-now.com/api/now/cmdb/instance/<sys_class_name>/<sys_id>

  • Replace <instance> with your actual instance ID.

  

• Click Submit