--- title: "ServiceNow Security Incident Response (SIR)" slug: "servicenow-sir" updated: 2025-10-15T10:02:57Z published: 2025-10-15T10:02:57Z canonical: "docs.databee.buzz/servicenow-sir" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # ServiceNow Security Incident Response (SIR) ServiceNow Security Incident Response application tracks the progress of security incidents from discovery and initial analysis, through containment, eradication, and recovery, and into the final post incident review, knowledge base article creation, and closure. For detailed information refer to the [ServiceNow’s official documentation](https://www.servicenow.com/docs/bundle/yokohama-security-management/page/product/security-incident-response/reference/sir-landing-page.html). **Integration Method:** API **Tables**: Incident Finding (2005), Ticket Inventory (99405001) This integration supports the following events. | **Event** | **Description** | | --- | --- | | Incidents | Retrieves data for all incident details | | Response Tasks | Retrieves data for all task details | This integration supports the following versions. | ServiceNow Version Tested | ServiceNow Yokohama | | --- | --- | | ServiceNow API version | v2.0 | ## Prerequisites - ServiceNow **Admin** privileges to create an OAuth API endpoint for external clients. - Access to the DataBee console. ## Configuration Overview 1. Generate API credentials on the ServiceNow console with the required user roles. 1. [Create OAuth client application](/user-manual/docs/servicenow-sir#create-oauth-client-application) 2. [Create user](/user-manual/docs/servicenow-sir#create-user) 3. [Assign roles to user](/user-manual/docs/servicenow-sir#assign-roles-to-user) 2. Add the [ServiceNow SIR Data Feed](/user-manual/docs/servicenow-sir#databee-configuration) integration in the DataBee console with the required API credentials. | **DataBee Parameter** | **ServiceNow Parameter** | | --- | --- | | Client Key | Client ID | | Client Secret | Client Secret | | Username | User ID | | Password | Password | | Token URL: | ServiceNow Instance | | API URL : | ServiceNow Instance | ## ServiceNow Configuration The scope is a mechanism to limit application access to ServiceNow data. ServiceNow platform supports authentication scopes to allow admins to limit access of an OAuth client application to a specific REST API. ### Create OAuth client application 1. Get the ServiceNow **instance** from the URL as highlighted below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-3c52z8j0.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 2. Navigate to **All**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-8p4734my.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 1. In the search bar, enter **System OAuth**. 2. Navigate to **System OAuth** > **Application Registry**. 3. Click on the **New** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-hd8lyrft.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 4. Click the **Create an OAuth API endpoint for external clients**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-kufk829u.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 5. Fill in the required details in the form: - **Name**: Enter a unique name for OAuth client application. - **Client ID**: Automatically generated by the ServiceNow OAuth server. - **Client Secret**: Enter Client secret for the Oauth application or leave empty for auto generation. 6. Copy the **Client ID** for later use. 7. Click on the **Submit** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-t0059bvn.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 8. Select the Application created in the previous step from the **Application Registries** table. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-scd7i8mr.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 9. Click on **Lock** icon and save the **Client Secret** for later use. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-1sac8eew.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) | **Name** | **Unique Name that identifies the application** | | --- | --- | | Client ID | This will be auto generated by the instance: To be provided to DataBee. | | Client Secret | This will be auto generated by the instance Or Can Entered: To be provided to DataBee. | | Refresh Token Lifespan | 8,640,000 seconds (100 days) & can be increased | | Access Token Lifespan | 1800 seconds (30 Minutes) & can be increased | ### Create User 1. Navigate to **All**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-26dau10z.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 1. In the search bar, enter **User Administration**. 2. Navigate to **User Administration** > **Users**. 2. Click on the **New** button. The “Create User” form window will appear. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-4pw1u0h1.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 3. Fill in the required fields to create a user: The user must be active and not locked out to allow the instance to generate an access token for OAuth. > [!NOTE] > **Note:** > > Copy the **User ID** for later use. - **User ID**: Enter a unique username. - **First Name**: Enter the user's first name. - **Last Name**: Enter the user's last name. - **Time Zone**: Set to **GMT/UTC** to ensure the API response includes GMT/UTC dates. - **Date Format**: Set to **System (yyyy-MM-dd)**. - **Active**: Ensure the checkbox is selected. - **Locked Out**: Ensure the checkbox is **not** selected. 4. Click the **Submit** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-tw6ebc84.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 5. Search for the **User ID** created in the previous step and click on it. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-2suvoesd.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 6. Click on the **Set Password** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-lrqh1a5k.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 7. Click on the **Generate** button and copy the **password** for later use. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-xactsas2.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 1. Click on the **Save Password** button. 2. Click on the **Close** button. ### Assign roles to user 1. Go to **Roles** tab and click on **Edit** to assign roles to user. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-v6ilvuvo.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 2. In the search bar: 1. Enter **admin** or **“sn_si.read**” and click **Add**. 2. Click the **Save** button. **NOTE**: When choosing the sn_si.read role, the created user must be an allowed member to fetch an incident record. Additionally, selecting this role will result in the following missing fields in the API response | Event Type | Missing Fields with sn_si.read role | | --- | --- | | Incidents | allowed_groups, allowed_members, approval_set, comments_and_work_notes, delivery_plan, delivery_task, enforce restriction, template, work_notes_list | | Response Tasks | approval_set, comments_and_work_notes, delivery_plan, delivery_task, work_notes_list | 1. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-y9n8ho25.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) ## DataBee Configuration 1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-wkk4wywl.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 2. Search for **ServiceNow SIR** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-g7jz9ykc.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 3. Click on the **API Ingest** option for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-j1byq6za.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-nn09pqi5.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 5. In the configuration page, confirm the following: - **Authorization Method**: OAuth2 - **API Base URL**: Replace **** with your ServiceNow Instance. - **Username:** Paste the User ID. - **Password**: Paste the Password. - **Client Key:** Paste the Client ID generated earlier in the ServiceNow Platform. - **Client Secret**: Paste the Client Secret generated earlier in the ServiceNow Platform. - **Token URL**: Replace **** with your ServiceNow Instance. - **Event Types**: Preselected for all the event types that integration pulls. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/servicenow-sir-image-oxtyeqmz.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A07Z&se=2026-10-30T12%3A38%3A07Z&sr=c&sp=r&sig=AM5%2F54PjXevDlIS1PCMusEch7Xcz9n9nYM7UcSNVtbY%3D) 6. Click **Submit**. # Troubleshooting Tips - Ensure the client key, client secret, instance, username and password are pasted correctly. Since you cannot view the client key and secret after the 1st time, re-create the creds, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed. - Make sure the required user role is assigned. #