ServiceNow App for Vulnerability Response

Overview

The Nucleus ServiceNow App connector integrates directly with ServiceNow through the Nucleus Security for Vulnerability Response app. It runs directly on your ServiceNow environment and enables integration with Vulnerability Response.

Prerequisites

• Admin permission in your ServiceNow instance to install and configure the app.
• Vulnerability Response installed in ServiceNow.
• The ServiceNow App connector has been enabled for your Nucleus organization.

Connector setup

Install the Nucleus Security for Vulnerability Response app in ServiceNow

1. Navigate to the Nucleus Security for Vulnerability Response app in the ServiceNow App Store.
2. Click Get.
3. Log in with your ServiceNow ID using admin permissions.
   ### Create and configure the local integration user
4. Log in to your ServiceNow instance with admin permissions.
5. From the navigation bar on the left, under User Administration, select Users.
6. Click New.
7. In the User ID field, enter the username nucleussec.project or any custom username of your choice.
8. In the First Name field, enter any first name.
9. In the Last Name field, enter any last name.
10. Optionally, in the Title and Department fields, enter any values of your choice.
11. In the Password field, enter a password for the user and make a note of it.
12. Click Submit.
13. In the list of users, select the new user you created.
    
14. Ensure Active is selected.
15. Disable Web service access only. This setting must be disabled for the user impersonation check to pass. After that check has passed you can then choose to enable Web service access only.
16. Select the Roles tab.
17. Click Edit....
18. Ensure the user has the following non-inherited roles applied to it:
    • x_nucse_nucleus_vr.admin
    • sn_vul.vulnerability_admin
19. Click Save.
20. From the navigation bar on the left, select Nucleus Integrations.
21. Here you can choose which what integration you would like to enable, by default all integrations should be enabled.

Set up the ServiceNow App connector in Nucleus

1. Log in to your Nucleus project.
2. From the navigation bar on the left, under Project Administration, select Connector Setup.
3. Select ServiceNow App.
   
4. In the Name field, enter a name for this connector.
5. Optionally, in the Description field, enter a description for this connector.
6. In the Instance URL field, enter the URL of your ServiceNow instance. Enter the base path only (e.g., https://my-instance.service-now.com).
7. Select the preferred authentication method: Basic Auth or OAuth2.
   • Basic Auth:
     1. In the Username field, enter the username you chose when creating the user earlier enter that username instead.
     2. In the Password field, enter the password of the user you created earlier.
   • OAuth2:
     1. Log in to your ServiceNow instance admin permissions.
        1. From the navigation bar on the left, under System OAuth, select Application Registry.
        2. Click New.
        3. Click Create an OAuth API endpoint for external clients.
        4. In the Name field, enter a name.
        5. Ensure the Application is set to Nucleus Security for Vulnerability Response.
        6. Click Submit.
        7. Click on the name of the new application registry you created.
        8. Copy the Client ID.
        9. Copy the Client Secret.
     2. Return to the Nucleus app.
        1. In the Username field, enter nucleussec.project. If you chose a different username when creating the user earlier enter that username instead.
        2. In the Password field, enter the password of the user you created earlier.
        3. In the Client ID field, enter the Client ID you copied from ServiceNow.
        4. In the Client Secret field, enter Client Secret you copied from ServiceNow.
8. Click Connect To ServiceNow.
9. Click Save & Finish.

Test the configuration

The Nucleus platform requires successful communication with ServiceNow. The following steps outline how to test the connection and ensure successful configuration of the Nucleus Security for Vulnerability Response application coming in to ServiceNow and out to the Nucleus platform.

1. Log in to your Nucleus project.
2. From the navigation bar on the left, under Vulnerabilities, select Active.
3. Select a vulnerability.
4. Click Create Ticket.
5. Select the ServiceNow App connector.
6. Make sure Vulnerability Response module is selected.
7. Click Submit to ServiceNow to test the ticket creation. You should see a success message.
8. In the vulnerability, click on the Tickets tab.
9. Click the arrow on the far right side of the ticket. A side window will extend out.
10. Verify the description loads correctly.
11. In the Comment field, enter a comment.
12. Click Comment.
13. In the External ID column on the far left, click on the incident number for the ticket. The ticket will open in ServiceNow.
14. Verify the ticket is correctly listed.