{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43657,"path":"security-management/cj-sir-capfmw-about.md","title":null,"bundle":null,"doc_type":null,"release":null,"body":"---\ntitle: Integrations Capabilities framework 2.0\ndescription: The new Integration Capabilities Framework 2.0 has been redesigned to enable implementation of integrations in a simple and consistent manner. This ensures a consistent experience for similar types of integrations \\(for example: observable reputation lookup\\).The Security Incident Response plugin includes all the capability flows listed in Integration Capabilities Framework 2.0, and standard high-level filters that you can enable or disable depending on your requirement.This section describes the configurations available in the new framework.This section describes how to use the new capability framework for an existing integration.Use the steps below to create a flow and call the subflow provided by the new capability framework.The Capability Executions option provides detailed information on each capability that has been executed.\nlocale: en-US\ncanonical_url: https://www.servicenow.com/docs/r/australia/security-management/cj-sir-capfmw-about.html\nrelease: australia\ntopic_type: concept\nlast_updated: \"2026-03-12\"\nreading_time_minutes: 12\nbreadcrumb: [Security Operations Integration Reference, Security Operations common functionality, Security Operations]\n---\n\n# Integrations Capabilities framework 2.0\n\nThe new Integration Capabilities Framework 2.0 has been redesigned to enable implementation of integrations in a simple and consistent manner. This ensures a consistent experience for similar types of integrations \\(for example: observable reputation lookup\\).\n\nThe new framework has capabilities implemented using [Flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/build-workflows/flows.md).\n\nBenefits from the enhanced framework implementation include:\n\n- The capability flows that include only business level components without any implementation specific logic.\n- The capability flows now accept a broad array of inputs and formats for maximum flexibility \\(For example, observable references, CI references, tasks, any table or sys\\_id combinations\\).\n- Rate limiting or throttling on integration executions are now easy to configure \\(removing the need to do this using custom code or changes to implementation workflows\\).\n- Enhanced auditing and execution tracking capabilities now enable better reporting and easier troubleshooting.\n- Robust error handling functions are built into the capability flows to avoid duplicating implementation routines.\n- Ability to configure conditional triggering of the capabilities or the integrations. This provides flexibility to automatically launch automations based on incident category.\n- A default filter condition has been introduced on all capabilities to filter allow listed observables before inputs are provided to the integrations.\n\n**Note:** This new capability framework does not upgrade the current capability framework. Both frameworks can work in parallel. For instructions on how to leverage the new capability framework, see [Using the new Capability Framework with an installed integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/cj-sir-capfmw-about.md) and [Using the new Capability Framework with a Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/cj-sir-capfmw-about.md).\n\n**Parent Topic:**[Security Operations Integration Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/secops-integ-ref.md)\n\n## Supported integrations and components\n\nThe Security Incident Response plugin includes all the capability flows listed in Integration Capabilities Framework 2.0, and standard high-level filters that you can enable or disable depending on your requirement.\n\n**Note:** If you want to use the new Capability Integration Framework with the New York release, you must install the ServiceNow IntegrationHub Starter Pack Installer plugin. Contact Customer Support for assistance with the installation.\n\n### Supported application versions\n\nStarting with Security Incident Response 10.0, the following integrations are supported:\n\n|Application|Minimum version required|\n|-----------|------------------------|\n|Security Operations Hybrid Analysis Integration|10.0.0|\n|Security Operations PhishTank Integration|10.0.0|\n|Security Operations ThreatCrowd Integration|10.0.0|\n|Security Operations CrowdStrike Intelligence Integration|10.0.0|\n|Security Operations 'Have I been pwned?' Integration|10.0.0|\n|Security Operations Metadefender Integration|10.0.0|\n|Security Operations Recorded Future Integration|10.0.0|\n|Security Operations VirusTotal Integration|10.0.0|\n|Security Operations Reverse WhoIs Integration|10.0.0|\n\nStarting with Security Incident Response 10.4, the following integrations are supported:\n\n|Application|Minimum version required|\n|-----------|------------------------|\n|Security Operations RiskIQ Integration|10.0.0|\n|Security Operations Shodan Integration|10.0.0|\n|Security Operations WhoIs Integration|10.0.0|\n|Security Operations Carbon Black Integration|10.3.1|\n|Security Operations Splunk Search Integration|10.3.0|\n|Security Operations ArcSight Logger Integration|10.3.0|\n|Security Operations McAfee ESM Integration|10.3.0|\n|Security Operations Elasticsearch Integration|10.3.0|\n|Security Operations IBM QRadar Integration|10.3.1|\n|Security Operations CrowdStrike Falcon Host|10.3.0|\n\n### Components included\n\nThe new Capability Integration Framework includes the following components:\n\n- **Capabilities**: All of the following capabilities that exist in the product today as workflows have been redesigned using [Flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/build-workflows/flows.md):\n - **Block Request**: Provides a way to block observables associated with a security incident on a firewall, web proxy, or some other control point. This capability is used during incident response investigations to contain an identified threat.\n - **Email Search and Delete**: Provides a way to search an email server during a security investigation and if necessary, delete emails from the server.\n - **Enrich Configuration Item**: Provides a general way to enrich configuration items with additional information from a variety of sources. This capability is used during incident response investigations to enrich data associated with a security incident.\n - **Enrich Observable**: Provides a general way to enrich observables with additional information from a variety of sources. This capability is used during incident response investigations to contain an identified threat.\n - **Event Ingestion**: Provides a general way to create a security incident by mapping events from an integration source to a security incident.\n - **Get Network Statistics**: Retrieves a list of active network connections from an endpoint or host. This capability is used for incident enrichment during investigations.\n - **Get Running Processes**: Retrieves a list of running processes from an endpoint or host. This capability is used for incident enrichment during investigations.\n - **Isolate Host**: Provides a way to isolate an endpoint or a host associated with a security incident. Isolate host is executed against a configuration item \\(CI\\).\n - **Publish to Watchlist**: Provides a way to add observables associated with a security incident to a watchlist that monitors for security events and generates alerts. This capability is used as part of incident response during investigations.\n - **Sightings Search**: Searches various SIEMs or other log stores for instances of observables. This capability is used to determine the presence of malicious IoCs in your environment.\n - **Threat Lookup**: Performs threat intelligence lookups to determine whether a certain observable is associated with a known security threat. This capability is used as part of incident response during investigations.\n- **New tables**:\n - sn\\_sec\\_cmn\\_capability: Capability and flow that implements the capability.\n - sn\\_sec\\_cmn\\_capability\\_implementation: The actual implementation flow that provides the services of the capability.\n - sn\\_sec\\_cmn\\_capability\\_execution: The execution record for a capability at runtime.\n - sn\\_sec\\_cmn\\_capability\\_implementation\\_execution: The execution record for a capability implementation at runtime.\n - sn\\_sec\\_cmn\\_filter\\_condition: The filter conditions that can be applied at runtime to the capability or a capability implementation.\n- **Include script**: CapabilityProcessor: Handles all the processing code for the framework.\n- **Rate limit**: Capability Max Concurrent Req Per Period: Defines how many integrations can be executed in parallel.\n- **Scheduled job process capability implementation**: Runs every 15 seconds and can be disabled in the Security Administration Properties page \\(**Security Incident** > **Administration** > **Properties**\\).\n - Enables or Disables the scheduled job, Process Capability Implementations: This job automatically schedules and manages capability implementation execution flows.\n - Enables or Disables Automated Lookups or Enrichments: Setting that activates or deactivates the scheduled job that performs automated threat lookup or enrichment of observables when observables are added to security incidents in the current capability framework.\n - Enables or Disables the scheduled job, Lookup Security Incident Observables: This job automatically schedules a Threat Lookup or Enrich Observables job when observables are added to a security incident.\n\n## Configurations in the new Capability Framework\n\nThis section describes the configurations available in the new framework.\n\n### Before you begin\n\nRole required: sn\\_si.admin, flow\\_designer, action\\_designer\n\n### Procedure\n\n1. Navigate to **All** > **Security Operations** > **Integrations** > **Integration Capabilities \\(Flows\\)**.\n\n2. The capabilities available with the base system are displayed.\n\n \\[Omitted image \"cj-sir-capfmw-oob-cap.png\"\\] Alt text: Capability flows: base system\n\n **Note:**\n\n These are the capabilities provided with the base system. You can use the capabilities, or you can customize them as required. The following steps describe how to configure a capability and the integrations implemented for the capability.\n\n3. Select the link in the Name column to configure a capability.\n\n The Name, Application, Description, and the Flow that the Capability implements is displayed.\n\n \\[Omitted image \"cj-sir-capfmw-config1.png\"\\] Alt text: Capability flows: Configure capability\n\n4. Select the **Active** check box to activate the capability.\n\n - **Filter conditions at the capability level**: When an integration capability implements a flow, the filter conditions associated with the flow will be executed before the capability flow is launched. For example, the Threat Lookup capability includes the Filter Allowlisted Observables condition as shown above. Select the Name link to edit the filter condition.\n\n **Note:** Select the **Add worknote to task** check box to add worknotes to include information on the filter conditions used.\n\n \\[Omitted image \"cj-sir-capfmw-config2.png\"\\] Alt text: Capability flows: configure capability: edit filter condition\n\n You can either define filter conditions or a script, or a combination of both. In the above example, a script is used to define the filter conditions. When the capability flow is executed, the script searches for allowlisted observables and removes them from the table.\n\n **Note:** The filter conditions set here are applicable to all active integrations defined in the **Capability Implementations** tab.\n\n - **Capability implementations**: Select the **Capability Implementations** tab. The implementations \\(integrations\\) that have been configured for the capability are displayed.\n5. Select the Name link to view the Capability Implementation.\n\n The Name, Application, Description, and the Flow that the capability implements is displayed.\n\n6. Select the **Active** check box to activate the capability.\n\n You can specify the following details:\n\n\n
\n\nField Name\n\n\n\nDescription\n\n
\n\nActive\n\n\n\nSelect this check box to enable disable this integration.**Note:** If you configure this integration using the integration tile in the **Security Operations** > **Integrations** > **Integrations Configurations**page, this flag is automatically set to **Active**.\n\n
\n\nOrder\n\n\n\nIndicates the order in which the integrations are executed.\n\n
\n\nCapability\n\n\n\nThe capability implemented by this integration.\n\n
\n\nFlow\n\n\n\nThe subflow that implements the capability.\n\n
\n\nConfiguration\n\n\n\nThe integration configuration for this capability. **Note:** This is initially set to the default configuration provided with the base system. When an integration is configuring using the integration tile in the **Integration Configurations** page, this value is automatically reset to the new configuration created.\n\n
\n\nRate Limit\n\n\n\nIndicates the number of integrations that can be executed at run-time \\(in parallel or per unit of time\\).\n\n
\n\nBatch Inputs Size\n\n\n\nThe batch input size for each execution. For example, for a Sighting Search integration you may want to group the observables into batches of 50 so that the queries generated do not become too large. 0 indicates that there is no limit.\n\n
\n\nTimeout Period\n\n\n\nThe maximum duration before the capability implementation flow is cancelled. 0 indicates that there is no timeout period.\n\n
\n\nTotal Requests\n\n\n\nThe total number of implementation execution requests. This field in conjunction with the Total Reqs Period field, can be used to limit the number of requests to the service. For example, you can limit the number to 4 requests per minute.\n\n
\n\nTotal Reqs Period\n\n\n\nThe total number of execution requests allowed per period.\n\n
\n\nRetry Limit\n\n\n\nThe number of retries allowed for a failed execution request. This limit will be applicable if the **Retry** flag is set in your integration to retry an execution request when a condition is met. For example, a retry request is made when you have exceeded your license limit for that service for a time period or the service is down.\n\n
\n\nRetry After\n\n\n\nThe period after which an attempt is made to retry a failed execution request.\n\n
\n\nMax Concurrent Reqs\n\n\n\nThe maximum number of concurrent implementation execution requests. 0 indicates no limit.\n\n
\n\nSighting Search Configurations\n\n\n\nThe default sighting search queries that can be executed.\n\n
Select the Name link in the Filter Conditions section to configure the conditions defined for the implementation. Add or delete filter conditions, modify the script if required and update the record.\n\n\n## Using the new Capability Framework with an installed integration\n\nThis section describes how to use the new capability framework for an existing integration.\n\nUse the steps below to enable an already installed and configured integration \\(see supported list of Integrations in [Supported integrations and components](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/cj-sir-capfmw-about.md)\\) to use the new capability framework.\n\n**Note:** Integration Capability Framework 2.0 available with Security Incident Response 10.0.2 supports implementations for the **Threat Lookup** and **Enrich Observable** capabilities. Implementations for other capabilities will be made available in a future release.\n\n**Before you begin**\n\n- Role required: sn\\_si.admin\n- Security Incident Response 10.0.2\n\n1. Navigate to **Security Operations** > **Integrations** > **Capabilities**.\n2. Click on **Threat Lookup** capability.\n3. Click the Capabilities Implementation tab.\n\n \\[Omitted image \"cj-sir-capfmw-new-cap.png\"\\] Alt text: Capability framework: New capability\n\n4. 4. View the Capability Implementation record for the integration of interest \\(example: Crowdstrike Falcon Intelligence\\). The **Active** column should have the value as **False**.\n5. Click the **Name** link to view the implementation record.\n\n \\[Omitted image \"cj-sir-capfmw-new-cap-det.png\"\\] Alt text: Capability framework: New capability implementation record\n\n6. Select the **Active** check box.\n7. Ensure the implementation record is pointing to the right configuration record \\(the tile name for the integration in **Integration Configurations** > **Show Configurations \\(Yes\\)**\\).\n\n \\[Omitted image \"cj-sir-capfmw-config-tile.png\"\\] Alt text: Capability Framework: Configuration Tile\n\n8. The implementation is enabled for use with the new framework.\n\n**Note:** All supported Integrations when installed with Security Incident Response 10.0.2 will automatically be enabled under the new Integration Capability framework.\n\n## Using the new Capability Framework with a Flow\n\nUse the steps below to create a flow and call the subflow provided by the new capability framework.\n\n### Before you begin\n\n- Role required: sn\\_si.admin, flow\\_designer, action\\_designer\n- Install one of the supported integrations \\(see [Supported integrations and components](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/cj-sir-capfmw-about.md)\\)\n\nThe steps below describe how to create a sample flow and call one of the subflows provided with the new capability framework.\n\n### Procedure\n\n1. Navigate to **All** > **Flow Designer** > **Designer**.\n\n2. Select **New** and then select **Flow** to create a new flow and provide the necessary information for the properties.\n\n \\[Omitted image \"cj-sir-capfmw-create-flow.png\"\\] Alt text: Capability Framework: Create new flow\n\n **Note:** Select **System User** in the Run As choice list as shown in the above image.\n\n3. Select a Trigger condition for the flow \\(a common trigger is the creation of a security incident record for a certain incident category\\).\n\n4. In step 1 of the flow, select an action to get inputs from the security incident \\(for example, observables\\).\n\n You can select an action from the actions provided with the base system with the Security Support Common Spoke.\n\n \\[Omitted image \"cj-sir-capfmw-create-flow-action.png\"\\] Alt text: Capability Framework: Create new flow: action\n\n5. In step 2, select a subflow \\(for example, Threat Lookup\\).\n\n6. Configure the subflow you have selected as shown below:\n\n \\[Omitted image \"cj-sir-capfmw-create-flow-subflow-config.png\"\\] Alt text: Capability Framework: Create new flow: configure subflow\n\n7. Save and publish the flow.\n\n\n## Troubleshooting Integration Capability flows\n\nThe Capability Executions option provides detailed information on each capability that has been executed.\n\n**Note:** Completed executions are archived after 30 days.\n\n1. Navigate to **Security Operations** > **Integrations** > **Capability Executions.**.\n\n \\[Omitted image \"cj-sir-capfmw-execute-1.png\"\\] Alt text: Capability Framework: Capability Executions\n\n2. Click on the Capability Executions link to view additional details.\n\nSecurity Incident Record Worknotes\n\nWhen observables have been added to a security incident and the trigger condition for the flow is met, the Threat Lookup and Enrich Observable subflows are initiated and the following work notes are added to the security incident:\n\n- Flow execution started: Security Operations Integration - Enrich Observable V1\n- Flow execution completed: Security Operations Integration - Enrich Observable V1\n- Flow execution started: Security Operations Integration – Threat Lookup V1\n- Flow execution completed: Security Operations Integration – Threat Lookup V1\n\nTo view these worknotes, login as a user with the `sn_si.admin` or `sn_si.analyst`, and `flow_designer`, and `action_designer` roles.\n\nNavigate to the security incident record page and click on these worknotes to view the flow execution details.\n\n\\[Omitted image \"cj-sir-capfmw-worknotes.png\"\\] Alt text: Capability Framework: Security Incident: Worknotes\n\n"}}