{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44058,"path":"security-management/index.md","title":"Australia Security Management","bundle":"security","doc_type":"toc","release":"australia","body":"\n# Australia Security Management\n\n- [Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-operations-landing-page.md) -- ServiceNow Security Operations applications import incident data from your security tools into a structured response engine. Intelligent workflows, automation, and data visualizations help you prioritize and resolve threats based on their impact to your organization.\n  - [Exploring Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/understanding-secops.md) -- Protect your assets and enterprise environment with ServiceNow Security Operations applications and the power of the ServiceNow AI Platform. Connect your security and IT teams to help you prioritize and resolve threats based on the impact they pose to your organization.\n  - [ServiceNow Otto for Threat Intelligence Security Center (TISC)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-tisc-landing.md) -- With ServiceNow Otto for Threat Intelligence Security Center (TISC), threat analysts and security operations teams can use generative AI skills to generate case summaries and threat intelligence reports.\n    - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/exploring-now-assist-tisc.md) -- Threat analysts and security operations teams can use ServiceNow generative AI skills to summarize case management content and generate threat intelligence case reports with ServiceNow Otto for Threat Intelligence Security Center (TISC).\n    - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuring-now-assist-tisc.md) -- Use the AI Admin Hub console to configure and activate the generative AI skills for ServiceNow Otto for Threat Intelligence Security Center (TISC).\n    - [Use generative AI skills](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/using-now-assist-tisc.md) -- Threat analysts can generate threat intelligence reports and summarize case management content from within their flow of work with ServiceNow Otto for Threat Intelligence Security Center (TISC).\n  - [ServiceNow Otto for Security Incident Response (SIR)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-for-security-incident-response-sir/now-assist-security-incident-landing.md) -- With ServiceNow Otto for Security Incident Response (SIR), security analysts can use intelligent workflows and ServiceNow generative AI skills to help them resolve security incidents. Security managers can review the context of security incidents and closure notes quickly in a concise, easy-to-read format, view post-incident analysis data, and see recommended remediation steps.\n    - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-for-security-incident-response-sir/exploring-now-assist-security-incident.md) -- Security analysts can use intelligent workflows and ServiceNow generative AI skills to triage, investigate, and close security incidents with ServiceNow Otto for Security Incident Response (SIR).\n      - [Supporting information](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-for-security-incident-response-sir/supporting-information-now-assist-security-incident.md) -- Get a quick overview of the important information that is related to the ServiceNow Otto for Security Incident Response (SIR) application.\n  - [ServiceNow Otto for Unified Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-for-usem-landing-ties.md) -- Set up, manage, and optimize your generative‑AI solutions on the ServiceNow AI Platform in the Unified Security Exposure Management workspace.\n    - [Generative AI skills with USEM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/using-now-assist-skills-vulnerability-response.md) -- AI skills help vulnerability managers and analysts resolve remediation tasks within their flow of work by providing automated insights, recommendations, and data analysis.\n    - [Agentic workflows with USEM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/using-now-assist-ai-agents-vr.md) -- Use AI agents to complete your tasks autonomously.\n    - [Supporting information](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/supporting-information-now-assist-vr.md) -- Get an overview of the important information that is related to the USEM application.\n  - [LLM-powered SIR integration builder](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sir-integration-builder-now-assist.md) -- The LLM-powered SIR integration builder (ServiceNow Otto for Security Incident Response (SIR) integration Toolkit) enables you to integrate capabilities into the Security Incident Response application.\n    - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/explore-sir-integration-builder.md) -- SIR Integration Builder offers a guided experience to efficiently integrate new tools through a simplified workflow.\n    - [Install](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/install-sir-integration-toolkit.md) -- Install the SIR integration builder to integrate capabilities to Security Incident Response.\n    - [Use SIR Integration Builder](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/using-sir-integration-builder.md) -- Add new integrations and use the existing integrations in SIR Workspace.\n      - [Add an integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/add-a-new-integration.md) -- Use the following steps to add an integration to your Security Incident Response application.\n        - [Add application details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/add-application-details.md) -- Add application details for your integration.\n        - [Add connection details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/add-connection-details.md) -- Configure the connection details for the integration.\n        - [Add capability details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/choose-capabilities.md) -- Select the capabilities that you want to include in your integration.\n        - [Add APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/add-apis.md) -- All the selected capabilities are listed as tabs on the Add APIs page. Add at least one API for each capability.\n        - [Review integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/review-integration.md) -- Review and publish the integration for using it in Security Incident Response Workspace.\n      - [Verify capabilities in ServiceNow Studio](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/verify-capabilities.md) -- Verify the capabilities that you have added using ServiceNow Otto for Security Incident Response (SIR) integration Toolkit and update the scripts for any required changes.\n      - [Use capabilities in SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/use-capabilities-sir-workspace.md) -- Use the capabilities created using ServiceNow Otto for Security Incident Response (SIR) integration Toolkit in the SIR Workspace.\n      - [Edit an integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/edit-an-integration-sir.md) -- Editing an integration enables you to modify existing published integrations to adapt to evolving requirements or correct configurations.\n    - [SIR Integration Builder reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sir-integration-builder-reference.md) -- Details of the Prompt Data (sn_si_int_kit_prompt_data) table.\n      - [Prompt Data table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/promptdata-table.md) -- Use the Prompt Data (sn_si_int_kit_prompt_data) table to view and modify the prompts for the capabilities.\n  - [Unified Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/unified-security-exposure-management-landing-page.md) -- Unified Security Exposure Management (USEM) is a comprehensive platform designed to transform how organizations manage security exposure across their digital estate. It consolidates multiple security exposure applications including Vulnerability Response, Configuration Compliance, Application Vulnerability Response, and Container Vulnerability Response into a single, cohesive architecture.\n    - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/exploring-unified-security-exposure-management.md) -- Unified Security Exposure Management (USEM) is a platform that brings together infrastructure, application, container, and configuration exposures into one unified experience.\n      - [Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-workspace-user-interface.md) -- The Security Exposure Management Workspace provides a unified, role-based environment where security teams can investigate exposures, take remediation actions, configure automation, and track risk reduction progress in one place. It centralizes visibility across findings, remediation tasks, approvals, and administration, helping teams collaborate efficiently and respond to risks with clarity and speed.\n        - [Administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-administration-console.md) -- The Administration for Security Exposure Management application offers a unified administrative experience across all Unified Security Exposure Management (USEM) applications. It introduces the Admin Console within the Security Exposure Management (SEM) Workspace, allowing administrators to configure Security Exposure Management applications and monitor integrations from a single location.\n          - [Visualization library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-visualization-library.md) -- The Visualization library lists all the widgets that you can use to visualize and categorize findings. It includes a set of default widgets and any custom widgets that you create for organization-specific reporting. You can browse the available widgets, understand the data they use, and add them to dashboards to build tailored security exposure views.\n        - [AI Exposures](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/ai-security-exposure-home.md) -- Access the entire attack surface across various types of findings on the AI Security Exposure Management dashboard with the AI Exposures module. AI Security Exposure Management is a dedicated module of the Security Exposure Management workspace.\n        - [Cloud Exposure view](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vr-cloud-exposure-view-db.md) -- The Cloud Exposure View is a module that is supported by Security Exposure Management workspace. Select interactive visualizations and filter aggregated data for your cloud assets by category to view findings for your security exposures. Cloud security teams can monitor and act on all their cloud-related security findings from multiple vendors across their cloud environments from within the workspace.\n        - [Approvals view](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-unified-approval-rules-explore.md) -- The approval process in Security Exposure Management for vulnerability and compliance exceptions is unified to simplify workflows, improve visibility, and streamline actions for Approvers.\n        - [Finding view](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-findings-view.md) -- The Security Exposure Management Workspace Findings view aggregates the security exposure data and presents it as dashboards containing data visualization widgets.\n        - [Remediation view](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-workspaces-ui-remediation-module.md) -- The Remediation view in the Security Exposure Management workspace provides remediation owners and vulnerability managers with a consolidated view of remediation tasks, findings (vulnerable items and configuration test results), and assets (configuration items) that are associated with exposure findings.\n        - [List view](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-workspace-list-page.md) -- The List view in the Security Exposure Management Workspace enables vulnerability and security managers and analysts to view remediation progress on records, drill down into records, and view the status of their approval requests and exceptions.\n        - [Watch topics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-watch-topic.md) -- The Watch topics page in the Security Exposure Management Workspace enables you to create and edit a watch topic. A Watch topic is a set of data visualizations which enables you to monitor a filtered set of records findings (VITs, AVITs, CVITs and CTRs) over time on a dashboard that might be of a particular interest or priority to your organization.\n      - [Health Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-health-dashboard-overview.md) -- The Vulnerability Response Health dashboard is a tool designed to empower organizations with comprehensive insights into the implementation and usage of their Security Exposure Management applications.\n      - [Security Exposure Management workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-workflow.md) -- Unified Security Exposure Management (USEM) is ServiceNow’s next-generation platform that consolidates multiple security exposure applications—Vulnerability Response (VR), Application Vulnerability Response (AVR), Container Vulnerability Response (CVR), and Configuration Compliance (CC)—into a unified architecture. It provides a single source of truth for security exposure, enabling real-time visibility, streamlined workflows, and automated remediation.\n        - [Automating prioritization and triaging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-automating-prioritization-triaging.md) -- Automate prioritization and triaging of findings using rules and severity mapping.\n          - [Associating finding with a configuration item using lookup rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-associate-finding-configuration-item-using-lookup-rules.md) -- Unified Security Exposure Management uses lookup rules to associate imported third-party exposure findings with configuration items (CIs) in the Configuration Management Database (CMDB). These rules match asset data to existing CIs, enabling accurate remediation.\n            - [Managing unmatched configuration items (CIs)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-unmatchedCIs.md) -- When assets are imported, they are automatically matched against existing CIs in your Configuration Management Database (CMDB). Assets that do not find a match are listed as 'Unmatched CIs' under Discovered Items.\n            - [Managing unclassed hardware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-unclassed-hardware.md) -- An asset is classified as unclassed hardware when it cannot be matched to an existing configuration item (CI) in the Configuration Management Database (CMDB) using defined lookup rules during import.\n            - [Steps to help prevent duplicate or orphaned records after running lookup rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-ci-identifier-rules-impl-test.md) -- Take steps to help prevent duplicate or orphan records resulting from matching (configuration items (CIs) within the CMDB.\n          - [Categorizing findings and discovered items using classification rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-categorizing-findings-discovered-items.md) -- Classification groups automate the classification of entities or records based on the classification rules defined in the group. The condition for each rule is evaluated in order, and the first matching rule is used.\n          - [Prioritizing vulnerabilities and other findings using roll-up calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-prioritizing-vulnerabilities-other-findings.md) -- After assessing risk calculators, use the roll-up calculators to configure how the cumulative risk scores are computed for remediation tasks and other higher entities.\n            - [Vulnerability Response Rollup Calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-vuln-rollup-calculator.md) -- After your initial assessment of risk calculators in the Setup Assistant, use the vulnerability rollup calculators to configure how the cumulative risk score is computed for remediation tasks and imported vulnerabilities.\n          - [Assigning findings to remediation teams using assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-assigning-findings-to-remediation-teams.md) -- Assignment rules automatically assign findings, such as vulnerable items, application vulnerabilities, container vulnerabilities, and configuration test results, to the appropriate groups for remediation. This streamlined triage ensures that tasks are directed to the appropriate teams, and enhances consistency and visibility across security and compliance programs.\n            - [Removing assignments from findings and remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-unassigning-findings.md) -- You can remove yourself or your group from the Assigned to and Assignment group fields on findings and remediation tasks if you believe they were incorrectly assigned.\n          - [Defining your own service level agreements (SLAs) using remediation target rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-defining-your-own-sla.md) -- Remediation target rules set the expected time frame for addressing findings, similar to how service level agreements (SLAs) set deadlines for fixing vulnerabilities. You can also send notifications to users and groups when target dates are approaching and when they are past due.\n          - [Deferring findings automatically without manual intervention using exception rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-exception-rules-overview.md) -- Exception rules for Security Exposure Management Workspace enable you to automate the deferral process for findings. Request an exception for the findings that can't be remediated or deferred immediately, by identifying the impacted vulnerabilities, configuration items (CIs), or VIs. Defer the matching findings based on the rule when the system identifies them by automating the finding deferral process.\n          - [Grouping multiple findings as remediation tasks for easy processing using remediation task rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-grouping-multiple-findings-remediation-tasks-processing.md) -- Remediation tasks help vulnerability analysts and remediation teams manage findings in bulk. By configuring remediation task rules, you can automatically group findings into remediation tasks, eliminating the need for manual task creation and streamlining remediation efforts.\n          - [Closing stale detections and findings automatically using auto-close rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-closing-stale-findings-automatically.md) -- Auto-close rules automatically close stale detections and findings based on predefined criteria. These rules ensure that redundant or unwanted findings are marked as closed, helping to maintain an accurate and up-to-date record of the organization's security posture. By automating this process, the rules reduce manual effort and enable teams to focus on active and critical vulnerabilities.\n          - [Deleting stale findings automatically using auto-delete rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-deleting-stale-findings-automatically.md) -- Auto-delete rules automatically remove findings from the system based on predefined criteria. These rules help manage the life-cycle of vulnerabilities by ensuring that resolved or outdated findings are removed, reducing clutter and maintaining a clean, up-to-date database. This automation streamlines the vulnerability management process and ensures that teams focus on current and relevant issues.\n          - [Controlling the ingestion volume with automatic exclusion](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-controlling-ingestion-volume-automatic-exclusion.md) -- Exclusion rules provide a way to filter or exclude detections from getting converted into VITs during the ingestion process in Vulnerability Response.\n          - [Creating CIs using the Identification and Reconciliation engine](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-ci-creation-using-IRE.md) -- You can create configuration items (CIs) in the Configuration Management Database (CMDB) using the Identification and Reconciliation engine (IRE) API. By using the IRE API to create CIs, you can prevent duplicate CIs from being created and you can reconcile CI attributes by allowing only authoritative data sources to write to CMDB.\n            - [Updating CI class for unmatched cloud assets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-updating-class-cloud-resource-hybrid-assets.md) -- Starting with Vulnerability Response v20.0, you can categorize the unmatched cloud assets from Qualys, Rapid7 and Tenable scanners into Unclassed Hardware by using the sn_sec_cmn.unmatched_cloud_resource_enabled system property.\n    - [Implement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuring-security-exposure-management.md) -- This section guides you through the entire process of implementing Unified Security Exposure Management (USEM) on your ServiceNow AI Platform instance. It provides detailed instructions on how to download the application from the ServiceNow Store, install it, and configure it to optimize your security workflows.\n      - [Installing Security Exposure Management Workspace applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-installing-required-applications.md) -- The required applications for the Security Exposure Management Workspace are available from the ServiceNow Store.\n        - [Migration upgrade prerequisites](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-install-prerequisites.md) -- Before you install the required applications for Security Exposure Management Workspace, review the following information and setup tasks.\n        - [Install Unified Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-install-and-configure.md) -- Before you run the Unified Security Exposure Management application in your ServiceNow AI Platform instance, you must get entitlement and download the application from the ServiceNow Store and install it on your ServiceNow AI Platform instance.\n        - [Download and activate applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-install-required-applications.md) -- Download the required Security Exposure Management Workspace applications from the ServiceNow Store into your ServiceNow AI Platform and activate them to upgrade.\n      - [Security Exposure Management Workspace Roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-new-roles-installed.md) -- List of roles installed with Security Exposure Management, defining user permissions and access for Security Exposure Management-related tasks.\n      - [Access control lists (ACLs) for administration rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-acls-for-admin-rules.md) -- You can either view or modify the administration rules based on the roles assigned to you.\n      - [Security Exposure Management Workspace personas and granular roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-persona-overview.md) -- Before you can successfully remediate vulnerabilities with the Security Exposure Management Workspace plugin, you must assign personas and roles to your users and groups in Setup Assistant.\n        - [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-assign-personas_SA.md) -- Assign the Vulnerability Response persona roles to groups or users with Setup Assistant.\n          - [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-manage-granular-roles.md) -- After you complete your initial assignment of persona roles using Setup Assistant, manage additional granular role assignments to users or groups from the User Administration module in your instance.\n      - [Configure watchdog](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-watchdog-configure.md) -- Use the watchdog configuration page to create new or update existing watchdogs with conditions that you want to specify. You can enable the notification for each watchdog, and get notified when the conditions are met.\n      - [Configure rules to manage findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-rules-manage-findings.md) -- By configuring rules, you can automate, organize, and manage the lifecycle of findings. The rules help ensure scalability, data consistency, and faster response times by reducing manual intervention across large volumes of vulnerability data.\n        - [Configuring lookup rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-lookup-rules.md) -- By configuring lookup rules, you can map security exposure data to the correct configuration items (CIs) in the CMDB. This mapping is a critical function because associating exposure findings with the right assets is essential for proper risk assessment, assignment, and remediation workflows.\n          - [Create lookup rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-lookup-rules.md) -- By configuring lookup rules, you can map security exposure data to the correct configuration items (CIs) in the CMDB. This mapping is a critical function because associating exposure findings with the right assets is essential for proper risk assessment, assignment, and remediation workflows.\n          - [Ignore CI classes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-lookup-rules.md) -- By configuring lookup rules, you can map security exposure data to the correct configuration items (CIs) in the CMDB. This mapping is a critical function because associating exposure findings with the right assets is essential for proper risk assessment, assignment, and remediation workflows.\n          - [Reapply lookup rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-lookup-rules.md) -- By configuring lookup rules, you can map security exposure data to the correct configuration items (CIs) in the CMDB. This mapping is a critical function because associating exposure findings with the right assets is essential for proper risk assessment, assignment, and remediation workflows.\n          - [Reapply lookup rules on selected discovered items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-lookup-rules.md) -- By configuring lookup rules, you can map security exposure data to the correct configuration items (CIs) in the CMDB. This mapping is a critical function because associating exposure findings with the right assets is essential for proper risk assessment, assignment, and remediation workflows.\n        - [Configuring classification rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-classification-rules.md) -- By configuring classification rules, you can ensure consistent categorization and processing of vulnerabilities, discovered items and other finding related entities based on key attributes. This helps the system route findings to the correct tables, apply the appropriate grouping, assignment, and remediation rules, enhance reporting accuracy, and determine which business logic to use (such as prioritization and remediation targets).\n          - [Create and edit a classification group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-classification-rules.md) -- By configuring classification rules, you can ensure consistent categorization and processing of vulnerabilities, discovered items and other finding related entities based on key attributes. This helps the system route findings to the correct tables, apply the appropriate grouping, assignment, and remediation rules, enhance reporting accuracy, and determine which business logic to use (such as prioritization and remediation targets).\n          - [Create or edit classification rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-classification-rules.md) -- By configuring classification rules, you can ensure consistent categorization and processing of vulnerabilities, discovered items and other finding related entities based on key attributes. This helps the system route findings to the correct tables, apply the appropriate grouping, assignment, and remediation rules, enhance reporting accuracy, and determine which business logic to use (such as prioritization and remediation targets).\n          - [Reapply a classification rule to existing records in the table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-classification-rules.md) -- By configuring classification rules, you can ensure consistent categorization and processing of vulnerabilities, discovered items and other finding related entities based on key attributes. This helps the system route findings to the correct tables, apply the appropriate grouping, assignment, and remediation rules, enhance reporting accuracy, and determine which business logic to use (such as prioritization and remediation targets).\n          - [Deactivate or delete a classification rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-classification-rules.md) -- By configuring classification rules, you can ensure consistent categorization and processing of vulnerabilities, discovered items and other finding related entities based on key attributes. This helps the system route findings to the correct tables, apply the appropriate grouping, assignment, and remediation rules, enhance reporting accuracy, and determine which business logic to use (such as prioritization and remediation targets).\n        - [Configuring roll-up calculator rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-risk-rules.md) -- Configure roll-up calculator rules to compute the cumulative risk score for remediation tasks and imported vulnerabilities.\n          - [Create or edit roll-up calculator rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-risk-rules.md) -- Configure roll-up calculator rules to compute the cumulative risk score for remediation tasks and imported vulnerabilities.\n        - [Configuring assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-assignment-rules.md) -- By configuring assignment rules, you can automate the process of routing findings to the appropriate teams or individuals. By defining assignment criteria based on vulnerability attributes or affected assets, you can ensure timely and accurate ownership for remediation efforts.\n          - [Create or edit assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-assignment-rules.md) -- By configuring assignment rules, you can automate the process of routing findings to the appropriate teams or individuals. By defining assignment criteria based on vulnerability attributes or affected assets, you can ensure timely and accurate ownership for remediation efforts.\n          - [Reapply assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-assignment-rules.md) -- By configuring assignment rules, you can automate the process of routing findings to the appropriate teams or individuals. By defining assignment criteria based on vulnerability attributes or affected assets, you can ensure timely and accurate ownership for remediation efforts.\n          - [Delete assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-assignment-rules.md) -- By configuring assignment rules, you can automate the process of routing findings to the appropriate teams or individuals. By defining assignment criteria based on vulnerability attributes or affected assets, you can ensure timely and accurate ownership for remediation efforts.\n          - [Remove assignments from findings and remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-assignment-rules.md) -- By configuring assignment rules, you can automate the process of routing findings to the appropriate teams or individuals. By defining assignment criteria based on vulnerability attributes or affected assets, you can ensure timely and accurate ownership for remediation efforts.\n        - [Configuring remediation target rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-remediation-target-rules.md) -- By configuring remediation target rules, you can set the expected time frame for addressing findings, similar to how service level agreements (SLAs) set deadlines for fixing vulnerabilities.\n          - [Create or edit remediation target rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-remediation-target-rules.md) -- By configuring remediation target rules, you can set the expected time frame for addressing findings, similar to how service level agreements (SLAs) set deadlines for fixing vulnerabilities.\n            - [Recalculate RT date](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-remediation-target-rules.md) -- By configuring remediation target rules, you can set the expected time frame for addressing findings, similar to how service level agreements (SLAs) set deadlines for fixing vulnerabilities.\n              - [Examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-remediation-target-rules.md) -- By configuring remediation target rules, you can set the expected time frame for addressing findings, similar to how service level agreements (SLAs) set deadlines for fixing vulnerabilities.\n        - [Configuring an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-exception-rule.md) -- You can request an exception for findings that can't be remediated or deferred immediately. By automating the finding deferral process, you can defer the matching findings based on the rule when the system identifies them.\n          - [Create an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-exception-rule.md) -- Create a rule to automatically request an exception for a specific condition for a group findings, such as a rule with a condition that is based on the vulnerability severity of these findings. With this rule, you can defer new and existing findings automatically if they match the approved rule condition.\n          - [Approve an exception rule request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-approve-ex-rule-request.md) -- Assess exception rule requests from users so that you can approve or reject these requests.\n          - [Activating an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-activate-ex-rule.md) -- A rule is activated on its \"Valid from\" date. After activation, it automates the exception process for findings.\n          - [Reopen an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-reopen-ex-rule.md) -- Reopen an exception rule that has been rejected, but you want to resubmit. Reopening the rule moves it to the Draft state.\n          - [Update an approved exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-update-approved-ex-rule.md) -- Cancel an approved rule to be able to update it. For example, before you can modify any dates or add a condition to an approved rule, you must cancel it so that the remediation task finding is deleted, and the findings move to the Open state.\n          - [Delete an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-delete-ex-rule.md) -- Delete an exception rule that is not required anymore. For example, you can delete a rule if you don't want to defer a finding during ingestion.\n        - [Define fields and weights for the risk rule for Unified Security Exposure Management risk calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-vuln-calc-define-risk-rule-fields.md) -- Customize risk rule parameters and weights to generate risk scores that reflect your organization's specific finding and asset data. By selecting relevant fields for the risk rule, you can create an effective risk scoring framework that meets your organization's unique needs.\n        - [Configuring remediation task rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-remediation-task-rules.md) -- By configuring remediation task rules, you can automatically group findings based on filter conditions.\n          - [Create remediation task rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-remediation-task-rules.md) -- By configuring remediation task rules, you can automatically group findings based on filter conditions.\n        - [Configuring auto-close rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-auto-close-rules.md) -- By configuring auto-close rules, you can automate the process of closing stale detections and findings associated with retired configuration items (CIs).\n          - [Create or edit auto-close rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-auto-close-rules.md) -- By configuring auto-close rules, you can automate the process of closing stale detections and findings associated with retired configuration items (CIs).\n        - [Configuring auto-delete rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-auto-delete-rules.md) -- By configuring auto-delete rules, you can automate the process of deleting older findings and remediation tasks.\n          - [Create or edit auto-delete rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-auto-delete-rules.md) -- By configuring auto-delete rules, you can automate the process of deleting older findings and remediation tasks.\n        - [Configuring exclusion rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-exclusion-rules.md) -- By configuring exclusion rules, you can filter or exclude detections from being converted into vulnerable items (VITs) during ingestion. This filtering helps streamline vulnerability management by reducing noise and prioritizing critical issues.\n          - [Create or edit exclusion rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-or-edit-exclusion-rules.md) -- Create a rule to filter or exclude detections from getting converted into vulnerable items (VITs) during ingestion.\n        - [Approval workflow configurations for unassign request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-unassign-approval-rules.md) -- You can design the approval workflow for the removal of assignments from vulnerable items (VIs, VITs), remediation tasks, application vulnerable items (AVITs), and container vulnerable items (CVITs) for you and your group.\n      - [Configure AI skills and agentic workflows for USEM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuring-now-assist-for-vulnerability-response.md) -- Configure AI skills and agentic workflows for ServiceNow Otto for Unified Security Exposure Management.\n        - [Configure a skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/activate-skills-now-assist-vulnerability-response.md) -- You have the option to review the details, edit the configuration of a skill, and reactivate it in the Guided Setup.\n        - [Configure an agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-vr-acticvate-agentic-workflow.md) -- You can configure agentic workflows from the AI Agent Studio, but you must duplicate them to modify settings. The USEM AI agents included with the application and used in the agentic workflows are activated by default and aren't editable.\n      - [Configure AI Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/ai-security-exposure-install-config.md) -- Install and configure the required applications.\n      - [Configure Exception Management for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-exp-mngmt-vr.md) -- When your organization can't comply with a vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to a finding or remediation task (RT) that can't be remediated according to the policy.\n        - [Request an exception using GRC: Policy and Compliance Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-integration-with-grc.md) -- Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Vulnerability Response.\n        - [Specify the duration of an exception requested for a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-ex-req-sysprop.md) -- Use system properties to limit the duration for which an exception is requested for a remediation task. Remediation of the remediation task is deferred for the specified period.\n      - [Configure email notifications in Unified Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-email-notifications.md) -- Set up email notifications to share useful information about important updates and activities such as approval and rejection of false-positive requests. Creating an email notification involves specifying when to send it, who receives it, and what it contains.\n      - [Configure email templates in Unified Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-email-templates.md) -- Create and manage preconfigured email templates for sending notifications.\n      - [Configure a severity map in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-severity-map.md) -- Security Exposure Management Workspace severity mapping transforms third-party source severity fields to recognizable fields in Unified Security Exposure Management.\n      - [Configure advanced Settings in Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-advanced-settings.md) -- The Advanced Settings section allows administrators to configure system-level behavior for vulnerability processing, remediation workflows, compliance handling, and service impact calculations across Unified Security Exposure Management products.\n      - [Configure Visualization library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-visualization-library.md) -- The Visualization library lists the available widgets for the Findings view page and their additional details, such as, the current activation status, additional conditions, and other columns. Configure the visualization library to select the columns you want to view.\n        - [Create a custom widget](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-widget.md) -- Create a custom widget in the Security exposure management (SEM) workspace to visualize findings data that meets your organization’s reporting needs. This feature enables administrators to extend the default widgets in the visualization library by adding new widgets that reflect organization-specific risk and exposure metrics.\n        - [Update a widget](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-update-widget.md) -- Update a widget in the Visualization Library to modify its configuration or presentation. You can update attributes to refine how data appears in Findings dashboards and ensure that the visualizations stay relevant to your reporting needs.\n        - [Localize widget titles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-localize-widget-titles.md) -- Update the widget title in the Messages [sys_ui_message_list] table whenever you create a custom widget or rename an existing one to ensure it displays correctly in localized interfaces.\n      - [Configure users and groups in Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-users-groups-overview.md) -- Administrators can manage user and group access directly from the Security Exposure Management Workspace using centralized assignment of product-specific roles through a consistent, workspace-based experience.\n        - [Add groups to a role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-add-groups-to-role.md) -- Assign groups to product-specific roles in the Security Exposure Management Workspace. Only explicit assignments are managed through this interface.\n        - [Add users to a role](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-add-users-to-role.md) -- Assign users to product-specific roles using the interface in the Security Exposure Management Workspace.\n      - [Set up security tag groups and tags](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-class-group-and-tags.md) -- You can assign tags to security incidents, response tasks, vulnerable items, observables, IoCs, and security cases to create metadata on the responding record and define who should have access to specific types of security content. The tags can be added to security groups to organize them.\n        - [Create security tag rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-security-tag-rules.md) -- Security tag rules provide filtering for security tag access.\n        - [Import security tag rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-import-security-tag-rules.md) -- You can import security tag rules from other tables in your deployment.\n    - [Integrate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/integrating-usem.md) -- Unified Security Exposure Management supports multiple third-party integrations to help with vulnerability management, orchestration and remediation. This section provides guidelines for managing and developing integrations.\n      - [Review Unified Security Exposure Management integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/review-usem-integrations.md) -- The integration dashboard provides an overview of the installed third-party applications and the status of the integration runs.\n      - [AI Service Graph Connector for Palo Alto Prisma AIRS](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/palo-alto-prisma-airs-ai-sgc.md) -- The AI Service Graph Connector (SGC) for Palo Alto Prisma AIRS integrates ServiceNow with Palo Alto Networks Prisma AIRS to discover AI models and import critical metrics related to AI security findings.\n        - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/palo-alto-prisma-airs-ai-sgc-install-configure.md) -- Configure the AI Service Graph Connector to integrate ServiceNow with Palo Alto Networks Prisma AIRS and import AI model inventory and security findings.\n        - [Field mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/palo-alto-prisma-airs-ai-sgc-mapping.md) -- Prisma AIRS API fields map to ServiceNow fields for AI models, vulnerability scans, red teaming scans, and compliance data.\n      - [Early Warning for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/armis-early-warning-integration.md) -- Early Warning for Security Exposure Management, powered by Armis, enriches the Central Vulnerability Database (CVDB) in Unified Security Exposure Management (USEM) with vulnerability intelligence of imminent exploit. This enables your security team to prioritize and patch vulnerabilities before threat actors weaponize them.\n        - [Install](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/early-warning-install.md) -- Install the required applications for Early Warning for Security Exposure Management.\n        - [Set up requirements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/early-warning-integration-setup.md) -- Complete the following setup steps in your Armis Intelligence Center console environment before you configure Early Warning for Security Exposure Management in your ServiceNow AI Platform instance.\n        - [Configure the Early Warning for Security Exposure Management integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-early-warning-integration.md) -- Install and configure the Early Warning for Security Exposure Management integration plugin to ingest vulnerability intelligence and enrich your vulnerability database with threat signals.\n        - [Add Early Warning criteria to a risk rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/add-armis-early-warning-risk-rule.md) -- Add the Early Warning flag or Admiralty score as a weighted criterion in a risk rule to prioritize vulnerable items based on vulnerability intelligence data.\n        - [Schedule the integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/schedule-ew-integration.md) -- You can schedule the integration import times on the records in the Vulnerability Integrations [sn_vul_int_fw_integration] table and launch them on-demand.\n        - [View Early Warning for Security Exposure Management integration health](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-armis-early-warning-health.md) -- Monitor the Early Warning for Security Exposure Management integration by reviewing run history, ingestion performance, and processing health from the Security Exposure Management Administration console.\n        - [Early Warning CVD Attributes field reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/early-warning-cvd-attributes.md) -- The Early Warning CVD Attributes table stores vulnerability intelligence signals for vulnerabilities. Each attribute represents a threat indicator ingested from the Early Warning feed.\n      - [Cisco AI Defense Integration for AI Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/exploring-cisco-ai-defense-integration.md) -- The Vulnerability Response Integration with Cisco AI Defense imports AI model vulnerabilities and AI model validation data (results from automated red teaming or pentests) into your ServiceNow AI Platform instance. Use this data to detect security risks, drive remediation workflows, and verify compliance with AI security requirements.\n        - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/install-cisco-ai-defense-integration.md) -- Install and configure the ServiceNow AI Platform Integration with Cisco AI Defense application in your ServiceNow AI Platform instance to import scan results and model validation data from Cisco AI Defense.\n        - [Viewing data and field mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/use-cisco-ai-defense-integration.md) -- View and work with imported data from the Vulnerability Response Integration with Cisco AI Defense scan results and model validation data on records and dashboards in your ServiceNow AI Platform instance.\n      - [Fix Intelligence for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/fix-intel-for-usem-landing.md) -- Fix Intelligence for Security Exposure Management brings fix and remediation intelligence from Armis Centrix for Vulnerability Prioritization and Remediation (ViPR) into Unified Security Exposure Management (USEM), so your security team can remediate vulnerabilities by fix instead of one finding at a time.\n        - [Exploring Fix Intelligence for SEM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/exploring-fix-intel.md) -- Fix Intelligence for Security Exposure Management enriches USEM with a de-duplicated catalog of remediation actions, each linked to the findings and assets it resolves and scored by the risk it removes.\n          - [How Fix Intelligence for SEM works](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/fix-intel-data-flow.md) -- Fix Intelligence for Security Exposure Management enriches your host findings with normalized fix information and stores each unique fix as a Fix record. The feature links every fix to the findings it resolves and rolls up a risk score per fix. Your team can remediate by fix instead of one finding at a time.\n        - [Install Fix Intelligence for SEM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/install-fix-intel.md) -- Activate the Fix Intelligence for Security Exposure Management plugin (sn_vul_fix) to add the Fix tables, role, and integration to your USEM environment.\n        - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/using-fix-intel-security-exposure-management.md) -- Review the remediation actions available in your instance. Prioritize work by the risk each fix removes, and move between a fix and the findings and assets it resolves.\n          - [View fixes in USEM Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-fixes-in-workspace.md) -- Review the fixes that Fix Intelligence for SEM has identified, and see the findings and assets each one resolves. A Fix record represents a single remediation action that resolves one or more findings.\n          - [Group findings by fix](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/group-findings-by-fix.md) -- Use a remediation task rule to group the findings that share a fix, so your team can remediate them together as a single unit of work.\n          - [Fix links on findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/fix-links-on-findings.md) -- Fix Intelligence for SEM adds a read-only Fix reference to vulnerable items and vulnerabilities, so you can see which fix resolves a given finding directly from the finding.\n        - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/fix-intel-reference.md) -- Reference information about the roles, tables, and other components installed with Fix Intelligence for Security Exposure Management.\n          - [Components installed](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/fix-intel-components-installed.md) -- Activating the Fix Intelligence for Security Exposure Management plugin (sn_vul_fix) installs the following tables, role, scripts, automation, and integration components.\n          - [Understanding Fix records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/understanding-fix-records.md) -- A Fix record represents a single remediation action that resolves one or more findings.\n      - [Palo Alto Prisma AIRS Integration for AI Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/prisma-airs-integration.md) -- The Vulnerability Response Integration with Palo Alto Prisma AIRS imports AI security scan results, posture findings, and model validation data into your ServiceNow AI Platform instance. Use the data to help you detect security risks, drive remediation workflows, and verify compliance with AI security requirements.\n        - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/install-prisma-airs-integration.md) -- Use this task to set up the Vulnerability Response integration with Palo Alto Prisma AIRS and import AI security scan results, posture findings, and model validation data into your ServiceNow AI Platform instance.\n        - [Viewing imported data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-prisma-airs-data.md) -- View and work with imported data from the Vulnerability Response Integration with Palo Alto Prisma AIRS integration on records and dashboards in your ServiceNow AI Platform instance.\n        - [Field mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/palo-alto-prisma-airs-mapping.md) -- These tables map Prisma AIRS payload fields to target tables and columns in your ServiceNow ServiceNow AI Platform instance.\n    - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/using-unified-security-exposure-management.md) -- Unified Security Exposure Management provides a comprehensive platform for managing vulnerabilities and ensuring compliance across your organization. By unifying workflows across Vulnerability Response (VR), Application Vulnerability Response (AVR), Container Vulnerability Response (CVR), and Configuration Compliance (CC), you can view all findings in one place, streamline workflows and improve overall efficiency.\n      - [Create a dashboard in the Findings view page](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-dashboard.md) -- As a vulnerability manager and analyst, create a configured dashboard using the visualization library widgets, and use the active widgets to drill down to specific findings.\n      - [Evaluate vulnerability exposure data using generative AI with Security Exposure 360](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-review-vulnerability-exposure-data.md) -- Use the Security Exposure 360 agentic workflow to review vulnerability data about your environment. Vulnerability analysts and remediation owners can enter questions in plain language and receive comprehensive answers about host, container, and test results vulnerabilities.\n      - [AI Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/exploring-ai-security-exposure.md) -- AI Security Exposure Management is a part of the Unified Security Exposure Management product suite of applications. AI Security Exposure Management integrates with third-party AI security products to help you manage various types of potential AI exposure across your environment.\n        - [Using the AI guardrails helper skill and agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/ai-security-exposure-skill-agent.md) -- The AI guardrails helper skill and agentic workflow can help you understand finding types, associated guardrails, and how guardrails map to findings. See what type of findings you have, understand the guardrails associated with findings, and see why the skill to mapped guardrails to particular findings.\n          - [Use the AI guardrails helper agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/ai-security-exposure-use-agent.md) -- Use the AI agent to ask about the guardrails that were identified by the AI skill component in the AI Guardrails Helper, automatically defer findings with existing mitigations in the form of guardrails, or create exception rules to auto-defer future findings.\n          - [Use the AI guardrails helper skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/ai-security-exposure-use-aiskill.md) -- This AI skill can help you identify finding types, understand the guardrails that might be already mapped to findings, and see why they were selected by the skill to map to specific findings. This information can help you determine which findings might be already mitigated or deferred for later review or remediation.\n          - [Components installed with AI Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/installed-with-aisecmanagement.md) -- Components installed with the AI Security Exposure Management application.\n        - [Using Employee Center AI asset remediation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/ai-security-exposure-employee-workflow.md) -- AI Security Exposure Management integrates with Employee Center and third-party security tools to enable AI asset owners to remediate AI posture findings (configuration issues) directly through lightweight tasks. These tasks can reduce time to remediate (TTR) by assigning a task directly to the asset owner.\n          - [Remediate AI exposure tasks in Employee Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/ai-security-exposure-management-employee-task.md) -- Resolve the finding or request an exception from Employee Center AI posture findings.\n      - [Generate vulnerability insights with generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-insights-skill.md) -- Use the Security Exposure Management (SEM) Insights generative AI skill to provide contextual summaries and actionable recommendations in the Security Exposure Management (SEM) Workspace. Use insights based on exposure data, threat intelligence, remediation status, and asset context to surface dynamic insights for findings views. Help admins, analysts, and vulnerability managers prioritize critical risks and take immediate remediation actions.\n      - [Retrieve vulnerability and exposure data with generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/retrieve-vr-data.md) -- Chat with an AI agent to retrieve information about Vulnerability Response (host) and Application Vulnerability Response findings (vulnerable items and application vulnerable items).\n      - [Assess vulnerability exposure with generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/assess-exposure-vr-aiagent.md) -- Chat with an AI agent to help you assess the potential exposure of your configuration items and your business services to vulnerabilities.\n      - [Identify duplicate vulnerable items with generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/dedupe-host-vi-now-assist-vulnerability-response.md) -- Use this generative AI skill to identify the primary (first-found) vulnerable items for configuration items along with duplicate vulnerable items that are imported by your vulnerability scanners.\n      - [Approval recommendations using generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-vr-generating-approvals.md) -- Learn more about the how the Approval Recommendation generative AI skill arrives at its approval recommendations and the sources it uses to generate them.\n        - [Generate approval recommendations with generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-approval-recommendation-skill.md) -- Use a generative AI skill to streamline the approval process for exceptions and false positive requests with AI-driven recommendations. Reduce manual effort and improve decision accuracy for your approvers in the Security Exposure Management Workspace.\n      - [Suggest vulnerability solutions with generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/solutions-now-assist-vulnerability-response.md) -- Use the Approval Recommendation generative AI skill to help your analysts find potential preferred solutions from third-party vendors for the vulnerabilities on your assets.\n      - [Analyze remediation status with generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sla-targets-vr-aiagent.md) -- Chat with an AI agent to help you gain insights into your monthly remediation compliance metrics for vulnerable items.\n      - [Creating an API connector with a generative AI skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/using-now-assist-api-connector.md) -- Developers can use the SPC Setup Connector generative AI skill to help them quickly and automatically create an API connector that they can publish. Use the connector in the Security Posture Control workspace.\n        - [Create API connector with generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/select-api-template.md) -- Use the SPC Setup Connector skill to automatically complete configuration steps 3-5 in the Connector builder in the Security Posture Control Workspace.\n      - [Reclassify unclassed hardware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-reclassify-unclassed-hardware.md) -- Reclassify unclassed hardware by updating the lookup rules.\n      - [Bulk edit in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-workspace-bulk-edit-overview.md) -- In the Security Exposure Management Workspace, the bulk edit feature enables you to update multiple findings simultaneously, streamlining the management and remediation process.\n        - [Using bulk edit in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-using-bulk-edit.md) -- Bulk edit in the Security Exposure Management Workspace enables you to update the state, request exceptions and false positives, assign multiple findings to an assignment group simultaneously, and modify risk ratings.\n          - [Update the state of records in bulk in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-bulk-edit-update-state.md) -- Update the state of multiple findings concurrently according to their remediation progress using the bulk edit feature in the Security Exposure Management Workspace.\n          - [Bulk edit host vulnerable items with patches and solutions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-bulk-edit-patches-solutions.md) -- Recommend a patch or solution for multiple host vulnerable items concurrently using the bulk edit feature in the Security Exposure Management Workspace.\n          - [Assign records to an assignment group in bulk](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-bulk-edit-assign.md) -- Assign multiple records findings concurrently to an assignment group using the bulk edit feature in the Security Exposure Management Workspace.\n          - [Remove assignments for host vulnerable items in bulk](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-bulk-edit-unassign.md) -- Remove yourself or your groups from the  Assigned to  and  Assignment group  fields on the findings if you determine that the records aren’t within your scope for remediation, or if you think that records have been incorrectly assigned to you or to your groups.\n          - [Request bulk exception in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-bulk-edit-request-exception.md) -- Request an exception for multiple findings concurrently using the bulk edit feature instead of manually selecting each record.\n          - [Bulk edit risk modification](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/bulk-edit-risk-reduction.md) -- Use bulk edit risk reduction to request an adjusted risk rating, and optionally apply compensating controls, across multiple vulnerable items that share a single vulnerability.\n          - [Bulk edit risk modification restrictions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/bulk-edit-risk-restrictions.md) -- Risk modification in the Bulk Edit dialog is restricted in specific scenarios based on the vulnerabilities mapped to the selected items and the vulnerability configuration.\n          - [Request risk modification for findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/reduce-risk-bulk-edit.md) -- Create a risk modification request for multiple vulnerable items at once by using the Bulk Edit dialog to specify a desired risk rating and optional compensating controls.\n          - [Bulk edit for false positive in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-bulk-edit-request-false-positive.md) -- Mark one or more records (VITs, AVITs, CVITs, or TRs) as false positive concurrently using the bulk edit feature from the Security Exposure Management Workspace instead of manually selecting each item.\n          - [Close records in bulk in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-bulk-edit-close-records.md) -- Close multiple records (VITs, AVITs, or CVITs) concurrently using the bulk edit feature in the Security Exposure Management Workspace.\n          - [Bulk edit form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-bulk-edit-request-exception-form.md) -- The following table shows the fields on the Bulk Edit modal in the Security Exposure Management Workspace. The fields that appear depend on the State or Risk rating value you select.\n      - [Use the List view in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-ws-list-view.md) -- As a vulnerability manager, security manager and analysts, you can view remediation progress on records, drill down into findings, and view the status of their approval requests and exceptions.\n        - [Create a customized list of records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-custom-list.md) -- You can create a customized list in the Security Exposure Management Workspace.\n      - [Create a remediation task manually in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-remediation-task.md) -- You can create remediation tasks manually from the findings on the List page of Security Exposure Management Workspace. You can also create remediation tasks from the drill-down lists that appear when you click on the visualizations on the Home page.\n      - [Enable or disable the import of test results for a Qualys test group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-enable-disable-imports-qualys.md) -- In Security Exposure Management Workspace control the import of the test results for the tests in a Qualys test group by using the Enable/Disable import button, which is available in the test group's record view.\n      - [Modify the severity for a CVE or TPE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-modify-reset-severity.md) -- As a vulnerability manager or analyst, you can modify the severity level of Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Security Exposure Management Workspace.\n      - [Use Remediation Effort records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-ws-remed-eff-rcd.md) -- When Vulnerability managers and analysts create remediation efforts (REs), remediation Tasks (VUL) are automatically assigned to IT teams for remediation.\n        - [Create a remediation effort in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-rev16.md) -- A remediation effort record is a static list of records that you create from a watch topic in the Security Exposure Management Workspace.\n        - [Create a remediation task on-demand from Remediation Effort in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-rt-frm-re.md) -- Create a remediation task on-demand from a remediation effort. If you create a remediation task on-demand, you choose the records you want to add manually.\n        - [Create a recurring remediation effort in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-recurringRE-steal-VI.md) -- You can create and schedule recurring remediation efforts that are generated automatically on the dates and times that you set.\n        - [Transfer records to remediation efforts in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-transfer-VI-to-RE.md) -- You can transfer records from existing remediation efforts into new remediation efforts in the Vulnerability Manager Workspace.\n      - [Approve or reject requests in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-approve-requests.md) -- Approve or reject requests that are submitted by remediation owners.\n      - [Modify the risk rating for a finding or remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-modify-risk.md) -- Change the risk rating for a host vulnerable item, application vulnerable item, container vulnerable item, or remediation task in the Security Exposure Management Workspace.\n        - [Modify risk and Request risk modification form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-modify-risk-form.md) -- The following table shows the fields on the Modify risk and Request risk modification dialogs.\n      - [Add a compensating control to the library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-compensatory-control.md) -- As a Vulnerability Manager or Analyst, add a list of compensatory controls to the Compensating Controls library in the Security Exposure Management Workspace, which can be applied for the risk reduction of host vulnerable items and remediation tasks.\n        - [Associate compensating controls with CVEs or TPEs for risk reduction requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-associate-controls-cve-risk-reduction.md) -- As a Vulnerability Manager or Analyst, you can associate relevant compensating controls with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Security Exposure Management Workspace, which can be used for reducing the risk posed by a vulnerability.\n        - [Disable or enable risk reduction for a CVE or TPE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-disable-risk-reduction.md) -- As a Vulnerability Manager and Analyst, you can disable or enable the risk reduction requests for the host vulnerabilities associated with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Security Exposure Management Workspace.\n      - [Examples for remediation task creation in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-remediation-task-examples.md) -- When you create remediation tasks manually in the Security Exposure Management Workspace, records are grouped into a remediation task based on the grouping criteria you select.\n      - [Exception Management Overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-exception-management-overview.md) -- When your organization can't comply with a published finding or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to a finding or remediation task (RT) that can’t be remediated.\n        - [Approver roles required for Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-approve-or-reject-request.md) -- You can see the required roles for the approvers in the Security Exposure Management Workspace.\n        - [Questionnaire support in Exception Management via Smart Assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-smart-assessment-exp-management.md) -- Configure advanced questionnaires as part of the exception management process using Smart Assessment. This enables Remediation Owners to provide more detailed context for Exception Requests and enables Approvers to configure conditional questions to gather information for informed decision making.\n          - [Questionnaire Configuration form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-compensating-controls-approval-rule.md) -- You can define distinct questionnaire for a distinct collection of vulnerabilities or remediation tasks by filtering the vulnerabilities or remediation tasks respectively.\n          - [Configure an assessment template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-assessment-template.md) -- Assessment templates contain the questions prompted during the request process (such as, when requesting an exception). The above-mentioned preconfigured templates are provided with smart assessment. You can also create your own templates as required.\n          - [Use case for False positive or Request Exception Questionnaire](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-ques-for-false-positive-or-request-exp.md) -- Scenario when the questionnaire for False Positive or Request Exception is raised but not filled completely.\n        - [Defer a Remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-defer-rem-task.md) -- If you identify a finding or remediation task for which a fix is not yet available and can be safely deferred without additional analysis, you can use the Request Exception feature.\n        - [Request an extension for a deferred remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-extend-defer-rem.md) -- As a remediation owner, you’re no longer required to wait until the deferred due date to make this request. Request an extension for a deferred remediation task before it reaches its deferred until due date.\n        - [Request a false positive for a vulnerable item or remediate task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-falsepst-reqst.md) -- Indicate a false positive request for a finding or a remediation task in the Security Exposure Management Workspace. A false positive is a condition where a scanner incorrectly reports that a finding exists in the system due to situations such as an incorrect classification, improper logic, or an algorithm in the scanner.\n      - [Unified Approvals View](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-approval-view.md) -- The approval process in Security Exposure Management for vulnerability and compliance exceptions is unified to simplify workflows, improve visibility, and streamline actions for Approvers.\n        - [Add an approver](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-add-false-positive-approver.md) -- Users added to the False Positive, Unassign, Exception Approver group can approve findings and remediation tasks (VULs). Granting a false positive, unassign, exception is a single-level approval process.\n        - [Configure Approval List and Form View](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-approval-view.md) -- Optimize the review and approval process by configuring list views and form layouts for unified exception and approval management.\n        - [Reviewing an Approval Request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-review-approval-request.md) -- Review an approval request form to perform the required action according to the role assigned to you.\n        - [Review questionnaire to approve or reject requets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-smart-assessment-flow.md) -- Approvers review the questionnaire and make approval/rejection decisions based on the provided information. Remediation owners must fill out the questionnaire before submitting for approval, if questionnaire configuration was selected during exception rule configuration..\n      - [Employee service center for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/employee-center-vr-overview.md) -- Employee Service Center provides a standardised approval experience and process for Business Unit Heads, Service Owners, and IT Heads, who may not regularly log in to USEM. It enables them to manage approvals from a central location, such as Employee Center Approval Requests, ensuring that requests are routed to the right approvers, decisions are tracked transparently, and actions are completed efficiently. This improves operational efficiency, accountability, and the overall approver experience.\n        - [Managing Approvals via the Employee Service Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/manage-approvals-ec.md) -- The updated Employee Service Center experience consolidates vulnerability approvals under one interface.This allows customers to efficiently manage security exceptions without navigating multiple systems or UIs.\n      - [Unified Approval Rules Overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-approval-rules-overiew.md) -- The approval rules and approval configuration are unified to provide a consistent approach to managing approval workflows.\n        - [Create or edit approval rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-configure-approval-rules-list-and-form-view.md) -- Create and activate an approval rule by selecting a rule type, choosing the target tables, defining conditions, and configuring approval levels.\n        - [Create or edit approval levels](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-create-or-edit-approval-levels.md) -- Define the levels of users and user groups that are going to approve the exception requests.\n      - [Create a change request in the Remediation view](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-ws-CRs.md) -- From a remediation task (VUL, AVUL, CVUL, or CRG), create a change request. Alternatively, add a remediation task to an existing change request.\n    - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/unified-security-exposure-management-reference.md) -- Reference topic contains information about tables, roles, scheduled jobs and properties installed with the Unified Security Exposure Management application. It also includes additional references.\n      - [References for generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-vulnerability-response-reference.md) -- Tools, agents, and AI agent collection information for ServiceNow Otto for Unified Security Exposure Management.\n        - [Prompts for the Retrieve Vulnerability Response data agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-vr-retrieve-qbank.md) -- The following sample prompts might help you become familiar with the Retrieve Vulnerability Response data agentic workflow.\n        - [Remediation workflow AI agent collection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-vr-sla-target-usecase.md) -- The tools and AI agents for the Analyze vulnerability remediation status agentic workflow.\n        - [Assess vulnerability agentic workflow AI agent collection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/now-assist-vr-exp-assess-usecase.md) -- The tools and AI agents for the Assess vulnerability exposure agentic workflow.\n      - [Security Exposure Management Workspace Components](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-components-installed.md) -- When you activate the Unified Security Exposure Management (USEM) and Security Exposure Management Workspace applications, the system installs specific key components including tables, user roles, and scheduled jobs to support the operations required for assessing and managing security exposures.\n        - [Security Exposure Management Workspace Roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-new-roles-installed.md) -- List of roles installed with Security Exposure Management, defining user permissions and access for Security Exposure Management-related tasks.\n        - [Security Exposure Management Workspace Tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-new-tables-installed.md) -- The following are the tables installed with Security Exposure Management. These tables store Security Exposure Management-related configuration, rules, findings, and other data required for exposure assessment, remediation, scoring, and exception management.\n        - [Security Exposure Management Workspace Scheduled Jobs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-new-scheduledjobs-installed.md) -- The following are the scheduled jobs installed with Security Exposure Management. These jobs automate Security Exposure Management operations to ensure that exposure data is kept current and accurate.\n      - [Security Exposure Management Knowledge Base articles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-kb-list.md) -- This section provides a curated list of essential ServiceNow Knowledge Base (KB) articles related to Security Exposure Management. These resources cover best practices, compatibility details, and workflow guidance for managing security exposures effectively.\n      - [Migration upgrade reference information](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-migration-prereq-reference-data.md) -- Lists and tables of scheduled jobs, table deprecations, and new columns added to existing tables for migration to Security Exposure Management Workspace.\n      - [Security Exposure Management Workspace Roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-new-roles-installed.md) -- List of roles installed with Security Exposure Management, defining user permissions and access for Security Exposure Management-related tasks.\n      - [Visualization widget fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sem-vis-widget-fields.md) -- Use this reference to understand the fields available on the Visualization widget form. These fields define how the widget appears, behaves, and groups data.\n    - [Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln-landing-page.md) -- The National Vulnerability Database (NVD) and other sources collect information about known vulnerabilities. These vulnerabilities can include weaknesses in software, operating systems that malware can exploit, and other attacks. The ServiceNow Vulnerability Response application aids you in tracking, prioritizing, and resolving these vulnerabilities.\n      - [Exploring the Vulnerability Response application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_VulnerabilityResponse.md) -- The ServiceNow Vulnerability Response application imports and automatically groups vulnerable items according to rules that permit you to remediate vulnerabilities quickly. Vulnerability data is pulled from external sources, such as the National Vulnerability Database (NVD) and third-party integrations, and processed with applications developed by ServiceNow.\n        - [Migrating to USEM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/migrating-to-usem.md) -- The Migration assistant for Unified Security Exposure Management is a centralized utility that guides and automates the migration from Vulnerability Response applications to Unified Security Exposure Management (USEM). USEM provides a unified foundation that consolidates data models, streamlines features, and enhances performance and scalability across all Security Exposure Management applications.\n          - [USEM migration planning](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/usem-migration-planning.md) -- When upgrading to Unified Security Exposure Management (USEM) v30.0, you can choose between two primary methods: the Migration assistant for Unified Security Exposure Management and the Store App Manager. This topic outlines the capabilities of each method across key migration steps.\n        - [Installation of Vulnerability Response and supported applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cj-vr-setup.md) -- The Vulnerability Response application is available from the ServiceNow Store. The application supports other ServiceNow applications and third-party integrations that you also download from the ServiceNow Store. More options also are available to extend the basic setup.\n        - [Vulnerability Response personas and granular roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-persona-overview.md) -- Before you can successfully remediate vulnerabilities with the Vulnerability Response application, you must assign personas and roles to your users and groups in Setup Assistant.\n        - [Vulnerability Response remediation tasks and remediation task rules overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerability-groups.md) -- Configure remediation tasks (VULs) to help analysts and remediation specialists organize vulnerable items (VI) and analyze them in bulk. The criteria by which remediation tasks are formed is configured so that you do not have to manually assign vulnerable items into remediation tasks. Using remediation tasks, you can monitor progress and drive the remediation process more efficiently.\n        - [Vulnerability Response remediation target rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/time-to-remediate-rules.md) -- Remediation target rules define the expected time frame for remediating vulnerable items (VI), much like SLAs provide a time frame for remediating the vulnerability itself. For example, if an asset contains PCI data (credit card data) then the vulnerability on that item must be fixed within 30 days according to PCI DSS.\n        - [Machine Learning solutions for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ml_vr.md) -- Vulnerability Assignment Recommendations uses ServiceNow Predictive Intelligence and machine learning to recommend assignment groups for vulnerable items (VIs) and remediation tasks (VULs, or RTs). You can reduce the time that you spend on identifying the owners for unassigned or incorrectly assigned vulnerability findings. Also, you can see a system-generated confidence score that evaluates if the recommended assignment group is suited to resolve the vulnerability.\n        - [Discovered Items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cj-discovered-items.md) -- Assets are automatically matched to configuration items (CIs) in the Configuration Management Database (CMDB) when they are imported using CI Lookup Rules. Discovered Items give you visibility into how asset identification is mapped to CIs in the CMDB.\n          - [CI changes for discovered items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/reapply-discovered-items-ci-changes.md) -- When a configuration item (CI) on a discovered item (DI) changes, the impacted detections and vulnerable items (VIs) are updated. The risk score, assignment rules, group rules, and remediation target rule are reevaluated.\n          - [Re-evaluating discovered items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/re-evaluate-discovered-items.md) -- When new data is received on a discovered item, the discovered item is not immediately re-evaluated. On receiving new data, the reevaluate_ci option is set to true by default.\n        - [Vulnerability Response remediation task and vulnerable item states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerabillity-states.md) -- With the Vulnerability Response application, you can use the state model to see the status of a remediation task, at any given time. Knowing how each state relates to and affects each other helps you to determine when and how to remediate your vulnerable items (VIs).\n          - [Vulnerable item age calculation and display](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-vi-calcVI-age.md) -- The age of vulnerable items (VIs) is displayed in the Vulnerability Response application with more detail.\n        - [Removing assignments from vulnerable items and remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/Unassigning_vis.md) -- You can clear the Assigned to and Assignment group fields on vulnerable items directly from the vulnerable item and remediation task records that you determine might be incorrectly assigned to you or your groups.\n        - [Vulnerability Response calculators and vulnerability calculator rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln-calculators-rules.md) -- Vulnerability calculators automate calculating initial values for the fields on vulnerable items. The condition for each calculator is evaluated in order, and the first matching calculator is used.\n        - [Vulnerability Response vulnerable item detections from third-party integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr_host_detections.md) -- View all of the information that is gathered by third-party scans in your ServiceNow AI Platform instance. View the returned results of the scans on detection and vulnerable item (VI) records in your instance as these results are viewed on the scanners.\n        - [Vulnerability Solution Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln-solution-mgmt.md) -- Vulnerability Solution Management automates the correlation of vulnerabilities in your environment with the solutions that can remediate them. It identifies the patches, configuration updates, and controls with the highest impact for your organization, eliminating the need for manual research.\n          - [Microsoft Security Response Center Solution Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mscr-integration.md) -- Review and implement proposed remediation solutions provided by the Microsoft Security Response Center Solution Integration.\n          - [Red Hat Solution Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/redhat-integration.md) -- You can review and implement proposed remediation solutions provided by the Red Hat Solution Integration in the Vulnerability Response application.\n          - [Rapid7 solution management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/rapid-7-solution-management.md) -- Solutions are known remediations that are imported into your Rapid7 Vulnerability Integration from either the Rapid7 data warehouse or Rapid7 InsightVM. Rapid7 data warehouse imports both solutions and superseding solutions. With Rapid7 InsightVM, you get solutions as part of the Rapid7 Vulnerable Item Integration - API.\n          - [Generic framework to ingest data from any solution vendor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ingest-data-solution-vendors-generic-framework.md) -- A generic framework for solution intelligence integration is available to support ingestion of data in different file formats from solution vendors. These formats speed up information exchange and processing and facilitate the sharing of critical security-related information in a standardized reporting format.\n        - [Patch orchestration with Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/patch-orch-legacy-overview.md) -- You can manage patches and patch deployments for critical vulnerabilities for large groups of your assets with Patch orchestration with Vulnerability Response. Vulnerability Response Patch Orchestration and the patch orchestration integrations are available on the ServiceNow Store.\n        - [Exception Management overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-exception-management.md) -- When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to a vulnerable item (VI) or remediation task (RT) that cannot be remediated according to the policy.\n        - [Exception rules overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vi-classification-rule-based.md) -- Exception rules for Vulnerability Response enable you to automate the deferral process for vulnerable items (VIs). Request an exception for the vulnerable items (VIs) that can't be remediated or deferred immediately, by identifying the impacted vulnerabilities, configuration items (CIs), or VIs. Defer the matching VIs based on the rule when the system identifies them by automating the VI deferral process.\n        - [False Positive overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-false-positive.md) -- A false positive is a condition wherein the scanner reports that a vulnerability exists in the system, but in reality there is no vulnerability. There can be multiple reasons like incorrect classification, improper logic or algorithm in the scanner. The remediation owner can mark vulnerable items (VIs) or remediation tasks (RTs) as false positives.\n        - [Questionnaire support in Exception Management via Smart Assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-exception-management-smart-assessment.md) -- Configure advanced questionnaires as part of the exception management process using Smart Assessment. This allows Remediation Owners to provide more detailed context for Exception Requests and enables Approvers to configure conditional questions to gather information for informed decision making.\n          - [Configure Assessment template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-assessment-template.md) -- Assessment templates contain the questions that will be prompted during the request process (such as, when requesting an exception). The above-mentioned preconfigured templates are provided with smart assessment. You can also create your own templates as required.\n          - [Smart Assessment workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/smart-assessment-workflow-integration.md) -- Remediation owners must fill out the questionnaire before submitting for approval. Approvers review the questionnaire and make approval/rejection decisions based on the provided information.\n          - [Questionnaire for False positive or Request Exception](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/questionnaire-for-false-positive-or-request-exception-in-vr.md) -- When the questionnaire for False Positive or Request Exception is raised but not filled copmpletely.\n        - [Watchdog for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/watchdog-overview.md) -- The watchdog is used to track tables based on the conditions you specify. For example, it can be used to log details of integration run failures in Vulnerability Response.\n        - [Change management for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln-change_mgmnt_ovrvw.md) -- As an IT remediation owner, you can create and manage change requests (CHG) directly from remediation tasks (RT) in the Vulnerability Response application. Change requests help you initiate and track change activities on your assets so that you can remediate your remediation tasks and their corresponding vulnerable items.\n        - [Software exposure assessment using Software Asset Management (SAM Foundation)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr_sw_expsure_ovrvw.md) -- Use the ServiceNow Vulnerability Exposure Assessment application to determine your total installed software count for a specific software package on your assets. When used with the ServiceNow Software Asset Management (SAM) Foundation application, evaluate your exposure, create vulnerable items, and manage remediation for the vulnerable software you discover.\n        - [Vulnerability Crisis Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerability-crisis-management.md) -- Create and track critical vulnerability events through the Vulnerability Crisis Management (VCM) workflow. Create vulnerability assessment records, record key attributes of the vulnerability to calculate risk, perform assessment to identify exposure level, and engage stakeholders for a coordinated and swift response to vulnerabilities.\n        - [Domain separation and Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/domain-separation-vulnerability-response.md) -- Domain separation is supported in Vulnerability Response. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n        - [Service Mapping in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/service-mapping-vr.md) -- Service mapping helps organizations gain a comprehensive understanding of your IT infrastructure and the relationships between various components. It enables automatic discovery and mapping of services, applications, and infrastructure components, providing a visual representation of the dependencies and relationships.\n      - [Vulnerability Response implementation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr_implement-ovrview.md) -- Use the steps illustrated in the following images to download the Vulnerability Response application from the ServiceNow Store, install it on your ServiceNow AI Platform instance, and configure it using the Setup Assistant.\n        - [Migrate to USEM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/migrate-to-usem.md) -- Use the Migration assistant for Unified Security Exposure Management tool to migrate to the Unified Security Exposure Management (USEM) platform for a smooth and secure transition.\n        - [Install Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/install-and-configure-vr.md) -- Before you run the Vulnerability Response application in your ServiceNow AI Platform instance, you must get entitlement and download the application from the ServiceNow Store, install it on your ServiceNow AI Platform instance, and activate it.\n          - [Components installed with Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/installed-with-vr.md) -- Several types of components are installed with activation of the Vulnerability Response application, including tables, user roles, and scheduled jobs.\n        - [Configuring Vulnerability Response using the Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cj-setup-assistant.md) -- Setup Assistant walks you through setting up Vulnerability Response and certain third-party integrations for your environment. Setup Assistant provides almost everything you need to install and set up your environment so that you can use Vulnerability Response.\n          - [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-assign-personas_SA.md) -- Assign the Vulnerability Response persona roles to groups or users with Setup Assistant.\n            - [Configure filter values for ENISA European Union Vulnerability Database (EUVD) and Japanese Vulnerability Notes (JVN) integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cvd-configure-filter-values-euvd-jvn.md) -- Before activating the EUVD or JVN integrations, configure filter values and scheduled job parameters to control how vulnerability data is retrieved and processed.\n            - [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr_manage_granular-roles.md) -- After you complete your initial assignment of persona roles using Setup Assistant, manage additional granular role assignments to users or groups from the User Administration module in your instance.\n          - [Install Vulnerability Response third-party applications using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-installapp-setup-asst.md) -- Install the third-party integration applications you have entitlement for in Vulnerability Response using the Setup Assistant.\n            - [Importing data with the NVD and CWE integrations and managing third-party libraries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_NVDAndCWEDataImport.md) -- If not already installed, download and run the NVD integration and run the CWE scheduled job as part of your initial setup of Vulnerability Response and prior to importing vulnerability data into your instance with a third-party scanner product. The Vulnerability Response Integration with NVD is available on the ServiceNow Store.\n            - [Install the Solution Management for Vulnerability Response application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/install-and-configure-solution-mgmt.md) -- Remove if the plugin goes away.Before you can use the Solution Management for Vulnerability Response feature of Vulnerability Response in your instance, you must complete the installation of the Vulnerability Solution Management application. This application is available as a separate subscription in the ServiceNow Store.\n            - [Install Performance Analytics for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/install-and-configure-vr-analytics.md) -- Before you can use the Performance Analytics for Vulnerability Response application, you must get entitlement and download the application from the ServiceNow Store, install it on your ServiceNow AI Platform instance, and complete a few installation and configuration steps. The PA application is not installed as part of the Vulnerability Response application. It is available as a separate subscription.\n          - [Vulnerability Response applications and CSDM tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-avr-sbom-csdm-guidelines.md) -- The Vulnerability Response, Application Vulnerability Response, third-party vulnerability integrations and Software Bill of Materials applications manage (contribute data to) CSDM tables. These applications also use data from CSDM tables that other applications generate. Several ServiceNow products, therefore, benefit from and add value to these Security Operations applications.\n          - [Create or edit Vulnerability Response assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-vul-assign-rules.md) -- After you complete your initial assessment of assignment rules using Setup Assistant, you can create rules to automatically assign vulnerable items based on filter conditions. These rules assign vulnerable items as they are imported or manually created.\n          - [Create a Vulnerability Response assignment rule using ML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-vr-assignment-rule-with-ml.md) -- Use the following script to create a catch-all assignment rule for vulnerable items that uses ML recommendations from Predictive Intelligence to automatically assign them for remediation.\n          - [Create a Vulnerability Response assignment rule for service support](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-vr-assign-rule-svc-support.md) -- Use the following script to create a rule that assigns vulnerable items for remediation based on the business services they impact.\n          - [Create or edit Vulnerability Response remediation task rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-vul-group-rules.md) -- After you complete your initial assessment of remediation task rules using Setup Assistant, you can create rules to automatically group vulnerable items based on filter conditions. These rules automatically group vulnerable items as they are imported or manually created. Use the filter to limit the vulnerable items grouped by this rule, such as selecting all vulnerable items with exploits.\n          - [Define fields and weights for the risk rule for Vulnerability Response Risk Calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln-calc-define-risk-rule-fields.md) -- Customize the parameters and weights for the risk rule so that you can generate risk scores that use the vulnerability and asset data that are unique to your organization. By selecting the fields that are included in the risk rule, you can define an effective risk scoring framework.\n          - [Vulnerability Response Rollup Calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln-rollup-calculator.md) -- After your initial assessment of risk calculators in the Setup Assistant, use the vulnerability rollup calculators to configure how the cumulative risk score is computed for remediation tasks and imported vulnerabilities.\n          - [Create or edit a Vulnerability Response remediation target rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-time-to-remediate-rule.md) -- Set up remediation target rules after completing your initial assessment in the Setup Assistant. Vulnerability managers can set up a remediation target rule at the vulnerable item level to drive the remediation of high-risk vulnerabilities in a timely manner. When the remediation date for a vulnerable item is approaching, the system sends a notification to the users or groups specified in the rule.\n            - [Recalculate RT date](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/sem-recalculate-rt-date.md) -- The remediation target (RT) date defines when a finding must be remediated. Recalculation verifies that RT dates stay accurate and reflect the latest risk rating updates. When a finding’s risk rating changes, the system can recalculate RT dates using the most recent update date, helping maintain accurate SLAs and avoid outdated or overdue target dates.\n              - [Examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/sem-recalculate-rt-date-examples.md) -- The following examples show how the system recalculates the remediation target date based on different rule selections and risk rating changes.\n          - [Configure installed third-party integrations using the Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-setup-asst-config-thrid-party.md) -- Configure Vulnerability Response to work with each of your installed third-party application deployments.\n            - [Configure installed solution integrations for Vulnerability Solution Management using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr_SA_manage_supported_apps.md) -- After you install the Vulnerability Solution Management application, you can configure your vulnerability solution providers using Setup Assistant.\n            - [Configure the MS TVM Vulnerability Integration using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-vr-config-in-SA.md) -- Configure the Vulnerability Response integration with Microsoft Threat and Vulnerability Management (MS TVM) application, after you install it using the Setup Assistant.\n            - [Configure the Qualys Vulnerability Integration using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-config-in-SA.md) -- After you have installed the Qualys application, configure it using the Setup Assistant.\n            - [Configure the Tenable Vulnerability Integration using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-tenable-config-in-SA.md) -- After you have installed the Vulnerability Response Integration with Tenable application, configure it using the Setup Assistant.\n          - [Setting up vulnerability solution providers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/setup-vulnerability-solution-providers.md) -- Set up vulnerability solution providers by following the checklist and then configuring the providers in the Setup Assistant.\n            - [Prepare solution integration checklist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/prepare-solution-integration-checklist.md) -- Use the Setup Assistant to prepare for implementing a solution intelligence integration for all the vendors that support the Common Vulnerability Reporting Framework (CVRF) or Common Security Advisory Framework (CSAF) data format.\n              - [Preparing the Common Vulnerability Reporting Framework (CVRF) solution integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/prepare-cvrf-solution-integration.md) -- Use the Setup Assistant to prepare for implementing a solution intelligence integration for all the vendors that support the Common Vulnerability Reporting Framework (CVRF) data format.\n              - [Preparing the Common Security Advisory Framework (CSAF) solution integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/prepare-csaf-solution-integration.md) -- Use the Setup Assistant to prepare for implementing a solution intelligence integration for all the vendors that support the Common Security Advisory Framework (CSAF) data format.\n            - [Configure vulnerability solution providers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-vulnerability-solution-providers.md) -- After you install the Vulnerability Solution Management application, configure the vulnerability solution providers by using the Setup Assistant.\n              - [Common Vulnerability Reporting Framework (CVRF)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cvrf-common-vulnerability-reporting-framework.md) -- The Common Vulnerability Reporting Framework (CVRF) offers a standardized framework for the creation of vulnerability report documentation. It’s an XML-based language that simplifies the sharing of crucial security-related information among diverse stakeholders across multiple organizations. By utilizing the CVRF format, information exchange and processing can be expedited.\n                - [Import Common Vulnerability Reporting Framework data through file import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/import-cvrf-file.md) -- Import a CVRF file to view data in the CVRF format. Importing is a one-time activity.\n                - [Configure Connection and Credential aliases](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-connection-credential-aliases.md) -- Configure Connection and Credential aliases to authenticate vendors. In advisory parsing, third-party vendors are authenticated.\n                - [Configure a Common Vulnerability Reporting Framework vendor other than Cisco](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-cvrf-vendor.md) -- Configure a Common Vulnerability Reporting Framework (CVRF) vendor other than Cisco with API support.\n                - [Import Common Vulnerability Reporting Framework data from advisories](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/import-solution-advisories.md) -- Import CVRF data from advisories by configuring the vendor URL with import type as API.\n                - [Import Common Vulnerability Reporting Framework (CVRF) data through CVRF URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/import-cvrf-url.md) -- Import CVRF data by configuring the vendor URL in the Setup Assistant.\n                - [Troubleshooting Common Vulnerability Reporting Framework data import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/troubleshooting-cvrf-data-import.md) -- Troubleshooting actions can help resolve common issues when importing CVRF data in the Vulnerability Response application.\n              - [Common Security Advisory Framework (CSAF)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/csaf-overview.md) -- When used with Vulnerability Solution Management, the Common Security Advisory Framework (CSAF) enables automation security notifications through a machine-readable JSON format.\n                - [Import Common Security Advisory Framework data through file import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/import-csaf-file.md) -- Import a CSAF file to view data in the CSAF format. Importing is a one-time activity.\n                - [Configure Connection and Credential aliases for the Common Security Advisory Framework (CSAF)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-connection-credential-aliases-csaf.md) -- Configure Connection and Credential aliases to authenticate vendors. In advisory parsing, third-party vendors are authenticated.\n                - [Configure a Common Security Advisory Framework vendor other than Red Hat](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-csaf-vendor.md) -- Configure a Common Security Advisory Framework (CSAF) vendor other than Red Hat with API support.\n                - [Import Common Security Advisory Framework data from advisories](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/import-solution-advisories-csaf.md) -- Import CSAF data from advisories by configuring the vendor URL with import type as API.\n                - [Import Common Security Advisory Framework (CSAF) data through CSAF URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/import-csaf-url.md) -- Import CSAF data by configuring the vendor URL in the Setup Assistant.\n                - [Troubleshooting Common Security Advisory Framework data import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/troubleshooting-csaf-data-import.md) -- Troubleshooting actions can help resolve common issues when importing CSAF data in the Vulnerability Response application.\n        - [Additional Vulnerability Response setup and configuration tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/setup-tasks-additional.md) -- To help you with remediation, you can perform these additional administrative setup tasks as part of your configuration outside of the basic setup. You perform these tasks outside of the Setup Assistant.\n          - [Quick start tests for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/quick-start-tests-vr.md) -- Validate that Vulnerability Response still works after you make any configuration change such as apply an upgrade or develop an application. Copy and customize these quick start tests to pass when using your instance-specific data.\n            - [Run the Automated Test Framework (ATF) test suite for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-run-vr-atf-suite.md) -- Run the Automated Test Framework (ATF) test suite after you install or upgrade the Vulnerability Response application.\n          - [Install Vulnerability Assignment Recommendations for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ml-install-and-configure-vul-assign-rec.md) -- Install Vulnerability Assignment Recommendations so that you can reduce the time that you spend on identifying owners for vulnerability findings that are unassigned or incorrectly assigned. This application is available as a separate subscription in the ServiceNow Store.\n            - [Configure Vulnerability Assignment Recommendations for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ml-config-assignment-rec.md) -- Enable Vulnerability Assignment Recommendations to reduce the time that you spend on identifying the owners for vulnerability findings that are unassigned or incorrectly assigned.\n            - [Create and train a solution definition for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ml-train-sol-definition.md) -- Create and train a solution definition model for Vulnerability Response by using Predictive Intelligence. You can use this model to predict the assignment group for a vulnerable item (VI) or remediation task (RT) based on existing data.\n          - [Create a Vulnerability Response calculator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-vul-calculator.md) -- A vulnerability calculator is a pre-defined formula to calculate a target field when certain criteria are met. Calculators, which calculate the vulnerable item Risk Score, can contain Risk Rules.\n            - [Disable the default vulnerability calculator if not used](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/disable-vuln-calcs.md) -- If you do not use vulnerability calculators, disable the default calculator, in addition to any others you have defined. Vulnerability calculators run every time a vulnerable item record is created or updated, and can impact initial import performance.\n          - [Create, enable, or, modify Vulnerability Response auto delete rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/enable-auto-del-vi-vg.md) -- You can create, enable, or, modify the delete vulnerability item (VI) and remediation task (RT) delete rules. Use auto delete to remove older records from the VI and RT tables.\n          - [Add vulnerability significance charts to the Vulnerability Response homepage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/t_AddVulnSign.md) -- You can add vulnerability significance definition charts and other visualizations to the Overview.\n          - [Define Vulnerability Response email notifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/t_DefineEmailNotifications.md) -- Set up email notifications to share useful information about important updates and activities such as approval and rejection of false-positive requests. Creating an email notification involves specifying when to send it, who receives it, and what it contains.\n            - [Define Vulnerability Response email templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/t_DefiningEmailTemplates.md) -- Creating an email notification involves specifying when to send it, who receives it, and what it contains.\n            - [Create or edit remediation target notifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-remediation-notification.md) -- Vulnerability administrators can edit the remediation target notification or add new ones, specifying when to send the notification, who receives the notification, and what content is in the notification.\n          - [Configure the Vulnerability Exposure Assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln_sw_expsure_task.md) -- Assess the zero-day (current day) exposure of your assets to vulnerable software with the Vulnerability Exposure Assessment application.\n          - [Configure Exception Management for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-exception-management-settings.md) -- When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to a vulnerable item (VI) or remediation task (RT) that cannot be remediated according to the policy.\n            - [Add an exception approver](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/add-exception-approver.md) -- Add users to the approver groups so that you can request an exception.\n          - [Configure approval rules for Exception Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/exception-mgt-approval-rules.md) -- Starting with Vulnerability Response v15.0, use the flow designer to approve exception requests for exception management, exception rules, and false positive management. If you are deploying Vulnerability Response (VR) for the first time, the flow designer is enabled by default.\n            - [Create configurations for an approval rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/exception-mgt-approval-config.md) -- Define the conditions to filter out matching vulnerable items, remediation tasks, or exception rules for an approval level.\n            - [Create approval levels for Exception Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/exception-mgt-config-approval-rule.md) -- Define the levels of users and user groups that are going to approve the exception requests.\n            - [Exception management workflow versus flow designer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ex-mgt-flow-designer-vs-workflow.md) -- Starting with Vulnerability Response v15.0, if you are deploying Vulnerability Response (VR) for the first time, the flow designer for approving exception requests in exception management is enabled by default. If you are an existing VR user, the default option is workflow.\n          - [Add a false positive approver](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/grant-fp-approver-rights.md) -- Only users added to the False Positive Approver group can approve false positives for vulnerable items (VIs) and remediation tasks (VULs). Granting a false positive is a single-level approval process.\n          - [Configure questionnaire for risk reduction](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-approval-rules-risk-reduction.md) -- Starting with Vulnerability Response v20.0, you can customize risk reduction request's questionnaire for a set of filtered vulnerable items or remediation tasks.\n          - [View Vulnerability Response SLAs for remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/t_CreateVulnSLA.md) -- To ensure that vulnerable items are processed correctly, you can define a Service Level Agreement (SLA) for Vulnerability Response remediation tasks.\n          - [Configure watchdog](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/watchdog-configure.md) -- Use the watchdog configuration page to create new or update existing watchdogs with conditions that you want to specify. You can enable the notification for each watchdog, and get notified when the conditions are met.\n          - [Configure maximum rows in related list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-max-rows-rel-list.md) -- Control the number of rows that appear in related lists to reduce load time and improve readability and performance across Vulnerability Response (VR), Configuration Compliance (CC), Cloud Vulnerability Response (CVR), and Application Vulnerability Response (AVR). The related lists display associated records, such as affected CIs, findings, or remediation tasks so that you can quickly access relevant details without leaving the form.\n        - [Advanced Vulnerability Response configuration tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/setup-tasks-optional.md) -- The following setup tasks require coding or advanced ServiceNow expertise and are not considered part of the basic configuration.\n          - [Create domain-separated imports for an integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-domain-separated-imports.md) -- If you require imported data to be in a specific domain, the user assigned to run the integrations must belong to that domain.\n            - [Create and support multiple domains in the background jobs framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-support-multiple-domains.md) -- Background jobs in vulnerability response products are designed to run for long periods of time to perform multiple processes on your records. The background job processors are shipped with the base system that run via the system user and create records in the global domain.\n          - [Create a Vulnerability Response CI lookup rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-ci-identifier-rules.md) -- The CI Lookup Rules module contains rules that are used to find the matching record for host information received during third-party vulnerability integration imports. The host information is matched with the discovered items, unmatched configuration item classes, and the Configuration Management Database (CMDB).\n            - [Ignore CI classes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ignore-CI-classes.md) -- To ignore some configuration item (CI) classes, for example Load Balancer [cmdb_ci_lb], when running CI Lookup Rules, set the ignoreCIClass [sn_sec_cmn.ignoreCIClass] system property.\n            - [Filter decommissioned CIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/filter-decommissioned-ci.md) -- Filter decommissioned configuration items (CIs) while running the CI lookup rules. To filter decommissioned CIs when running the Security Operations CMDB CI lookup rules, set the filterOutDecommissionedCI [sn_sec_cmn.filterOutDecommissionedCI] system property to true.\n            - [Auto-promote CIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/auto-promote-ci.md) -- Edit the JSON string in the autoPromoteFields [sn_sec_cmn.autoPromoteFields] system property so your configuration item (CI) lookup rules auto-promote all the Security Operations CMDB CIs to matching entries in the [cmdb_ci] table.\n          - [Detection key configurations for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/detection-key-configurations-for-vr.md) -- Use configurable detection keys to choose between Asset ID and Configuration Item, with validations, UI controls, and a schedule job to update existing detections.\n            - [Run detection key configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/run-detection-key-configuration.md) -- Use the revised detection key to update the existing detections and vulnerable item records.\n          - [Configure the vulnerable item key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-configure-vi-key.md) -- Configure the granularity of the vulnerable item (VIT) key in the Vulnerability Response application to define what makes a vulnerable item (VIT) in your organization.\n            - [Adding proof to Rapid7 vulnerable item keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/add-proof-to-vi-key-rapid7.md) -- Add proof as a vulnerable item (VI) key for the Rapid7 VIs. Including the proof for specific vulnerabilities enables the Rapid7 scanner integration to create VIs for each proof received from Rapid7.\n            - [Delete all your vulnerable item records and related data in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-vi-key-returndefault.md) -- Permanently remove all Vulnerability Response data (vulnerable items or vulnerable item detections) and related data and records from the from the Vulnerability Response application in your ServiceNow AI Platform instance.\n          - [Filtering within Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-filtering.md) -- Remediation Task Rules, Calculators, and Assignment Rules use conditions during import, created using the Condition builder. Changes to their criteria can affect performance since each record is evaluated using these filters.\n          - [Severity mapping for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerability-response-severity-mapping.md) -- Vulnerability Response ships with National Vulnerability Database (NVD) to normalized ServiceNow severity mapping. ServiceNow third-party integrations provide severity mappings upon installation. These maps can be adjusted by changing the fields in existing maps.\n          - [Create a Vulnerability Response severity map](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-severity-map.md) -- Vulnerability Response severity mapping transforms third-party source severity fields to recognizable fields in Vulnerability Response.\n          - [Define service classifications for Vulnerability Response reporting and related lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/define-service-classification.md) -- Bring more focus to reporting and related lists in Vulnerability Response by defining service classifications. In addition, reducing the number of requested service classifications can improve the performance of Vulnerability Response data gathering.\n          - [Audit selected fields in the vulnerable items table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/enable-auditing-selected-fields-vuln-items-table.md) -- Enable auditing for fields you specify in the Vulnerable Item [sn_vul_vulnerable_item] table. This method of auditing is useful when you want to audit fields that you cannot audit by default.\n          - [Vulnerability Response background job framework configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-background-framework.md) -- Define the background job framework in your ServiceNow AI Platform instance. These configuration changes can help you improve performance by reducing the amount of system resources used to run your background jobs.\n            - [Define background job configurations in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-configure-bckgrnd-frmwrk.md) -- Define how many tasks you want to run concurrently for a given background job. You can also set the job to import partitions of data so the tasks complete more quickly and easily and use less of your system resources. If you determine it’s running too long, you can also cancel a job.\n            - [Advanced parallel processing for background jobs in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-adv-config-bkgrd-fmwrk.md) -- With this advanced setting, control the total number of background jobs that are being processed parallel, regardless of the job type.\n      - [Vulnerability Response integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln_integrations.md) -- Vulnerability Response includes support for third-party integrations. Included in this section are some basic guidelines for developing your own integrations.\n        - [AWS Integration for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/aws-integration-for-security-exposure-management-overview.md) -- AWS Integration for Security Exposure Management connects your AWS environment to your ServiceNow AI Platform, enabling you to import security findings from AWS Inspector and AWS Security Hub.\n          - [Integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/aws-sem-integrations.md) -- Integrations, roles, dependencies, and REST messages used for the AWS Integration for Security Exposure Management.\n          - [Set up requirements in AWS](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/aws-inspector-setup.md) -- Complete the following setup steps in your AWS Management Console environment before you install and configure the AWS Integration for Security Exposure Management Integration in your ServiceNow AI Platform instance.\n          - [Install](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/aws-inspector-install.md) -- Install the required applications for the integration.\n          - [Configure the integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/aws-configure-inspector.md) -- Configure the integrations that are included with the AWS Integration for Security Exposure Management application to import the data that you want.\n            - [AWS Inspector data filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/aws-inspector-data-filters.md) -- The following filters are available for the AWS Inspector Host Vulnerability and Container Vulnerability Integrations. These filters control which findings are retrieved from AWS Inspector.\n            - [AWS Security Hub data filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/aws-security-hub-filters.md) -- The following filters are available for the AWS Security Hub Host Vulnerability, Container Vulnerability, and Test Results Integrations. These filters control which findings are retrieved from AWS Inspector.\n          - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/aws-inspector-sechub-ref-stub.md) -- Reference information for the AWS Integration for Security Exposure Management, including data field mappings, severity mappings, tables, script includes, and supported AWS regions.\n            - [AWS Inspector data mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/aws-inspector-mapping.md) -- AWS Inspector data mapping tables.\n            - [AWS Security Hub data mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/aws-security-hub-mapping.md) -- AWS Security Hub data mapping tables.\n        - [National Vulnerability Database (NVD) integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/nvd-vuln-integration.md) -- The NVD integrations use data from the NIST National Vulnerability Database to help you determine the impact and priority of flaws in your code. Run this integration as part of your initial setup of Vulnerability Response and before importing vulnerability data into your instance with a third-party scanner product.\n          - [Preparing for the NVD integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/nvd-prerequisites.md) -- A successful integration requires planning and careful execution of pre-integration tasks. Prepare for the integration by performing these tasks. The NVD integrations assume that you are familiar with the NIST National Vulnerability Database (NVD).\n          - [Configure and run the scheduled job for updating CWE records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/t_ConfigureScheduledJobsCWE.md) -- Data imports from the CWE further enrich the vulnerability data in your instance. Use Common Weakness Enumeration (CWE) records downloaded from the CWE database for reference when deciding whether a vulnerability must be escalated. Run this integration as part of your initial setup of Vulnerability Response and prior to importing vulnerability data into your instance with a third-party scanner product.\n          - [Install the Vulnerability Response Integration with the NIST National Vulnerability Database](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/install-nvd.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the NIST National Vulnerability Database (NVD) product properly integrates with Vulnerability Response. This application is available as a separate subscription.\n            - [Activate the NIST National Vulnerability Database–API (Unmapped CPE)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/install-nvd.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the NIST National Vulnerability Database (NVD) product properly integrates with Vulnerability Response. This application is available as a separate subscription.\n            - [Activate the NIST National Vulnerability Database–API (CPE only)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/install-nvd.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the NIST National Vulnerability Database (NVD) product properly integrates with Vulnerability Response. This application is available as a separate subscription.\n          - [Optional NVD integration modification and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/nvd-optional-modifications.md) -- Configure optional modifications specifically for the NVD integrations.\n            - [Perform a manual NVD integration import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/manual-nvd-import.md) -- If your initial import failed, or you don’t want to wait for the scheduled initial import, you can perform a full data import independent of the daily or weekly scheduled job.\n          - [View the (National Vulnerability Database) NVD integration import run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/nvd-check-imports.md) -- Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.\n          - [Add CVEs to third-party entries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/add-cve2thirdparty-entry.md) -- Common Vulnerability and Exposure (CVE) information can be related to a single third-party vulnerability. It is usually added during a third-party integration import however, you can add multiple CVEs (vulnerabilities) manually.\n          - [View Vulnerability Response vulnerability libraries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/view-vuln-libraries.md) -- You can view vulnerability data imported from the National Vulnerability Database (NVD), Common Weakness Enumeration (CWE), or third-parties to decide whether to escalate a remediation task.\n          - [SSVC enrichment for CVEs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/nvd-ssvc-enrichment.md) -- Unified Security Exposure Management (USEM) enriches CVE entries with SSVC (Stakeholder-Specific Vulnerability Categorization) decision values from the National Vulnerability Database (NVD). These values provide additional risk signals that you can use to analyze and prioritize vulnerabilities. This enrichment is available only in USEM.\n        - [Central Vulnerability Database](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cvd-overview.md) -- The Central Vulnerability Database (CVDB) is a source-agnostic vulnerability data repository that consolidates and enriches vulnerability records from multiple security sources into a single, authoritative view. Use CVDB to eliminate conflicting data across your vulnerability integrations and gain full visibility into which source is authoritative for each field.\n          - [Integrations for Central Vulnerability Database](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cvd-integrations-overview.md) -- The Central Vulnerability Database supports integration with trusted global vulnerability data sources, including the National Vulnerability Database, European Union Vulnerability Database (EUVD), and Japanese Vulnerability Notes (JVN), to enrich and normalize vulnerability records.\n            - [Central Vulnerability Database: versions and dependencies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cvd-versions-and-dependencies.md) -- Lists the available release versions and application dependencies required to run the Integrations for Central Vulnerability Database.\n            - [Activate the ENISA EUVD integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cvd-activate-enisa-euvd-integration.md) -- Activate the ENISA EUVD integration to ingest vulnerability data from the European Union Vulnerability Database (EUVD) into your ServiceNow instance.\n            - [Activate the Japanese Vulnerability Notes Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cvd-activate-jvn-integration.md) -- Activate the JVN Integration to ingest vulnerability data from the Japanese Vulnerability Notes (JVN) database using scheduled or on-demand integration runs.\n            - [View the Integrations for Central Vulnerability Database Import Run Status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/view-cvd-integration-run-status.md) -- Use the Vulnerability Integration Runs related list to verify the success of your integration runs, identify issues, and inform remediation decisions.\n            - [View Central Vulnerability Database vulnerability data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/view-cvd-vulnerability-data.md) -- View vulnerability records imported through the EUVD and JVN integrations in the NVD Entry table within your ServiceNow instance.\n            - [Roles and permissions for Integrations for Central Vulnerability Database](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cvd-roles-and-permissions.md) -- Roles required to view, configure, and execute the EUVD and JVN integrations and to access related vulnerability data.\n        - [CISA Known Exploit Vulnerability (KEV) Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cisa-vuln-integration.md) -- The Vulnerability Response integration with the CISA Known Exploited Vulnerabilities (KEVs) catalog ingests data to help you effectively prioritize and remediate these vulnerabilities.\n          - [Preparing for the CISA integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cisa-prerequisites.md) -- A successful integration requires planning and careful execution of pre-integration tasks. Prepare for the integration by performing these tasks. The CISA Known Exploited Vulnerability integration assumes that you are familiar with the Cybersecurity & Infrastructure Security Agency (CISA).\n          - [Install the ServiceNow Vulnerability Response Integration with CISA application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/install-cisa.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the Cybersecurity & Infrastructure Security Agency (CISA) Known Exploited Vulnerability advisor integrates with Vulnerability Response. This application is available as a separate subscription.\n        - [Understanding the Exploit Prediction Scoring System (EPSS) integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/epss-vr-integration-overview.md) -- Overview of the EPSS integration with Vulnerability Response.\n          - [Configure and run a scheduled job to update CVE records with EPSS data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/config-schedule-job-update-cve-record-epss-data.md) -- Customize the base system scheduled job to update CVE records with EPSS data.\n          - [Add EPSS Score condition in Risk calculator Business Rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/add-epss-score-condition-risk-calc-business-rule.md) -- Modify Business Rule to add EPSS score condition to Risk Calculator.\n        - [Microsoft Defender Integration for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ms-defender-sem.md) -- The Microsoft Defender Integration for Security Exposure Management application is a unified integration point for importing security data from Microsoft TVM and Microsoft Defender for Cloud.\n          - [Microsoft Threat and Vulnerability Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-integration.md) -- The Microsoft Threat and Vulnerability Management integrations are included with the Microsoft Defender Integration for Security Exposure Management application available with a subscription from the ServiceNow Store.\n            - [Prepare for installation and configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-prep-checklist.md) -- Prepare for the integration installation and configuration by performing setup tasks.\n            - [Set up Microsoft Azure for the MS TVM integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-azure-account.md) -- Set up your account in the Microsoft Azure portal to access the Microsoft Threat and Vulnerability Management (MS TVM) API remotely. You need this account to access the MS TVM tenant to gather information for machines, vulnerabilities, and security recommendations.\n            - [Install and configure MS TVM integrations for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-install-and-configure.md) -- Install, activate, and configure the Microsoft TVM integrations for the Microsoft Defender Integration for Security Exposure Management with the Setup Assistant.\n            - [Data retrieval settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-data-rerieve.md) -- Determine the type and scope of data that you want to import with the integrations with data retrieval settings.\n            - [REST messages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-rest-msgs.md) -- REST messages for the Microsoft Threat and Vulnerability Management (MS TVM) Vulnerability Integration enable API calls to MS TVM for retrieving vulnerability data, security recommendations, and asset information.\n              - [Data transformation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-data-transformref.md) -- Data is retrieved from the ServiceNow Microsoft Threat and Vulnerability Management (MS TVM) application, processed through a set of data sources, and transformed in your instance.\n            - [Integration run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-integration-run.md) -- The Integration Run Status module displays the status of Microsoft Threat and Vulnerability Management integration runs in a graphical format. Use this chart to monitor integration performance and identify issues.\n              - [Verify integration run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-view-import-run-status.md) -- Confirm your Microsoft Threat and Vulnerability Management (MS TVM) integration runs successfully and locate any issues.\n            - [Split Microsoft TVM detections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-split-detections.md) -- Split detections from Microsoft Threat and Vulnerability Management scanners to create a unique vulnerable item (VIT) for each detected vulnerability instance. This split enables the assignment of VITs to various remediation teams, enhancing the management and tracking of vulnerabilities.\n          - [Microsoft Defender](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cc_asc_overview.md) -- The Microsoft Defender for Cloud integrations included with the Microsoft Defender Integration for Security Exposure Management application import cloud misconfiguration findings, compliance data, and container image vulnerabilities.\n            - [Migrate to the Microsoft Defender Integration for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mstvm-migrate.md) -- Migrate your existing data from the standalone Microsoft Defender for Cloud Integration application to the unified Microsoft Defender Integration for Security Exposure Management application.\n            - [Configure Defender for Cloud integrations for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cc_asc_install_configure.md) -- After you install and configure the Microsoft Defender Integration for Security Exposure Management, configure the Microsoft Defender for Cloud integrations.\n            - [Integration imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cc-asc-policies.md) -- Configuration Compliance imports policies, tests, authoritative sources, and test results from third-party integrations and stores them in modules for viewing.\n        - [Understanding the HCL BigFix patch orchestration integration with Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-bigfix-integration.md) -- You can manage patches and patch deployments for critical vulnerabilities for large groups of assets with the Vulnerability Response patch orchestration integration with the HCL BigFix product.\n          - [Integrations and dependencies of the Vulnerability Response Patch Orchestration integration with HCL BigFix](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-bigfix-integration-list.md) -- The following product and dependency applications are required for the Vulnerability Response Patch Orchestration with HCL BigFix Integration. These applications are available in the ServiceNow Store.\n          - [Prepare for the Vulnerability Response Patch Orchestration integration with HCL BigFix](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-bigfix-setup-checklist.md) -- Prepare for the integration by performing the following setup tasks.\n          - [Install the Vulnerability Response Patch Orchestration with HCL BigFix application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-bigfixinstall.md) -- Download the Vulnerability Response Patch Orchestration with HCL BigFix application from the ServiceNow Store.\n          - [Configure the Vulnerability Response patch orchestration integration with HCL BigFix](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-bigfix-config.md) -- After you have installed the application, configure it with your BigFix account information and validate your credentials.\n          - [Viewing patch data for the Vulnerability Response patch orchestration integration with HCL BigFix](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-bigfix-rollup.md) -- Patch data and patch rollup data, as well as vulnerability information and remediation status of your vulnerabilities, are displayed on records in your instance.\n          - [Schedule patches with the Vulnerability Response patch orchestration integration HCL BigFix](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-bigfix-schedule-patch.md) -- Schedule patches from Patch Update and Remediation task records in the Vulnerability Response application in your ServiceNow AI Platform instance.\n            - [Schedule a patch deployment with Change Request approval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-ws-patch-schedule-change-request.md) -- Schedule a patch deployment from a remediation task through a Change Request for approval, and optionally deploy the patches automatically after the change is approved.\n          - [REST messages for the Vulnerability Response patch orchestration integration with HCL BigFix](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-bigfix-REST-msg.md) -- The Vulnerability Response patch orchestration integration with HCL BigFix REST messages are used to make calls to the BigFix API.\n          - [Data transformation for the patch orchestration integration with HCL BigFix](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-bigfix-data-transform.md) -- Data is retrieved from the Vulnerability Response patch orchestration with HCL BigFix integration, processed through a set of data sources, and transformed in your ServiceNow AI Platform instance.\n          - [Example workflow for the Vulnerability Response patch orchestration integration with HCL BigFix](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-bigfix-use-case.md) -- An example of how patch orchestration works with the HCL BigFix product.\n        - [Vulnerability Response patch orchestration integration with Microsoft SCCM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mspatch-integration.md) -- The Vulnerability Response integration with the Microsoft System Center Configuration Manager (SCCM) supports patch management and deployment for critical vulnerabilities across your assets.\n          - [Integrations and dependencies of the Vulnerability Response Patch Orchestration with the Microsoft SCCM application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-mspatch-integration-list.md) -- The following product and dependency applications are required for the Vulnerability Response Patch Orchestration with Microsoft System Center Configuration Manager (SCCM) integration. These applications are available in the ServiceNow Store\n          - [Prepare for the Vulnerability Response patch orchestration integration with Microsoft SCCM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-mspatch-setup-checklist.md) -- Prepare for the integration by performing the following setup tasks.\n          - [Install the Vulnerability Response Patch Orchestration with Microsoft SCCM application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-mspatch-install.md) -- Download the application from the ServiceNow Store.\n          - [Configure Microsoft SCCM Patch Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-mspatch-config.md) -- Configure the Microsoft SCCM Patch Orchestration integration with your account credentials to enable data ingestion and patch deployment.\n          - [Viewing patch data and patch data rollup for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-mspatch-rollup.md) -- Patch data and patch rollup data, as well as vulnerability information and remediation status of your vulnerabilities are displayed on records in your instance.\n          - [Schedule patches with the Microsoft SCCM integration with Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-mspatch-schedule-patch.md) -- Schedule patches from Patch Update and Remediation task records in the Vulnerability Response application in your ServiceNow AI Platform instance.\n          - [REST messages for the Vulnerability Response Patch Orchestration with Microsoft SCCM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-mspatch-REST-msg.md) -- The Vulnerability Response Patch Orchestration with Microsoft SCCM uses the SCCM Windows Management Instrumentation (WMI) classes to make calls to the SCCM Server API.\n          - [Data transformation for the Patch Orchestration with Microsoft SCCM Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-mspatch-data-transform.md) -- Data is retrieved from the Patch Orchestration with Microsoft SCCM Integration, processed through a set of data sources, and transformed in your ServiceNow AI Platform instance.\n          - [Example workflow for the Vulnerability Response Patch Orchestration integration with Microsoft SCCM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-mspatch-use-case.md) -- An example of how patch orchestration works with Microsoft SCCM.\n        - [Understanding the Qualys Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_QualysVulnIntegration.md) -- The Qualys product sensors collect the data and automatically send it to the Qualys application, which continuously analyzes and correlates the information. It easily integrates with Vulnerability Response as the Qualys Vulnerability Integration to map vulnerabilities to CIs and business services to determine impact and priority of potentially malicious threats.\n          - [Preparing for the Qualys Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-prerequisites.md) -- A successful integration requires planning and careful execution of pre-integration tasks. It is essential that you prepare for the integration by performing these procedures. The Qualys Vulnerability Integration assumes that you are familiar with and run Qualys Cloud Platform scans in your environment.\n          - [Install the Qualys Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/install-and-configure-qualys.md) -- Before you run the Qualys Vulnerability Integration in your instance, you must install and configure the Qualys Vulnerability Integration application. This application is available as a separate subscription.\n            - [Activate the Qualys scanners](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/activate-qualys-scanners.md) -- You must activate the scanners after installing the Qualys Vulnerability Integration because the scanners are deactivated by default in the Vulnerability Response application.\n            - [Installed components](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-installed-with.md) -- The following roles, integration jobs, and tables are installed with the Qualys Vulnerability Integration.\n          - [Update configuration items with the network partition identifier for the Qualys Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-updateCI-NPI.md) -- Create unique configuration items (CIs) for assets in your environment that share IP addresses. Identify the distinct assets across your environment and automatically update the CIs on your existing discovered item, vulnerable item, and detection records to give you more details about your vulnerabilities.\n          - [Optional Qualys modifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/optional-modifications.md) -- Configure optional modifications and streamline some of the data specifically for the Qualys integration.\n            - [Disable notification-related business rules prior to initial record import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/optional-modifications.md) -- Configure optional modifications and streamline some of the data specifically for the Qualys integration.\n            - [Enable Qualys QVS score integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/optional-modifications.md) -- Configure optional modifications and streamline some of the data specifically for the Qualys integration.\n            - [Modify an initial start date](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/optional-modifications.md) -- Configure optional modifications and streamline some of the data specifically for the Qualys integration.\n          - [Advanced Qualys configurations and modifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n            - [Modify the Qualys to ServiceNow priority and state mapping values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n            - [Restrict the ability to write to a record based on an assignment group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n            - [Set up scanner appliances](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n            - [Configure and manage Qualys vulnerability scanners and scans](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n              - [Configure the ServiceNow-initiated Qualys IP scan](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n              - [Scan multiple Qualys vulnerabilities or vulnerable items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n              - [Configure the Qualys auto scan for resolved remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n              - [Configure Qualys rescans to run only within scheduled intervals](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n              - [Qualys vulnerability scan rate limits](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n                - [Define Qualys scan rate limits](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n                - [Apply scan rate limits to Qualys scanners](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n              - [View the Qualys vulnerability scan queue](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n              - [Enable base system filter for confirmed detection imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n              - [Initiate rescan for the Qualys Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/advanced-modifications.md) -- Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n          - [Qualys metadata for vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-kernal-service-metadata.md) -- The Qualys Host Detection Integration is enhanced to include more fields from Qualys. These fields help in filtering the non-exploitable Linux vulnerabilities. This enhancement improves the integration at the detection level and at the vulnerable item (VI) level.\n            - [Import additional metadata from Qualys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/import-additional-metadata.md) -- Import additional metadata for vulnerability items (VI) to filter vulnerabilities based on the impact on a kernel or service.\n            - [Qualys metadata values for vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-metadata-values.md) -- When the kernel metadata, service metadata, and configuration metadata are imported, some values are also retrieved. The values 0, 1 and Not available are processed in the back-end and converted to No, Yes and Empty respectively.\n            - [Set additional filter parameters for Qualys imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-add-filters.md) -- Customize the filtering parameters for your scheduled queries with the Qualys Vulnerability Integration to help you further refine the vulnerability data you import with the supported Qualys integrations.\n          - [Resolving Qualys Vulnerability Integration issues](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-troubleshooting.md) -- Some commonly encountered issues, along with workarounds are discussed.\n            - [Attachments not appearing after import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-troubleshooting.md) -- Some commonly encountered issues, along with workarounds are discussed.\n            - [Modify transform maps](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-troubleshooting.md) -- Some commonly encountered issues, along with workarounds are discussed.\n            - [Check XML attachment property size](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-troubleshooting.md) -- Some commonly encountered issues, along with workarounds are discussed.\n            - [Data retrieval limitations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-troubleshooting.md) -- Some commonly encountered issues, along with workarounds are discussed.\n            - [Resolving Qualys Knowledge Base Integration failure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-troubleshooting.md) -- Some commonly encountered issues, along with workarounds are discussed.\n          - [Qualys Vulnerability Integration reporting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_QualysHomepage.md) -- The Qualys Cloud Platform overview is an executive view into vulnerability activity. By providing trends, reports, and drill-downs into specific data, an administrator or analyst can quickly pinpoint areas of concern. The charts are populated with data after vulnerable items and the Qualys knowledge base data have been retrieved.\n            - [Qualys integration run status chart](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-integr-run-status.md) -- The Qualys Integration Run Status module is a graphical view of the status of Qualys integration runs.\n          - [Qualys data transformation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_QualysDataTransformation.md) -- The data retrieved from Qualys is processed through a set of data sources and transforms.\n            - [Dynamic Search List Import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-dyn-srch-list-transform.md) -- The Qualys dynamic search list transform map is used to transform and import Qualys Dynamic Search Lists. Changes to this transform alter how Dynamic Search Lists are processed and inserted into the system.\n            - [Static Search List Import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-static-srch-list-import.md) -- The Qualys static search list transform map is used to transform and import Qualys Static Search Lists. Changes to this transform alter how Static Search Lists are processed and inserted into the system.\n            - [Asset Group Import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-asset-grp-import.md) -- The Qualys Asset Group Appliance Transform map is used to transform Qualys Asset Group data to create scanner appliance records. Changes to this transform alter how scanner appliances are created and modified.\n            - [Appliance Import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-appliance-import.md) -- The Qualys Appliance Transform map is used to transform Qualys Appliance data into appliance records. This is used to update the appliance records that would initially be created from the Asset Group Import. Changes to this transform alter how appliance records are updated with appliance details.\n          - [REST messages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/qualys-rest-messages.md) -- Qualys REST messages are used to make calls to the Qualys API.\n            - [Configure OAuth authentication for Qualys REST messages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-qualys-oauth-authentication.md) -- Configure your Qualys Vulnerability Integration to authenticate with Qualys using OAuth instead of Basic Authentication.\n          - [Split Qualys detections based on vulnerability instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/split-qualys-detections.md) -- Vulnerability Response allows you to split detections from Qualys scanners, creating a unique Vulnerable Item (VIT) for each detected vulnerability instance. This supports more precise assignment to remediation teams and improves vulnerability management and tracking.\n        - [Understanding the Rapid7 Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/r7-vuln-integration.md) -- The ServiceNow Rapid7 Vulnerability Integration uses data imported from the Rapid7 data warehouse or the Rapid7 InsightVM products to help you determine the impact and priority of potentially malicious threats.\n          - [Preparing for the Rapid7 Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/r7-prerequisites.md) -- A successful integration requires planning and careful execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Rapid7 Vulnerability Integration assumes that you are familiar with and run Rapid7 data warehouse or Rapid7 InsightVM product scans in your environment.\n            - [Set up for the Rapid7 data warehouse Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/r7-setup-dw.md) -- The Rapid7 data warehouse Integration is one of the integration types that is included with the Rapid7 Vulnerability Integration Rapid7 Vulnerability Integration.\n            - [Set up for the Rapid7 InsightVM Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/r7-setup-ivm.md) -- The Rapid7 InsightVM Integration is one of the integration types that is included with the Rapid7 Vulnerability Integration Rapid7 Vulnerability Integration.\n          - [Install the Rapid7 Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/install-and-configure-r7.md) -- After you complete the set up steps for the integration so that it properly integrates with Vulnerability Response, get entitlements, download, and install the application on your ServiceNow AI Platform instance.\n            - [Configure the Rapid7 Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/r7-config.md) -- Configure the Rapid7 Vulnerability Integration after the application is installed and activated on your ServiceNow AI Platform.\n            - [Filtering by Rapid7 sites](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/filtering-by-site.md) -- Filter by site for Rapid7 InsightVM integration types as well as Rapid7 Nexpose data warehouse integration types.\n              - [Prepend SITE to your Rapid7 InsightVM site tags](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/prepend-site.md) -- Add the prefix, SITE, to your Rapid7 InsightVM site tags to highlight them among your list of tags.\n            - [Deduplicate Rapid7 Vulnerability Integration data warehouse records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/dedup-data-warehouse.md) -- When migrating to the InsightVM integration type from the Data Warehouse integration type, you can deduplicate existing data warehouse vulnerable items as long as they belong to the same source data as your Rapid7 InsightVM data.\n          - [Rapid7 Vulnerability Integration run status chart](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/r7-integr-run-status.md) -- Rapid7 Nexpose sensors collect the data and automatically send it to the Rapid7 Nexpose or Rapid7 InsightVM products, which continuously analyze and correlates the information.\n            - [View the Rapid7 Vulnerability Integration import runs status dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/check-imports-rapid7.md) -- Use the Rapid7 vulnerability import run status dashboard to verify the success of your integration runs, locate any issues and inform your remediation decisions.\n          - [Initiate rescan for the Rapid7 Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-r7-rescan.md) -- Initiate rescans in the Rapid7 platform to verify that your vulnerable items have been remediated between scheduled scanning cycles.\n          - [Set additional filter parameters for Rapid7 InsightVM imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/r7-add-filters.md) -- Customize the filtering parameters for your scheduled queries with the Rapid7 Integration for Security Operations to help you further refine the vulnerability data you import with the Rapid7 InsightVM product.\n        - [Understanding the Shodan Exploit Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/shodan-exploit-vuln-integration.md) -- The ServiceNow Shodan Exploit Integration application uses data imported from the Shodan search engine to help you determine the impact and priority of potentially malicious exploits.\n          - [Preparing for the Shodan Exploit Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/shodan-exploit-prerequisites.md) -- A successful Shodan Exploit Integration requires planning and careful execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Shodan Exploit Integration assumes that you are familiar with the Shodan search engine and API.\n          - [Install and configure the Shodan Exploit Integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/install-shodan-and-configure.md) -- Before you can run the Shodan Exploit Integration in your instance, download and install it from the ServiceNow Store. This application is available as a separate subscription.\n            - [Set Shodan Exploit Integration import time](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/set-import-time-shodan.md) -- For your convenience, you can reset the start time for the Shodan exploit integrations.\n            - [Perform a manual Shodan exploit import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/manual-shodan-import.md) -- If your initial import failed, or you do not want to wait for the scheduled initial import, you can perform a full data import independent of the daily scheduled job.\n          - [View the Shodan Exploit Integration import run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/check-imports-shodan.md) -- Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.\n        - [Understanding the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenableIntegration.md) -- The Vulnerability Response Integration with Tenable application developed by ServiceNow engineering for the Tenable Vulnerability Integration uses data imported from the Tenable.io, Tenable.sc, and Tenable.cs products. This data helps you prioritize and remediate vulnerabilities for your assets. The application is available with a separate subscription from the ServiceNow Store.\n          - [Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-io-integrations-list.md) -- The Tenable.io integrations in the Vulnerability Response Integration with Tenable with Tenable application are available for use with both the Vulnerability Response and Configuration Compliance applications.\n          - [Tenable.sc integrations with the Vulnerability Response application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-sc-integrations-list.md) -- The Tenable.sc integrations in the Vulnerability Response Integration with Tenable application.\n          - [Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-cs-integrations-list.md) -- The Tenable.cs integrations in the Vulnerability Response Integration with Tenable application are available in the Vulnerability Response and Container Vulnerability Response applications.\n          - [Preparing for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-setup-checklist.md) -- Prepare for the ServiceNow Tenable Vulnerability integration by performing the following setup tasks.\n          - [Install the Vulnerability Response Integration with Tenable application using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenableInstall.md) -- Before you run the ServiceNow Tenable Vulnerability Integration, you need to download the Vulnerability Response Integration with Tenable application from the ServiceNow Store and install and configure it using the Setup Assistant in the Vulnerability Response application.\n          - [Data retrieval settings for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-data-rerieve.md) -- The following data retrieval settings help you determine specifically the type and scope of data you want to import from the ServiceNow Tenable Vulnerability Integration to your ServiceNow AI Platform instance.\n          - [REST messages for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-rest-msgs.md) -- The ServiceNow Tenable Vulnerability Integration REST messages are used to make calls to the Tenable API.\n            - [Data transformation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-data-transformref.md) -- After you identify the data to import, it’s retrieved from the Tenable product and processed through a set of data sources and transforms in your instance.\n          - [Set import filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-add-filters.md) -- Customize the filtering parameters for your scheduled queries with the Tenable Vulnerability Integration to help you further refine the vulnerability data you import with the Tenable.io product.\n          - [Tenable Vulnerability Integration reporting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-integration-reporting.md) -- View reports about vulnerabilities and vulnerable items on the Vulnerability Response dashboards.\n            - [Integration run status chart for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-integration-run.md) -- The Tenable Integration Run Status module provides you with a graphical view of the status of Tenable integration runs.\n          - [Initiate rescan for the Tenable.sc integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-tenable-rescan.md) -- Verify your vulnerable items have been remediated between scheduled scanning cycles by initiating rescans in the Tenable platform. You can initiate a rescan on-demand for vulnerable items for the Tenable.sc product from your ServiceNow AI Platform instance.\n          - [Initiate rescan for the Tenable.io integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-tenable-rescan-tenable-io.md) -- Verify that your vulnerable items have been remediated between scheduled scanning cycles by initiating rescans in the Tenable platform. You can initiate a rescan on-demand for vulnerable items for the Tenable.io product from your ServiceNow AI Platform instance.\n          - [Update configuration items with the network partition identifier for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-updateCI-NPI.md) -- Create unique configuration items (CIs) for assets in your environment that share IP addresses. Identify the distinct assets across your environment and automatically update the CIs on your existing discovered item, vulnerable item, and detection records to give you more details about your vulnerabilities.\n          - [Import modifications for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-optional-vul-modify.md) -- Configure optional modifications and streamline some of the data specifically for the Tenable Vulnerabilities import integration in the ServiceNow Tenable Vulnerability Integration.\n          - [Split Tenable detections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-split-detections.md) -- ServiceNow Vulnerability Response enables the splitting of detections from Tenable scanners, enabling for the creation of a unique vulnerable item (VIT) for each detected vulnerability instance. This split enables the assignment of VITs to various remediation teams, enhancing the management and tracking of vulnerabilities.\n          - [Configure Test Result Granularity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cc-tenable-tr-granularity.md) -- Configure the Tenable test result granularity to ensure the system imports results at a more detailed level based on your selected configuration keys. In addition to the default keys, you can configure additional keys based on your requirements to increase granularity. Granular imports allow teams to manage their respective assets independently and prevent data from being overwritten when multiple records share common identifiers.\n          - [Compliance test uniqueness key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cc-tenable-compliance-test-uniqueness-key.md) -- The Tenable compliance test uniqueness key determines how the system identifies incoming compliance test records during ingestion and whether they are treated as new records or updates to existing ones.\n            - [Configure compliance test uniqueness key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cc-tenable-config-test-uniqueness-key.md) -- Configure the uniqueness key for Tenable compliance tests to control how the system identifies configuration test records during ingestion and prevent records from being overwritten when multiple tests share the same control identifier.\n        - [Understanding the Atlassian Jira integration with Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/jira-vuln-integration.md) -- The Atlassian Jira integration with Vulnerability Response enables you to leverage different issue-tracking and agile management tools for tracking efforts of vulnerability remediation.\n          - [Preparing for the Jira Vulnerability Response integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/jira-prerequisites.md) -- A successful Jira Vulnerability integration requires planning and the execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Jira Vulnerability Response integration assumes that you are familiar with the Jira product and API.\n          - [Install the Vulnerability Response Integration with Jira](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/jira-install.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the Jira product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.\n          - [Configure rules in the agile tool configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/jira-configure.md) -- Jira issues are created on the Jira platform if the records created in the Application Vulnerable Item, Container Vulnerable Item, Application Remediation Task and Container Remediation Task match the rules created in the agile tool configuration.\n            - [Create agile issue manually using list action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-agile-issue-manually.md) -- When a list action: Create Jira Issue is triggered, records that match the rule configuration criteria should be considered for “Create Jira Issue” and those records should be ingested into the sn_vul_agile_tool_manifest table with the mapping selected in the configuration rule.\n            - [Create agile issue manually using form action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-agile-issues-form-action.md) -- Create an agile issue manually using form action. If the record is matched with any configuration rule condition, then a pop-up box will be populated with values that are selected in the configuration rule and if it does not match any criteria then the user will be allowed to select values for pre-defined fields.\n          - [Manually synchronize the status of the Jira issue](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/sync-jira-issue-status-servicenow-manually.md) -- Update the state of the single record by clicking on the Sync Agile Status button of the form context menu and update the states of multiple records by clicking the list action Sync Agile Status of the Application Vulnerable Item, Container Vulnerable Item, and Remediation Task table in the Vulnerability Manager Workspace.\n            - [Configure scheduler to create issues automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-scheduler-create-issues-automatically.md) -- Configure the scheduler to run and automatically create the Jira issues for the records that have been created in the sn_vul_agile_tool_manifest table.\n            - [Configure scheduler to update issues automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-scheduler-update-issues-automatically.md) -- Configure the scheduler to update the Jira issues automatically for the records that have been added in the sn_vul_agile_tool_manifest table.\n            - [Configure scheduler to synchronize the Jira status to ServiceNow automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/config-scheduler-sync-jira-status-vr-auto.md) -- Configure the scheduler to synchronize the state of Jira issues with application vulnerability item, container vulnerability items and tasks in the sn_vul_agile_manifest table.\n        - [Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-pcc-integration.md) -- The Prisma Cloud Compute integration enables you to scan hosts to detect vulnerabilities.\n          - [Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-prisma-prep-checklist.md) -- You can prepare for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute by performing setup tasks.\n          - [Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-install-prisma-cloud-compute.md) -- Before you run the integration on your instance, complete the installation and configuration steps so that the Prisma Cloud Compute product properly integrates with Vulnerability Response and Container Vulnerability Response. This application is available as a separate subscription.\n          - [Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-prisma-install-and-configure.md) -- Install and configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application to import data from Prisma Cloud Compute. You can use the imported data to prioritize and remediate vulnerabilities for your hosts.\n          - [Integration run status chart for Prisma Cloud Compute Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-prisma-integration-run.md) -- The Prisma Cloud Compute Integration Run Status module provides you with a graphical view of the status of Prisma Cloud Compute Integration runs.\n        - [Wiz Vulnerability Response Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-wiz-exploring-host-cf.md) -- Import vulnerability and compliance data from Wiz scanners into your ServiceNow AI Platform instance to help you get deeper insights into your cloud infrastructure risks. These integrations provide you with a comprehensive assessment of your overall cloud security posture and help you drive remediation actions directly from your instance.\n          - [Install](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-wiz-host-vuln-install.md) -- Activate the required application.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-config-wiz-host-vuln.md) -- Configure the integration in your Wiz service account and assign roles in your ServiceNow AI Platform instance.\n            - [Runtime exposure visibility for container images](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/wiz-container-runtime-exposure-cvr.md) -- Chained Wiz integrations create container vulnerable items for images deployed across unlimited clusters, removing the previous 16-cluster limitation.\n            - [Activate the Wiz Asset Integration and identify resource types for import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/wiz-assets-resources-tab.md) -- Activate the Wiz Asset Integration and identify only the resource types (assets) with this integration that you want to import.\n            - [Filter host vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/wiz-host-tab-filters.md) -- Set the filtering values to import the host vulnerability data that you want.\n            - [Filter container vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/wiz-container-tab-filters.md) -- Set the filtering values to import the container vulnerability data that you want.\n            - [Filter test results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/wiz-test-result-tab-filters.md) -- Set the filtering values to import the cloud test results data that you want.\n            - [Filter issues](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/wiz-issues-tab-filters.md) -- Set the filtering values to import Wiz Issues that identify assets involved in toxic combinations of vulnerabilities and misconfigurations.\n            - [Filter host test results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/wiz-host-test-result-tab-filters.md) -- Set the filtering values to import Wiz host test results.\n            - [Configure the Application List, SCA and Secret integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/avr-wiz-config.md) -- Configure the Wiz Application Vulnerabilities, SCA, and Secrets Integrations.\n          - [Field mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/wiz-vul-resp-integration-view-findings.md) -- Review source and target fields and view imported data on tables and records in your ServiceNow AI Platform instance.\n        - [Manually create a vulnerability integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_VulnerabilityIntegrations.md) -- Vulnerability integrations provide the ability for customers and vendors to enrich the vulnerability data on their instance by retrieving data from external systems and vendors. This ability can simplify the vulnerability remediation life cycle by keeping the instance synchronized with other vulnerability management systems.\n          - [Define a new vulnerability integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/t_DefineNewIntegration.md) -- A vulnerability integration pulls report data from a third-party system, generally to retrieve vulnerability data, and process that reporting data using data sources or a custom processor.\n            - [Vulnerability integration script](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_AboutVulnIntegScript.md) -- On the Vulnerability Integration form, the integration script is a reference to a script include that extends the VulnerabilityIntegrationBase script include.\n              - [Single call integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_SingleCallIntegrations.md) -- Single call (single page) integration scripts are the simplest types of integrations. They require one call, often to an external source of data, to retrieve data. Only retrieveData() is required to be implemented for single page/single call integrations.\n              - [Multiple call integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_MultipleCallIntegrations.md) -- Multiple call (or multiple page) integration scripts are a bit more complicated. They require multiple calls to a data source to retrieve data.\n              - [Attachments as retrieveData() return values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_AttachmentsAsReturnValues.md) -- Sometimes, it is preferable be return an attachment from retrieveData(). The logic to create and/or retrieve an attachment is implementation-specific, but after the attachment is known, its information can be returned.\n            - [Report processor strategies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_AboutRptProcStrategies.md) -- The Report processor strategy field on the Vulnerability Integration form is used to select the method to process the data returned by the vulnerability integration script when the vulnerability integration process is executed.\n              - [Use the data source attachment report processor strategy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/t_DataSrcAttachStrategy.md) -- The Data Source Attachment report processor strategy is used to pass data retrieved by the integration script to configured data sources.\n              - [About custom report processor scripts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_AboutCustomRptProcScript.md) -- On the Vulnerability Integration form, the Report processor is a reference to a script include that extends the VulnerabilityReportProcessorBase script include. The functionality contained in this script is called by the VulnerabilityIntegrationController and defines the means by which the data returned by the integration script are processed.\n            - [Integration factory script fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_AboutFactoryScript.md) -- The Vulnerability Integration form contains the integration factory script and, when the Custom Report Processor report processor strategy is selected, the Processor factory script. These fields are used to provide the logic to actually instantiate the object defined by the script include reference fields, Integration script, and Report processor, respectively.\n          - [Manually run a vulnerability integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/t_ManualRunVulnInteg.md) -- Vulnerability integrations for Vulnerability Response and Application Vulnerability Response are configured to run on a scheduled basis. However, you can run them manually when needed.\n        - [Manual ingestion of vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/manually-ingest-vulnerabilities.md) -- Manually ingest vulnerabilities into the Vulnerability Response application so that you can remediate them quickly without having to wait for scanner results.\n          - [Ingest vulnerabilities manually](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ingest-vulnerabilities-manually.md) -- Manually ingest vulnerabilities by uploading a template with vulnerabilities data.\n          - [Verify manual integration run](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/verify-manual-integration-run.md) -- Verify that the integration run is successful. View the number of individual detections and the vulnerable items (VIs) created or updated due to the integration run.\n          - [Configure auto-close manual detections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-auto-close-manual-detections.md) -- Enable the auto-close manual detections to close stale manual detections automatically.\n          - [Verify upload status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/verify-upload-status.md) -- Verify whether the vulnerability integration run was successful, partially successful, or a failure.\n          - [Template for manual ingestion of vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/manual-ingestion-template.md) -- The template provides columns that must be filled with vulnerability and configuration item (CI) data. After the template is populated and uploaded, the data is processed.\n      - [Vulnerability Response remediation overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cj-common-vuln-tasks.md) -- Vulnerability Response remediation is a phased process consisting of verifying import completion, triaging new vulnerabilities, and monitoring progress to completion. Approached in this way, remediation becomes manageable, timely, and in many ways, automated.\n        - [Verify successful completion of Vulnerability Response integration imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-integr-run-status.md) -- The easiest way to determine whether your imports have succeeded is to use an Integration Run Status dashboard. The Integration Run Status dashboard provides an example of a graphical view of the status of third-party integration runs.\n        - [View Vulnerability Response vulnerable item detection data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr_view_detection.md) -- The complete data gathered by your third-party scanner integrations with Vulnerability Response are displayed on the Detections and Initial Detections tabs on the vulnerable item records (VIT). It is also displayed on Detection records on the Vulnerable Item Detection list in your ServiceNow AI Platform instance.\n          - [Verify Vulnerability Response vulnerable item detection data on integration run (VINTRUN) records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr_host_integration_run.md) -- From integration run records in your ServiceNow AI Platform instance, you can locate third-party integration vulnerable item detection data based on the date and time of scans. Verify the scan successfully completed, view the number (counts) of individual detections, as well as any vulnerable items (VIs) that are created or updated directly as a result of the scans.\n        - [Viewing patch data and scheduling patches in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-patch-orch-view-data.md) -- Starting with v16.1 of Vulnerability Response, you can schedule patches and view patch data along with solution and other vulnerability information on records in both the classic environment and the Vulnerability Response Workspaces in your ServiceNow AI Platform instance.\n          - [Patch data and state rollup for patch orchestration in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-patch-rollup-data.md) -- Starting with v16.1 of Vulnerability Response patch data and states are rolled up to Patch Update and other records in the Vulnerability Response application.\n          - [View patches without solutions in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-patch-view-no-solution.md) -- Starting with v16.0 of Vulnerability Response, for patches that have no solutions after an import, the system then searches for patch IDs in the vulnerability reference data so that you can view these patches on vulnerability records.\n          - [Viewing patch orchestration data on the Vulnerability Response dashboards](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-patch-orch-dbs.md) -- Starting with v16.1, you can view patch update data in the classic environment on the dashboards that are included with the Vulnerability Response application.\n        - [View a solution](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/view-solutions.md) -- View all solutions, solutions with highest-supersedence and solutions associated with vulnerable items to inform your remediation activities.\n        - [Create a vulnerability solution](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-vul-solution.md) -- Create a vulnerability solution so that you can track vulnerability solutions that are not covered by third-party solution content.\n          - [Manually exclude solutions from third-party records or vice versa](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/exclude-solutions.md) -- Exclude the relationship between a third-party vulnerability and a solution because it is not relevant to the CI you are remediating, or it is not a concern in your environment. Manually exclude solutions using either a third-party vulnerability or solution record.\n        - [Triage vulnerabilities automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln-automated-triage.md) -- Reviewing and triaging new vulnerabilities is necessary to ensure successful remediation. Transform vulnerability imports into remediation tasks with automated vulnerable item (VI) assignment, risk calculation, remediation targets, and VI grouping.\n          - [Edit vulnerable items in bulk in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/bulk-edit-vis.md) -- Edit vulnerable items in bulk to save time by selecting fields and running an asynchronous bulk edit job in the background.\n          - [Ungrouped Vulnerability Response vulnerable items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ungrouped-vul-items.md) -- Vulnerable items are automatically assigned to a remediation task when they are imported. However, sometimes, if a vulnerable item (VI) is created manually, for example, the VI can become an orphan. The Ungrouped vulnerable item module lists those vulnerable items without a group.\n            - [View ungrouped Vulnerability Response vulnerable items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/view-ungrouped-vul-items.md) -- Vulnerable items that are not assigned to a group are placed in a viewable list.\n            - [Manually add a vulnerable item to a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/add-vul-item-to-group.md) -- If a vulnerable item is left ungrouped, you can add it to a remediation task.\n          - [Remove assignments from vulnerable items and remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-unassign-vi.md) -- Clear the Assigned to and Assignment group fields on vulnerable item records in the Vulnerability Response, Application Vulnerability Response, and Container Vulnerability Response applications.\n          - [Approve or reject an unassign request in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-approve-unassign-requests.md) -- Approve requests for the removal of vulnerable items from an assignment group or an individual user in the Vulnerability Response application.\n          - [Automatic closing of vulnerable items and detections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/auto-close-common.md) -- You can automatically close stale detections and vulnerable items (VIs) associated with retired CIs using the Auto-Close rules module.\n            - [Working with retired configuration items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/working-with-retired-CIs.md) -- Decommissioned configuration items (CIs) are moved to retired, archived, or deleted state in the Configuration Management Database (CMDB). Vulnerability Response contains vulnerable items (VIs) that are made up of CIs. When the state of a CI is updated to retired, the associated VIs are closed with the substate 'CI decommissioned'.\n            - [Automatically close vulnerable items related to retired CIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/auto-close-vis.md) -- If the Configuration Management Database (CMDB) changes the life cycle stage status of a configuration item (CI) to retired, you can choose to automatically close the associated vulnerable items (VIs) and detections.\n          - [Closing stale detections in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-setup-autoclose-detections.md) -- The Auto-Close Stale Detections module helps you automatically clean up older, stale vulnerable detections not recently found by your third-party integrations. Moving these detections to Closed reduces the number of active vulnerable items and remediation tasks in your ServiceNow AI Platform instance and helps you reconcile assets in your CMDB.\n            - [Automatically close stale detections in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-autoclose-detections.md) -- Enable Auto-Close Stale Detections to automatically close stale vulnerable detections not recently found by your third-party integrations.\n            - [Create auto-close rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-auto-close-rules.md) -- Use auto-close rules to close older detections automatically based on the filter conditions that you set.\n          - [Reclassify unclassed hardware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/reclassify-unclassed-hardware.md) -- Reclassify unclassed hardware by updating the CI lookup rules.\n        - [Manually create a remediation task in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-vulnerability-group.md) -- Creating a remediation task manually is done when you want to group vulnerable items by something other than the Remediation Task Rules criteria. For example, you can create tasks for a particular manager, or for active, new exploits, such as ransomware that include different vulnerabilities. You can also use it to group ungrouped vulnerable items.\n          - [Add users to the Vulnerability Response group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/t_SetUpVulnGroup.md) -- When the Close/Defer feature is used to defer or close a vulnerable item without requiring a scan, the Vulnerability Response group is notified to approve or reject the request. You can assign the appropriate users.\n        - [Manage individual vulnerable items manually](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_IndivVulnItemMgmt.md) -- Vulnerable items represent one configuration item (CI) with a given vulnerability. Vulnerable items are imported from third-party sources, or using the SAM NVD information (link) to compare vulnerability entries to software records retrieved from the Software Asset Management module.\n          - [Create Vulnerability Response vulnerable items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/t_CreateVulnerableItems.md) -- Multiple methods create vulnerable items (VI). Most commonly, an integration to a vulnerability scanner is installed and configured to import results nightly. There are cases, like physical security vulnerabilities, when you might prefer to manually add vulnerable item records.\n            - [Defer a vulnerable item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/defer-vul-item.md) -- If you determine that the issue associated with a vulnerable item (VIT) is of low risk and can be immediately deferred without further analysis, you can use the Defer feature.\n              - [Request an extension for a deferred vulnerable item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/extend-defer-vul-item.md) -- Request an extension for a deferred vulnerable item before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n          - [Refresh Vulnerability Response vulnerable items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/refresh-vuln-items.md) -- The Update status related link is used to have vulnerable items inspected to see if there are any additional vulnerable items that belong to a remediation task. Use it if an update is warranted outside the scheduled job.\n            - [Identify and escalate security issues in third-party software](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/escalate-sec-issue-3rdparty.md) -- You can view software vulnerabilities returned from third-party entries to determine remediation. Use this information to match the vulnerable software entries to a Software Asset Management discovery model.\n            - [Identify and escalate security issues using NVD](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/escalate-sec-issue-NVD.md) -- When Common Vulnerability and Exposures identifier (CVE-ID) records are downloaded from the National Vulnerability Database (NVD), they are compared to the software in your company network as identified by the Software Asset discovery model. When a CVE-ID matches vulnerable software or configuration item in your network, a vulnerable item is created. You use the information in the CVE-ID record to decide whether to escalate the vulnerable item for remediation.\n            - [Identify and escalate security issues using CWE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/escalate-sec-issue-CWE.md) -- View the library of Common Weakness Enumeration (CWE) records from the National Vulnerability Database (NVD) to understand how they relate to the Common Vulnerability and Exposure (CVE) records. Then use this information to match the vulnerable software entries to a Software Asset Management discovery model.\n            - [View the remediation target status of a Vulnerability Response vulnerable item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/view-remed-target-task.md) -- When a vulnerable item has nearly reached (or passed) its remediation target date, as defined by a remediation target rule, the vulnerable item record is updated with a status. This information can help the analyst proactively monitor upcoming remediation activities.\n        - [Working with unmatched CIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/working-unmatched-cis.md) -- As a Vulnerability Manager and Analyst, you can view and reclassify unmatched Configuration Items (CIs), reconcile unmatched discovered items, reapply CI lookup rules on the selected discovered items, and de-duplicate existing CIs.\n          - [View and reclassify unmatched configuration items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/view-discovered-items.md) -- Configuration items (CIs) that are not found in the Configuration Management Database (CMDB) are placed in a viewable list of discovered items. This list offers a convenient way to reclassify unmatched CIs.\n          - [Reconcile unmatched discovered items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/reapply-reconcile-unmatched-discovered-items.md) -- Create a scheduled job to reconcile unmatched discovered items.\n            - [Reapply CI lookup rules on selected discovered items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/reapply-ci-lookup-rules-di.md) -- Reapply the configuration item (CI) lookup rules on selected discovered items from the discovered item list view select actions. If the CI changes after you reapply the rules, the discovered items are updated with the new CI and impacted detections. Vulnerable items are also updated.\n            - [Reapply CI Lookup Rules Enhancements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/reapply-ci-lookup-rules-enhancements.md) -- Reapply the configuration item (CI) lookup rules on selected discovered items like os and netbios.\n          - [Steps to help prevent duplicate or orphaned records after running Vulnerability Response CI lookup rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ci-identifier-rules-impl-test.md) -- Take steps to help prevent duplicate or orphan records resulting from matching (configuration items (CIs) within the CMDB.\n          - [De-duplicating existing configuration items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/reapply-deduplication.md) -- Whenever configuration items (CIs) are updated through a deduplication task, the discovered items (DIs) that are related to those CIs are also updated. The vulnerable items (VIs) and detections are also updated with the CI.\n          - [Resolve remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/remediate-vuln-groups.md) -- The flexibility inherent in Vulnerability Response allows you to remediate vulnerabilities in whatever way suits your security organization.\n            - [Defer a Remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/defer-vuln-group.md) -- If you determine that the issue associated with a remediation task (VUL) is a low priority and can be immediately deferred without further analysis, you can use the Request Exception feature.\n              - [Request an extension for a deferred remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/extend-defer-vuln-group.md) -- Request an extension for a deferred remediation task (VUL) before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n            - [Close a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/close-vuln-group.md) -- If you determine that the issue associated with a remediation task can be immediately closed without further analysis, you can use the Close feature. Starting with v23.0 of Vulnerability Response, the Close button has been removed for a remediation task and the closure of a remediation task is driven by the scanner.\n        - [Identifying duplicate vulnerable items from multiple scanners](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/correlate-vis-from-diff-scanners.md) -- If you are using multiple scanners on the same asset to detect vulnerabilities, multiple vulnerable items (VIs) might be created. You can identify these duplicate VIs to ensure that the duplicate vulnerabilities are not assigned to the remediation owners.\n          - [Automatically resolve duplicate vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/automate-workflows-for-duplicate-vulnerabilities.md) -- Starting from Vulnerability Response (VR) v17.1, you can automatically resolve any duplicate vulnerabilities on an asset.\n        - [Create and edit a classification group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-edit-classification-group.md) -- Create groups so that the underlying rules of this group can classify the table records based on the conditions. The rules can be used to select any field in the corresponding table.\n          - [Create and edit a classification rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-classification-rule.md) -- Create rules to automatically classify the incoming vulnerabilities to the correct teams for remediation.\n          - [Apply a rule to an existing vulnerability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/apply-rule-existing-vulnerability.md) -- When you change a classification rule, rerun all the active rules on all the vulnerability entries. You can also retrofit the existing vulnerabilities, by applying the newly created classification rules to the existing vulnerabilities.\n          - [Deactivate or delete a classification rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/delete-vulnerability-classification-rule.md) -- Deactivate or delete a classification rule if it is no longer needed or relevant.\n        - [Create an exclusion rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-exclusion-rule.md) -- Create a rule to filter or exclude detections from getting converted into vulnerable items (VITs) during ingestion.\n        - [Change Management tasks for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln_chg_mgmnt_tasks.md) -- From remediation tasks (RTs), create change requests, associate RTs to existing change requests, or split remediation tasks into new tasks with subsets of vulnerable items (VI).\n          - [Create a change request from a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln-change_mgmnt_create_change.md) -- As an IT remediation owner, create a change request (CHG) directly from a remediation task (VUL) for all the vulnerable items in the group. Create a change request with pre-populated information that includes the preferred solution to expedite your investigation for vulnerabilities that require manual intervention.\n          - [Associate a remediation task to an existing change request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln_change_mgmnt_associate_chng.md) -- As an IT remediation owner, avoid creating duplicate change requests (CHG) as you work to resolve your remediation tasks by associating a remediation task (VUL) to a change request that is already available in your instance.\n          - [Split a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln_change_mgmnt_split.md) -- As an IT remediation owner, from an existing remediation task (VUL), identify a subset of vulnerable items (VI) that you want to move to a new group.\n          - [State synchronization between change requests and remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln_change_mgmnt_state_synch.md) -- There is a synchronized relationship between the State fields of remediation tasks (VULs) and the State fields of change requests (CHG) in the Vulnerability Response product. As a change request moves through its life cycle, it also moves the state of any related remediation tasks automatically.\n        - [Assess your exposure to vulnerable software](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr_sw_expsure_task.md) -- You can provide the publisher and product information in the Exposure Assessment module to assess your zero-day (current day) exposure of your assets to vulnerable software using the ITSM Software Asset Management (SAM) Foundation application.\n        - [Viewing assignment recommendations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ml_view_assignment_recommendations.md) -- An assignment group is usually allocated to a vulnerable item by using assignment rules. These rules are configured by the vulnerability administrator to allocate the correct assignment groups that are based on the data received from third-party scanners.\n          - [Request assignment group recommendations for a vulnerable item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ml-assignment-rec-for-vi.md) -- Request Vulnerability Assignment Recommendations so that you can view assignment group recommendations. You can request recommendations if a matching assignment group is not available or is incorrect for a vulnerable item (VI).\n          - [Request assignment group recommendations for multiple vulnerable items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ml-request-bulk-edit-vis.md) -- Use Vulnerability Assignment Recommendations to view the assignment group recommendations for multiple vulnerable items (VIs) using a bulk edit. When multiple VIs are selected, a prediction is performed on a random sample of the selected VIs.\n          - [Request assignment group recommendations for a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ml-request-bulk-edit-vg.md) -- Use Vulnerability Assignment Recommendations to view assignment group recommendations for a remediation task (VUL).\n        - [Requesting and approving an exception](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/request-approve-exception.md) -- You can request to defer the remediation of a vulnerable item or remediation task for a specified period. For example, as a remediation owner, you can request an exception if a patch is not available for a machine. Approvers who have access can approve requests from other users.\n          - [Request an exception for a vulnerable item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/raise-exception-vi.md) -- Request an exception for a vulnerable item (VI) that can’t be remediated immediately. For example, as a remediation owner, you can request an exception if a patch isn’t available for a machine.\n          - [Request an exception for a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/raise-exception-vg.md) -- Request an exception to defer a remediation task for a specified period if it can’t be resolved immediately.\n          - [Request a bulk exception](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/bulk-edit-ex-mgmt.md) -- Use the bulk edit option to request an exception for multiple vulnerable items (VITs) instead of manually selecting each item.\n          - [Request an exception using GRC: Policy and Compliance Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/integration-with-grc.md) -- Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Vulnerability Response.\n            - [Request a bulk exception using GRC: Policy and Compliance Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/bulk-edit-grc.md) -- Select a group of vulnerable items and submit a bulk exception.\n          - [Approve or reject an exception request in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/approve-ex-request.md) -- Approve or reject the exception requests for vulnerable items or remediation tasks that can't be remediated immediately. You must assess these requests for risk and then approve them for deferral until they can be remediated.\n        - [Working with an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/working-with-exception-rule.md) -- You can request an exception for vulnerabilities, vulnerable items (VIs), or configuration items (CIs) that can't be remediated or deferred immediately. By automating the VI deferral process, you can defer the matching VIs based on the rule when the system identifies them.\n          - [Create an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-exception-rule.md) -- Create a rule to automatically request an exception for a specific condition for a group of vulnerable items (VIs), such as a rule with a condition that is based on the vulnerability severity of these VIs. With this rule, you can defer new and existing VIs automatically if they match the approved rule condition.\n          - [Approve an exception rule request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/approve-ex-rule-request.md) -- Assess exception rule requests from users so that you can approve or reject these requests.\n          - [Activating an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/activating-ex-rule.md) -- A rule is activated on its \"Valid from\" date. After activation, it automates the exception process for vulnerable items (VIs).\n          - [Request an extension for an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/extend-ex-rule-request.md) -- Request an extension for a deferred exception rule before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n          - [Reopen an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/reopen-ex-rule.md) -- Reopen an exception rule that has been rejected, but you want to resubmit. Reopening the rule moves it to the Draft state.\n          - [Update an approved exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/update-approved-ex-rule.md) -- Cancel an approved rule to be able to update it. For example, before you can modify any dates or add a condition to an approved rule, you must cancel it so that the remediation task (VUL) is deleted, and the vulnerable items (VIs) move to the Open state.\n          - [Delete an exception rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/delete-ex-rule.md) -- Delete an exception rule that is not required anymore. For example, you can delete a rule if you don't want to defer a vulnerable item (VI) during ingestion.\n        - [Marking and approving a false positive](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/request-approve-fp.md) -- Vulnerable items (VIs) and remediation tasks (VULs) can be marked as false positives. Approvers with write access can approve such requests from other users.\n          - [Mark as a false positive](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/raise-fp-request.md) -- Mark a vulnerable item (VI) or remediation task (VUL) as a false positive if the warning given by the scanner is not actually an issue. For example, if a configuration item has been decommissioned but the scanner is still raising an issue related to it, mark it as a false positive.\n            - [Bulk edit for false positive](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/bulk-edit-fp.md) -- Use bulk edit to mark multiple vulnerable items (VITs) as false positive. If multiple VITs are selected, a remediation task is formed with these items.\n          - [Approve or reject a false positive](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/approve-fp-request.md) -- As a false positive approver, you can approve or reject false positive requests from other users.\n      - [Analytics and Reporting Solutions for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/monitor-vuln-rem-prog.md) -- Monitoring vulnerability remediation involves viewing trends, managing risk, and monitoring assignment groups. You can review high risk issues, assignment group workloads, deferrals and, reoccurring vulnerabilities. Vulnerability Response offers tools, reports, and procedures to make that process more productive and efficient.\n        - [Using the default Vulnerability Response dashboards](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_VulnHomepage.md) -- The Vulnerability Response overview dashboard (Vulnerability Management) provides an executive view into vulnerabilities and vulnerable items, helping the Vulnerability Admin pinpoint areas of concern quickly. The Vulnerability Response remediation dashboard (Vulnerability Remediation) allows a remediation specialist to focus on the remediation tasks and vulnerable items they own.\n        - [Platform Analytics Solutions for Vulnerability Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerability-mgmnt-content-pack.md) -- Platform Analytics Solutions contain prepackaged Performance Analytics and Reporting content for use with other ServiceNow AI Platform products. Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.This Analytics and Reporting Solution permits you to track the volume, performance and progress of vulnerabilities from initial analysis and detection to containment, or remediation. You can filter reports by assignment group, exploits, risk rating, or state.\n          - [Vulnerability Management CISO dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerability-mgmnt-CISO-dashboard.md) -- With the Vulnerability Management CISO dashboard, view data such as Key Performance Metrics (KPIs) for vulnerability remediation, see the highest risks, verify scan coverage, and learn how to lower risks.\n            - [Configure the Scan Coverage reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ciso-add-ci-class-to-scan-coverage-report.md) -- Enable your users to run scan coverage reports from the CISO dashboard. With these reports, your users can see what the organization's scan coverage is over a period of time.\n            - [Configure the PA indicators for the CISO Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ciso-view-indicators.md) -- Monitor the automated and formulated CISO indicators so that you can manage the vulnerability data in your instance.\n          - [SecOps Vulnerability Response Health dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/health-dashboard-overview.md) -- The Vulnerability Response Health dashboard is a tool designed to empower organizations with comprehensive insights into the implementation and usage of their Vulnerability Response applications.\n            - [Modifying the threshold values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/health-dashboard-threshold-val.md) -- You can modify the threshold values for the SecOps VR Health dashboard data based on your preferences.\n        - [Vulnerability Management (PA) dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerability-mgmnt-pa-dashboard.md) -- Track the volume, performance and progress of vulnerabilities from initial analysis and detection to containment, or remediation. You can filter reports by assignment group, exploits, risk rating, or state, for example. Quickly gain insight into your vulnerability exposure and which business services are affected.\n          - [View Performance Analytics for Vulnerability Response [PA] reports in real-time](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr_real_time_report_PA_VR.md) -- To manage your most important vulnerable items (VIs) and help you remediate them quickly, view reports on-demand, in real-time on the Vulnerability Management (PA) dashboard. The Performance Analytics for Vulnerability Response application is available with a separate subscription from the ServiceNow Store.\n          - [View the Performance Analytics indicators for Vulnerability Response [PA]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/view-pa-indicators.md) -- View automated and formulated Performance Analytics indicators representing the vulnerability data in your instance.\n        - [Aggregated reports framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerability-response-common-content-pack.md) -- Using aggregated reports framework, you can create reports for the data that involves complex and long-running on-the-fly queries for better performance.Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.\n          - [Configure an aggregation for source data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/configure-indicator-for-source-data.md) -- To analyze the performance of a specific facet in a business process that is recorded in a ServiceNow table, create an aggregation specific to the facet and create a report for this aggregation.\n            - [Run multiple aggregations simultaneously](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/run-multiple-aggregations.md) -- You can schedule the execution of multiple aggregations using a single Aggregation schedule.\n            - [Configure the number of aggregations that can run simultaneously](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-config-arf-processor.md) -- A new processor or a background job, Aggregated Reporting Framework Processor is shipped with the base system, which executes the scheduled jobs that are related to the Aggregated Reports Framework table. This enables the entire subsystem to run in the background, and it allows better utilization of system resources when they’re available.\n          - [Create a report using an aggregation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/generate-report.md) -- To visualize and analyze the data specific to an aggregation that you created, generate a report by providing a condition for the aggregation in the condition builder.\n      - [Vulnerability Response reference information](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-reference-info.md) -- The following topics provide you with links, reference information, troubleshooting, and knowledge articles, in addition to field data on the forms and records found in Vulnerability Response.\n        - [Implementation checklist for the Vulnerability Response application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-implement-chklist.md) -- This checklist lists the steps required for a basic implementation of the Vulnerability Response application on your ServiceNow AI Platform instance. When you have completed these tasks, the base system is ready for operation and verification.\n        - [Vulnerability Response remediation task states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-rt-states.md) -- Third-party integrations import vulnerable item detection data that create new vulnerability items (VITs) or update existing VITs. Detection states update VIT states in so far as they’re Open or Closed.\n          - [Detections, remediation tasks, and vulnerable item states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-detections-rt-vi-states.md) -- Third-party integrations retrieve the vulnerable item detection data. Detections are distinct occurrences of vulnerabilities as reported by the scanners.\n          - [Remediation tasks and vulnerable item states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-rt-vi-states.md) -- Remediation tasks and vulnerable items states can affect each other. Most of the time, a remediation task state updates the vulnerable item state, with the highest precedence task state used to update the vulnerable items in the group.\n          - [State roll-up and roll-down scenarios](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-state-rollup-rolldown.md) -- State roll-up and roll-down scenarios automatically sync the status of remediation tasks (RTs) and vulnerable items (VITs), ensuring real-time updates across both. This dynamic interaction reduces manual tracking, enhances accuracy, and provides users with an up-to-date view of progress, making vulnerability management more efficient and helping users make informed decisions quickly.\n          - [Remediation task state for Vulnerable Items (VITs) in multiple groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-rt-state-for-multi-grp-vi.md) -- When a VIT is in multiple remediation tasks, (RT in the following tables), and its own state has not been set, the higher precedence group state determines the state of that VIT, as shown in the following table.\n        - [Additional settings for domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/ds-additional-config.md) -- For precise execution and results, the following precautions and settings are required for domain separation in Vulnerability Response, Application Vulnerability Response, Container Vulnerability Response, and Configuration Compliance.\n        - [Discovered Items form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/discovered-items-fields.md) -- Assets are automatically matched to configuration items (CIs) in the Configuration Management Database (CMDB) when they’re imported using the CI Lookup Rules. Records for unmatched CIs are automatically created during third-party vulnerability integration imports and included in Discovered Items. However, for cloud assets that aren’t present in CMDB Cl, the record is created in the cloud resource class.\n        - [Vulnerability Response vulnerability form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerability-fields.md) -- Vulnerabilities are created automatically when records are downloaded from the National Vulnerability Database (NVD), Common Weakness Enumeration (CWE), or third-party integrations and stored under Libraries in Vulnerability Response.\n        - [Remediation target rule fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/sem-rt-rules-fields.md) -- Use remediation target rules to define how remediation timelines are calculated and maintained for findings. Administrators can configure base target dates and recalculation behavior when risk ratings change. The following table describes all fields available in the remediation target rule form.\n        - [Remediation task form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerability-group-fields.md) -- Using remediation tasks, the analyst can monitor progress and drive the mediation process more efficiently.\n        - [Questionnaire Configuration form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/compensating-controls-approval-rule-new-record-form.md) -- You can define distinct questionnaire for a distinct collection of vulnerabilities or remediation tasks by filtering the vulnerabilities or remediation tasks respectively in the VR Questionnaire Configuration section of Settings for VR Exception Management form.\n        - [Vulnerability Response vulnerable item form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vulnerable-item-fields.md) -- Vulnerable items are automatically created during third-party vulnerability integration imports.\n        - [Solution form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/solution-fields.md) -- Solutions are created automatically when records are downloaded from third-party solution integrations and stored under Solutions in Vulnerability Response.\n        - [Approval workflow configurations for unassign request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-unassign-approval-rules.md) -- You can design the approval workflow for the removal of assignments from vulnerable items (VIs, VITs), remediation tasks, application vulnerable items (AVITs), and container vulnerable items (CVITs) for you and your group.\n        - [Vulnerability Response remediation task rule examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vul-group-rules-examples-v10.md) -- Examples of remediation task rules using vulnerability and risk, or impact, or configuration item (CI).\n        - [Risk score calculation example for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vuln-calc-risk-rule-example.md) -- You can determine the risk score calculators to generate risk scores that use the vulnerability and asset data unique to your organization.\n        - [Error handling for detections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/detections-error-handling.md) -- Errors are logged while creating detections, or creating and updating vulnerable items, while processing the attachments. If a vulnerability integration process fails, errors are logged in the 'Vulnerability Integrations Log' tab.\n      - [Mobile experience for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mobile-vr.md) -- As a remediation owner, you can access the Vulnerability Response (VR) application on your ServiceNow AI Platform instance with your Android or iOS mobile device.When decided, copy all mobile to Madrid for June. Make a list of where it gets referenced in existing docs for weaving it in by mention. (\"Action available in the mobile app.\")\n        - [Set up checklist for the Vulnerability Response Mobile app](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mobile-vr-setupinstll-mobile.md) -- The following checklist includes the set up tasks that you are required to complete in your ServiceNow AI Platform instance and on your mobile device prior to using the Vulnerability Response Mobile app.\n        - [Log in to the Vulnerability Response Mobile app](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mobile-vr-login-mobileapp.md) -- Open the Vulnerability Response Mobile app and add a ServiceNow AI Platform instance with Vulnerability Response to your mobile device.\n        - [View, assign, and edit remediation tasks with the Vulnerability Response Mobile app](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mobile-reassign-vg.md) -- View, assign, or edit the fields on remediation task (RT) records assigned to your group. Navigate through vulnerabilities, vulnerability items, and solutions records and related lists to view solutions, deployment metrics, and items to address.\n        - [View, reassign, and edit remediation tasks assigned to you with the Vulnerability Response Mobile app](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mobile-vr-yourvg-vis.md) -- View, assign, or edit the fields on remediation tasks records that are assigned to you. Navigate through records and related lists to view solutions, deployment metrics, and items to address.\n        - [Search for remediation tasks with the Vulnerability Response Mobile app](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mobile-vr-search-vgs.md) -- Search for remediation tasks that match specific search criteria that you select.\n        - [Filter records with the Vulnerability Response Mobile app](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/mobile-filter-records.md) -- Set additional filters to limit the number of records that are displayed on a screen. Filtering records in the mobile app works like filtering with a condition builder on the ServiceNow AI Platform.\n      - [Vulnerability Response Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/c_VulnRespOrchestration.md) -- With Vulnerability Response Orchestration workflows and activities you can interact with and retrieve data from Windows or UNIX-based systems and environments using workflow orchestration. By enriching data, you can shorten the remediation life cycle.\n        - [Scan vulnerability workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/scan-vulnerability-workflow.md) -- The Vulnerability Response Scan Vulnerability workflow rescans a remediation task.\n        - [Scan vulnerability item workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/scan-vulnerable-item-workflow.md) -- The Vulnerable Response Scan Vulnerability Item workflow rescans a vulnerable item.\n        - [Variables for Create Scan Record for Vulnerabilities activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/create-scan-record-for-vuln-activity.md) -- Vulnerability scans for single or multiple vulnerable items can be run using the Create Scan Record for Vulnerabilities workflow activity included in the base system. When the input is passed to the activity, it creates a scan record.\n    - [Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-landing.md) -- The Application Vulnerability Response (AVR) feature of the ServiceNow Vulnerability Response application imports application vulnerable items (AVITs) and, according to rules, allows you to remediate application vulnerabilities. Vulnerability Response is available by separate subscription.\n      - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/app-vuln-mgmt.md) -- Application vulnerabilities are vulnerabilities on your custom software applications that are scanned throughout the application’s development life cycle.\n      - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-configuring.md) -- Before you run Application Vulnerability Response in your ServiceNow AI Platform instance, you must configure it.\n        - [Configure Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/configure-avm.md) -- Do the following setup steps prior to configuration so that you can ensure that your configuration is complete.\n          - [Verify that the scheduled job for updating CWE records is running](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-verify-CWE-sched-job.md) -- Use Common Weakness Enumeration (CWE) records downloaded from the CWE database for reference when deciding whether a vulnerability must be escalated. Update common weakness records from the Common Weakness Enumeration database on a regularly scheduled basis. You can also update the default script or write your own scripts, as needed.\n          - [Verify that the scheduled job for updating NVD records is running](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-verify-NVD-sched-job.md) -- Identify the repositories that you want updated regularly. You can execute a scheduled job to update National Vulnerability Database (NVD) records on a nightly or weekly basis. If it is not already running, you can enable the job\n          - [Install](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-activate-integrations.md) -- Enable Application Vulnerability Response integrations to perform regular updates.\n          - [Define Application Vulnerability Response email notifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-define-email-notifications.md) -- Set up email notifications to share useful information about important updates and activities such as approval and rejection of false-positive requests. Creating an email notification involves specifying when to send it, who receives it, and what it contains.\n            - [Create or edit remediation target notifications in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-create-remediation-notification.md) -- Vulnerability administrators can edit the remediation target notification or add new ones, specifying when to send the notification, who receives the notification, and what content is in the notification.\n          - [Exception Management in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-exception-management.md) -- When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to an application vulnerable item (AVIT) that cannot be remediated according to the policy.\n            - [Configure Exception Management for Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/configure-exception-management-application-vulnerability-response.md) -- Limit the duration of an exception requested and add a questionnaire to the exception or false positive request using the module. By default, an exception is requested using the ServiceNow Application Vulnerability Response module. You can also request an exception using the GRC: Policy and Compliance Management integration.\n            - [Configure approval rules for Exception Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-exception-mgt-approval-rules.md) -- Starting with Application Vulnerability Response v15.0, use the flow designer to approve exception requests for exception management, exception rules, and false positive management. If you are deploying Application Vulnerability Response (AVR) for the first time, the flow designer is enabled by default.\n            - [Deferring remediation in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/aws-defer-awaiting-implementation.md) -- Starting with v20.0, you can defer remediation with the Awaiting Implementation state that is available for application vulnerable items (AVI)s and remediation tasks as they move through their life cycles. You can only transition records to this state manually by selecting Awaiting Implementation from AVI and remediation task records in the Under Investigation state.\n            - [Add an exception approver for Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-add-exception-approver.md) -- Add users to the approver groups so that you can request an exception.\n            - [Requesting and approving an exception in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-request-approve-exception.md) -- You can request to defer the remediation of an application vulnerable item and a remediation task for a specified period.\n              - [Request an exception for an application vulnerable item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-raise-exception.md) -- Request an exception for an application vulnerable item that cannot be remediated immediately. For example, as a developer, you can request an exception if a patch is not available for a machine.\n              - [Request an exception for application vulnerabilities using GRC: Policy and Compliance Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/integrate-with-grc-avr.md) -- Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Application Vulnerability Response.\n              - [Request an exception for an application remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/raise-exception-art.md) -- Request an exception to defer a application remediation task for a specified period if it can’t be resolved immediately.\n              - [Approve exception rules and exception rule extension requests in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-approve-ex-request.md) -- Approve exception requests for application vulnerable items that can't be remediated immediately. You must assess these requests for risk and then approve them for deferral until they can be remediated.\n              - [Define policy reason mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/define-policy-reason-mapping.md) -- You can define the reason choices to be available to any user who requests an exception.\n              - [Request an extension for an exception rule in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/extend-ex-rule-request-avr.md) -- Request an extension for a deferred exception rule before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n              - [Request an extension for a deferred remediation task in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/extend-defer-app-vuln-group.md) -- Request an extension for a deferred remediation task (VUL) before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n              - [Request an extension for a deferred application vulnerable item in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/extend-defer-app-vul-item.md) -- Request an extension for a deferred application vulnerable item before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n            - [Create, delete, and cancel an exception rule for Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-create-exception-rule.md) -- Create a rule to request an exception automatically for application vulnerable items (AVI)s that meet specific conditions.\n          - [Application Vulnerability Response remediation tasks and task rules overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-rt-rt-rules-overview.md) -- Configure remediation tasks (AVULs) to help analysts and remediation specialists organize application vulnerable items (AVI) and analyze them in bulk. The criteria by which remediation tasks are formed is configured so that AVIs are automatically assigned into remediation tasks. Using remediation tasks, you can monitor progress and drive the remediation process more efficiently.\n            - [Create, edit, and delete Application Vulnerability Response remediation task rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-create-rt-rule.md) -- You can create rules to automatically group application vulnerable items (AVI) into remediation tasks (AVUL) based on filter conditions. These rules automatically group AVIs as they're imported or manually created.\n            - [Create an application remediation task manually in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-create-rt-manually.md) -- Create an application remediation task (AVUL) from another application remediation task record and add application vulnerable items (AVITs) manually.\n            - [Create auto-close rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-create-auto-close-rules.md) -- Use auto-close rules to close older AVITs automatically based on the filter conditions that you set.\n        - [Configure penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-config-v16-1.md) -- You can configure the sprint duration and estimated effort for penetration testing assessment types. This provides the scheduling functionality for application owners, helping them determine a tentative time frame for their penetration test assessment requests.\n          - [Configure sprints for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-config-sprints.md) -- Configure the sprint duration and capacity for the ethical hacking team so they can manage the sprint capacity for penetration test assessments.\n          - [Configure assessment types for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-config-assessment-types.md) -- Configure the estimated effort for each type of penetration testing assessment. This enables you to manage the capacity of each sprint, by estimating the effort required for each assessment type.\n      - [Integrate with other applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-integrations.md) -- Vulnerability Response includes support for third-party integrations.\n        - [Vulnerability Response Integration with Black Duck](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/blackduck-integration.md) -- The Vulnerability Response integration with Vulnerability Response Integration with Black Duck uses the data that is imported from the Black Duck Software Composition Analysis (SCA) tool to help you determine the impact and priority of the flaws in your code.\n          - [Prepare pre-integration tasks for Vulnerability Response Integration with Black Duck](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/blackduck-prerequisites.md) -- Plan and execute the pre-integration tasks for the Vulnerability Response Integration with Black Duck so that your integration is successful. The Vulnerability Response Integration with Black Duck assumes that you’re familiar with the Black Duck Software Composition Analysis (SCA) application and APIs.\n          - [Install the ServiceNow Vulnerability Response Integration with Black Duck](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/install-blackduck.md) -- Before you run the integration on your instance, you must complete the installation and configuration steps so that the Black Duck Software Composition Analysis (SCA) tool properly integrates with Application Vulnerability Response.\n          - [Configure the Vulnerability Response Integration with Black Duck](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/configure-blackduck.md) -- Before you run the Vulnerability Response Integration with Black Duck on your instance, you must complete the installation and configuration steps so that the Black Duck Software Composition Analysis (SCA) tool properly integrates with the Application Vulnerability Response application.\n            - [View the Vulnerability Response Integration with Black Duck import run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/blackduck-vuln-check-imports.md) -- Verify the success of your integration runs, locate any issues, and confirm your remediation decisions by viewing the Vulnerability Integration Runs related list.\n          - [Data transformation for the Vulnerability Response Integration with Black Duck](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/blackduck-data-transformref.md) -- After you identify the data that you want to import, the data is retrieved from the Vulnerability Response Integration with Black Duck, processed through a set of data sources, and transformed in your instance.\n          - [Import the project information from the Black Duck integration instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/blackduck-integration-activities.md) -- Import the project information from the Black Duck integration instance to make sure that the vulnerability integrations run sequentially. A successful integration helps you to identify and ingest the application vulnerable items (AVIs).\n            - [Import Vulnerability Response Integration with Black Duck project versions to the Discovered Applications table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/blackduck-integration-activity-application-list-integrtn.md) -- Import the Vulnerability Response integration with Black Duck project versions to the Discovered Applications [sn_vul_release] table so that the Black Duck Vulnerability integrations run sequentially. A successful integration helps you to identify and ingest the application vulnerable items (AVIs).\n            - [Import the application vulnerable items from the Vulnerability Response Integration with Black Duck](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/blackduck-integration-activity-application-vulnerable-item.md) -- Import the application vulnerable items (AVIs) from the Vulnerability Response integration with Black Duck so that the integration runs sequentially. A successful integration helps you to identify and ingest the AVIs.\n            - [Set the import times for the Vulnerability Response Integration with Black Duck](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/set-import-time-blackduck.md) -- Set the start time for the Vulnerability Response Integration with Black Duck imports. You can set the integrations ahead of time so that you get better performance and faster import runs.\n            - [Include Closed Black Duck application vulnerable items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/include-closed-avits-blackduck.md) -- Include Closed application vulnerable items (AVIs) during the Black Duck vulnerable item integration imports because by default, they aren’t created during the integration imports. If you want to create them, you must change the system property.\n        - [Fortify Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/fortify-vuln-integration.md) -- The Fortify Vulnerability Integration uses data imported from the Fortify product to help you determine the impact and priority of flaws in your code.\n          - [Preparing for the Fortify Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/fortify-prerequisites.md) -- A successful Fortify Vulnerability Integration requires planning and the execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Fortify Vulnerability Integration assumes that you are familiar with the Fortify product and API.\n          - [Install the ServiceNow Vulnerability Response Integration with Fortify](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/install-fortify.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the Fortify product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.\n          - [Configure the Fortify Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/configure-fortify.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the Fortify product properly integrates with the Application Vulnerability Response feature of Vulnerability Response. This application is available as a separate subscription.\n          - [View the Fortify Vulnerability Integration import run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/fortify-check-imports.md) -- Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.\n          - [Fortify Vulnerability Integration modification and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/fortify-optional-modifications.md) -- Configure optional modifications specifically for the Fortify Vulnerability Integration.\n            - [Perform a manual Fortify application vulnerability import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/manual-fortify-import.md) -- If your initial import failed, or you do not want to wait for the scheduled initial import, you can perform a full data import independent of the daily scheduled job.\n            - [Import data using the Fortify Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/set-import-time-fortify.md) -- Import data from the Fortify scanner, to map Application Vulnerable Items (AVIs), thereby enriching the data in your instance.\n            - [Include Closed Fortify on Demand application vulnerable items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/include-closed-avits-fortify.md) -- By default, Closed application vulnerable items (AVITs) are not created during Fortify Vulnerable Item integration imports. If you want to create them, you must change a system property.\n        - [GitHub Application Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-vuln-integration.md) -- The GitHub Application Vulnerability Integration imports Static application security testing (SAST) and Software Composition Analysis (SCA) data to help you view vulnerability alerts in the repositories in your GitHub environment.\n          - [Setup tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-vuln-prerequisites.md) -- Prepare for the integration by performing these tasks. The GitHub Application Vulnerability Integration assumes that you are familiar with the GitHub product and API.\n            - [Creating OAuth 2.0 credentials for GitHub Apps - JWT for the GitHub Application Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-app-vuln-apps-oauth-jwt.md) -- Perform the following steps to integrate your GitHub Apps using the JWT bearer token for the GitHub Application Vulnerability Integration.\n              - [Create and configure the GitHub app for the GitHub Application Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-app-vuln-apps-oauth-jwt.md) -- Perform the following steps to integrate your GitHub Apps using the JWT bearer token for the GitHub Application Vulnerability Integration.\n              - [Generate the JKS certificate for the GitHub Application Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-app-vuln-apps-oauth-jwt.md) -- Perform the following steps to integrate your GitHub Apps using the JWT bearer token for the GitHub Application Vulnerability Integration.\n              - [Attach the GitHub Java Key Store certificate to your instance for the GitHub Application Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-app-vuln-apps-oauth-jwt.md) -- Perform the following steps to integrate your GitHub Apps using the JWT bearer token for the GitHub Application Vulnerability Integration.\n              - [Create a JWT signing key for the GitHub JKS certificate for the GitHub Application Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-app-vuln-apps-oauth-jwt.md) -- Perform the following steps to integrate your GitHub Apps using the JWT bearer token for the GitHub Application Vulnerability Integration.\n              - [Create a JWT provider for your GitHub signing key for the GitHub Application Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-app-vuln-apps-oauth-jwt.md) -- Perform the following steps to integrate your GitHub Apps using the JWT bearer token for the GitHub Application Vulnerability Integration.\n              - [Register GitHub as an OAuth Provider (JWT) for the GitHub Application Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-app-vuln-apps-oauth-jwt.md) -- Perform the following steps to integrate your GitHub Apps using the JWT bearer token for the GitHub Application Vulnerability Integration.\n              - [Create Credentials and Connections for the GitHub Application Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-app-vuln-apps-oauth-jwt.md) -- Perform the following steps to integrate your GitHub Apps using the JWT bearer token for the GitHub Application Vulnerability Integration.\n          - [Install](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/install-github-vulnerability.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the GitHub Application Vulnerability Integration properly integrates with Application Vulnerability Response. This application is available as a separate subscription.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/configure-github-vulnerability.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the GitHub product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.\n          - [View import run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-vuln-check-imports.md) -- Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.\n          - [View import sets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/github-vulnerability-scan-summary.md) -- View details for import information for the GitHub Application Vulnerability Integration.\n          - [Field mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-github-vuln-mapping.md) -- Review source and target fields and view imported data on tables and records in your ServiceNow AI Platform instance.\n        - [Invicti Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/invicti-vuln-integration.md) -- The Invicti Vulnerability Integration uses application data imported from the Invicti product to help you determine the impact and priority of flaws in your code.\n          - [Prepare for the Invicti Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/invicti-prerequisites.md) -- A successful integration requires planning and the execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Invicti Vulnerability Integration assumes that you are familiar with the Invicti product and API.\n          - [Install the ServiceNow Vulnerability Response Integration with Invicti](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/invicti-install.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the Invicti Vulnerability Integration application properly integrates with Application Vulnerability Response. This application is available as a separate subscription.\n          - [Configure the Invicti Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/invicti-configure.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the Invicti Vulnerability Integration properly works with the Application Vulnerability Response feature of Vulnerability Response.\n          - [Viewing the Invicti Vulnerability Integration import run status and records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/invicti-check-imports.md) -- Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.\n          - [Invicti Vulnerability Integration state mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/invicti-mapping.md) -- The following source states from the Invicti Vulnerability Integration and their target states in your instance are listed in the following table.\n        - [Veracode Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/veracode-vuln-integration.md) -- The Vulnerability Response Integration with Veracode application uses data imported from the Veracode product to help you determine the impact and priority of flaws in your code.\n          - [Preparing for the Veracode Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/veracode-prerequisites.md) -- A successful Veracode Vulnerability Integration requires planning and the execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Veracode Vulnerability Integration assumes that you are familiar with the Veracode product and API.\n          - [Install the ServiceNow Vulnerability Response Integration with Veracode](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/install-veracode.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the Veracode product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.\n          - [Configure the Veracode Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/configure-veracode.md) -- Before you run the integration on your instance, the installation and configuration steps must be completed so the Veracode product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.\n            - [View the Veracode Application Vulnerability Integration import run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/veracode-check-imports.md) -- Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.\n            - [View Veracode scan summaries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/veracode-scan-summary.md) -- View details for scan summary information for the Veracode Vulnerability Integration.\n          - [Data transformation for the Veracode Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/veracode-data-transformref.md) -- After you identify the data that you want to import, the data is retrieved from the Veracode application, processed through a set of data sources, and transformed in your instance.\n          - [Veracode Vulnerability Integration modifications and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/veracode-optional-modifications.md) -- Configure optional modifications specifically for the Veracode Vulnerability Integration.\n            - [Modify Veracode integration instance parameters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/veracode-optional-modifications.md) -- Configure optional modifications specifically for the Veracode Vulnerability Integration.\n            - [Perform a manual Veracode application vulnerability import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/veracode-optional-modifications.md) -- Configure optional modifications specifically for the Veracode Vulnerability Integration.\n            - [Set Veracode Vulnerability Integration import times](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/veracode-optional-modifications.md) -- Configure optional modifications specifically for the Veracode Vulnerability Integration.\n            - [Include Closed Veracode application vulnerable items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/veracode-optional-modifications.md) -- Configure optional modifications specifically for the Veracode Vulnerability Integration.\n        - [Wiz Vulnerability Response Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/wiz-exploring-avr-sca-secrets.md) -- Import application vulnerability response data that includes application, Software Composition Analysis (SCA) and secrets data with the Wiz Application Vulnerability Response Integration.\n        - [Manual ingestion of vulnerabilities for Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/manual-ingestion-of-vulnerabilities-for-application-vulnerability-response.md) -- Security professionals and application testers can create and manage the application penetration test findings within the Penetration Testing Workspace.\n          - [Upload application vulnerabilities using a template file](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/ingest-vulnerabilities-manually-avr.md) -- Use a template file to upload the application vulnerabilities. To access and download the template, navigate to All Manual AVIT Ingestion Upload File UI .\n          - [Verify integration run](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/verify-manual-integration-run-avr.md) -- If the integration run is successful, review the count of individual detections and the penetration test findings created or updated.\n          - [Verify upload status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/verify-upload-status-avr.md) -- Verify whether the vulnerability integration run was successful, partially successful, or a failure.\n        - [Tenable Web Application Scanning Vulnerability Response Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/tenable-was-integration.md) -- Import applications, findings and associated application vulnerabilities from the Tenable Web application and manage them in ServiceNow Vulnerability Response.\n          - [Configure Tenable Web Application Scanning Vulnerability Response Integration using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/configure-tenable-was-integration-using-setup-assistant.md) -- Establish authenticated communication between ServiceNow and Tenable.was using API keys so the platform can retrieve application and vulnerability data.\n          - [Import Applications Data from Tenable Web Application Scanning Vulnerability Response Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/import-applications-data-from-tenable-was.md) -- Import application assets from Tenable WAS Vulnerability Response Integration using the Assets Export APIs and create import queue entries for transformation.\n          - [Import Vulnerabilities Data from Tenable Web Application Scanning Vulnerability Response Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/import-vulnerabilities-data-from-tenable-was.md) -- Import vulnerability findings and associated metadata using Tenable WAS Export Findings APIs.\n      - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-monitor-rem-prog.md) -- Monitoring remediation is a process that begins with reviewing status and ends with closing application vulnerable items (AVITs). Application Vulnerability Response offers tools and procedures to make that process more productive and efficient.\n        - [View vulnerability libraries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-view-vuln-libraries.md) -- You can view vulnerability data imported from the National Vulnerability Database (NVD), Common Weakness Enumeration (CWE), or third-parties to decide whether to escalate a remediation task.\n          - [Application Vulnerability fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-vulnerability-fields.md) -- Vulnerabilities are created automatically when records are downloaded from the National Vulnerability Database (NVD), Common Weakness Enumeration (CWE) or third-party integrations. NVD and CWE are stored under Libraries in Vulnerability Response or under Vulnerabilities in Application Vulnerability Response.\n        - [Identify applications in Application Vulnerability Response automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-ci-lookup-rules.md) -- When data is imported from a third-party integration, Application Vulnerability Response automatically uses application data to search for matches in the Configuration Management Database (CMDB). It does this using lookup Rules. These rules identify applications for the application vulnerable item (AVI) record to aid in remediation.Update with VR CI LOOKUP RULES changes.\n          - [Create a CI lookup rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-create-ci-lookup-rules.md) -- The CI Lookup Rules module contains rules that define what fields have matching data in the Configuration Management Database (CMDB). These rules are used to identify applications and application releases and add them to the application vulnerable item (AVI) record to aid in remediation.\n            - [Reapplying lookup rules in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-reapplying-ci-lookup-rules.md) -- You can reapply your configuration item (CI) lookup rules to update existing CIs (scanned applications and product models) on discovered application records.\n            - [Prevent duplicate or orphaned records after running Application Vulnerability Response lookup rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-ci-lookup-rules-impl-test.md) -- Take steps to prevent duplicate or orphan records resulting from matching (configuration items (CIs) within the CMDB.\n        - [Assign application vulnerable items in Application Vulnerability Response automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-assignment-rules.md) -- Automatically assign application vulnerabilities based on application tags, or any of the assignment groups in the Configuration Item [cmdb_ci] or platform assignment groups, to reduce the mean time to assignment.\n          - [Create or edit Application Vulnerability Response assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-create-assign-rules.md) -- You can create rules to automatically assign application vulnerable items (AVIs) based on filter conditions. These rules assign AVIs as they are imported or manually created.\n          - [Removing assignments from Application Vulnerability Response vulnerable items and remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/unassigning-avits.md) -- You can clear the Assigned to and Assignment group fields on Application Vulnerability Response vulnerable items directly from the application vulnerable item and remediation task records that you determine might be incorrectly assigned to you or your groups.\n        - [Calculate risk in Application Vulnerability Response automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-calculators-rules.md) -- Application vulnerability calculators automate calculating initial risk values for the fields on application vulnerable items (AVIs). Risk calculations offer insight into prioritizing remediation. The condition for each calculator is evaluated in order, and the first matching calculator is used.\n          - [Define fields and weights for the risk rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-vuln-calc-define-risk-rule-fields.md) -- Customize the parameters and weights for the risk rule so that you can generate risk scores that use the vulnerability and asset data that are unique to your organization. By selecting the fields that are included in the risk rule, you can define an effective risk scoring framework.\n          - [Create an application vulnerability calculator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-create-calculator.md) -- An application vulnerability calculator is a pre-defined formula to calculate a target field when certain criteria are met. Calculators, which calculate the application vulnerable item (AVI) Risk Score, can contain Risk Rules. Risk calculations offer insight in prioritizing remediation.\n        - [Map the severity of an application vulnerable item automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-create-severity-map.md) -- Application Vulnerability Response severity mapping transforms third-party source severity fields to recognizable fields within Vulnerability Response.\n          - [Filtering within Application Vulnerability Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-filtering.md) -- Calculators, and Assignment Rules use conditions during import, created using the condition builder. Changes to their criteria can affect performance since each record is evaluated using these filters.\n        - [Automate remediation target tracking in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-time-to-remediate-rules.md) -- Application Remediation Target Rules define the expected timeframe for remediating application vulnerable items (AVIs), providing a timeframe for remediating the vulnerability itself. For example, if an application vulnerable item contains a critical risk rating then the vulnerability on that item needs to be fixed within 15 days.\n          - [Create or edit application remediation target rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-create-time-to-rem-rule.md) -- Drive the remediation of high-risk vulnerabilities in a timely manner by setting up a remediation target rule at the application vulnerable item (AVI) level.\n          - [View the remediation target status of an application vulnerable item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-view-remed-target-task.md) -- When an application vulnerable item (AVI) has nearly reached (or passed) its remediation target date, as defined by a remediation target rule, the AVI record is updated with a status. This information can help you proactively monitor upcoming remediation activities.\n        - [Close a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-close-remediation-task.md) -- If you determine that the issue associated with an application remediation task can be immediately closed without further analysis, you can use the Close feature. Starting with v23.0 of Vulnerability Response, the Close button has been removed for an application remediation task.\n        - [Change Management for Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/app-vul-change-management-overview.md) -- Create change requests from remediation tasks in the Application Vulnerability Response application to expedite your investigation for application vulnerabilities (AVIT)s that require manual intervention.\n          - [Create a change request for Application Remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/create-change-request-app-vuln.md) -- As a App-sec Manager or Security Champion, you can create change requests from remediation tasks in the Application Vulnerability Response application.\n          - [Associate a remediation task to an existing change request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/associate-change-request-app-vuln.md) -- As a Appsec Manager or Security Champion, avoid creating duplicate change requests (CHG) as you work to resolve your remediation tasks by associating a remediation task (APP-VUL) to a change request that is already available in your instance.\n        - [Penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen_test_overview_avm.md) -- Penetration testing in Application Vulnerability Response enables application owners to assess the security posture of their application. It is the manual testing of an application by the ethical hacking team.\n          - [Configure assessment types for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-config-assessment-types.md) -- Configure the estimated effort for each type of penetration testing assessment. This enables you to manage the capacity of each sprint, by estimating the effort required for each assessment type.\n          - [Configure penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-config-v16-1.md) -- You can configure the sprint duration and estimated effort for penetration testing assessment types. This provides the scheduling functionality for application owners, helping them determine a tentative time frame for their penetration test assessment requests.\n          - [Configure sprints for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-config-sprints.md) -- Configure the sprint duration and capacity for the ethical hacking team so they can manage the sprint capacity for penetration test assessments.\n          - [Create a penetration test assessment request from existing requests (v19.0)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-create-from-list.md) -- Starting with v19.0, you create penetration test assessment requests directly from the list of existing requests. You can also copy existing requests in the Closed state on this list to create requests.\n          - [Create a penetration test assessment request (prior to v19.0)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-create-request-avm.md) -- Initiate a penetration test assessment request for your web applications or APIs. These requests are submitted to the ethical hacking team, who then proceed to test these applications and manually report the penetration test findings.\n          - [Attach findings to a penetration testing assessment request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pentest-attach-findings-pentest-request.md) -- Attach application vulnerable item findings to an existing penetration test request using the manual ingestion process.\n          - [Replicate a penetration test request in closed state](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-copy-create-request.md) -- Create a penetration test assessment request by replicating a request in Closed state. Active application vulnerable items (AVIs) are copied to the new request.\n          - [Create penetration test findings based on assessment requests (prior to v19.0)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-create-avi.md) -- Create penetration test findings based on the penetration test assessment request. These findings are manually-created Application Vulnerability Items (AVIs).\n          - [Create an application vulnerability entry](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen-test-create-app-vul-entry-avm.md) -- Create an application vulnerability entry for the vulnerability specified for the penetration test finding. Application vulnerabilities are vulnerabilities on the custom software applications.\n        - [Penetration testing workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen_test_workspace_avr.md) -- Penetration testing workspace in Application Vulnerability Response helps customers request for penetration test assessment request and track it using the workflow. It enables application owners to assess the security posture of their application. It is the manual testing of an application by the ethical hacking team.\n          - [Create a new penetration testing assessment request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/create-new-pen-test-assesment-req.md) -- Initiate a penetration test assessment request for your web applications, mobile applications, or APIs. These requests are submitted to the ethical hacking team, who then proceed to test these applications and manually report the penetration test findings.\n          - [Create penetration test findings based on an assessment questionnaire](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/create-penetration-test-findings.md) -- Create penetration test findings aligning testing with recognized standards of MASVS questionnaire into the penetration testing workflow. These findings are manually created Application Vulnerability Items (AVIs).\n          - [Publish the assessment questionnaire](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/publish-the-assessment-questionnaire.md) -- For testing a mobile application, there are certain standards developed by the OAS community to help testers identify the bugs in their products. Navigate to the assessment workspace to create the questionnaire of your choice. Publish them to be able to view in the assessment request form.\n          - [Use an assessment questionnaire](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/use-assessment-questionnaire.md) -- Post creation of the assessment questionnaire, you can use these questionnaires for testing purpose.\n        - [Penetration Testing Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/penetration-testing-dashboard.md) -- Get an overview of your penetration test requests and manual findings on your personal Penetration Test Dashboard. You can view the progress of your team with in the Penetration Test Workspace.
 The dashboard provides you with an overview of penetration test findings, view, and prioritize tests that need your attention, track test findings, and view assignments.\n          - [Penetration Dashboard components](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen_test_dashboard_components.md) -- Analyze your team's progress and data visually and drive business outcomes with the help of the components on your personal dashboard.\n      - [Platform Analytics and Reporting Solutions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/app-vuln-mgmnt-content-pack.md) -- Platform Analytics Solutions contain prepackaged Platform Analytics content for use with other ServiceNow AI Platform products. This Platform Analytics Solution presents important metrics for analyzing your Application Vulnerability Management process.Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.\n        - [Application Vulnerability Management (PA) dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/app-vuln-mgmnt-dashboard.md) -- Track the volume, performance and progress of application vulnerabilities from initial analysis and detection to containment or remediation.\n        - [My Application Vulnerabilities dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/app-vuln-mgmnt-secchamp-dashboard.md) -- This dashboard presents important metrics for analyzing your Application Vulnerability Management process, such as viewing remediation target attainment rates.\n        - [Aggregated reports framework for Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/vr-common-content-pack-avr.md) -- Using the aggregated reports framework, you can create reports for the data that involves complex and long-running on-the-fly queries for better performance.Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.\n      - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-references.md) -- Reference topics containing information about tables, roles, and properties installed with the Application Vulnerability Response application.\n        - [Application Vulnerability Response user groups and roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-manage-roles.md) -- Before you can successfully remediate vulnerabilities with Application Vulnerability Response (AVR), you must assign users to user groups.\n          - [Assign users to user groups in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-manage-roles.md) -- Before you can successfully remediate vulnerabilities with Application Vulnerability Response (AVR), you must assign users to user groups.\n        - [Components installed with Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/installed-with-avm.md) -- Several types of components are installed with activation of the Application Vulnerability Response feature, including tables, user roles, and scheduled jobs.\n        - [Application Vulnerable Item (AVI) states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-states.md) -- Application Vulnerability Response offers a state model for the status of your application vulnerable items (AVIs), at any given time. Knowing how each state relates to and affects each other helps you to determine when and how to remediate your AVIs.\n        - [Application Vulnerability Response remediation task rule examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-remediation-task-examples.md) -- A example of a remediation task rule example using the condition builder.\n        - [Scanned application fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-scanned-app-fields.md) -- Applications are stored during import under Administration Discovered Applications in Application Vulnerability Response.\n        - [Application Vulnerable Item fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-vul-items-fields.md) -- Application vulnerable items (AVITs) are automatically created during third-part vulnerability integration imports.\n        - [Penetration testing states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/pen_test_state_avm.md) -- Application owners can request penetration test assessment for their applications, and monitor the progress of the ethical hacking team until the request is resolved.\n        - [Managing state mapping for deferrals and false positives in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-excep-fp-triage-mapping-example.md) -- You can manage how the Source states on application vulnerable items (AVIs) imported by the Veracode Vulnerability Integration and Fortify Vulnerability Integration are mapped in your instance after import.\n        - [Application Vulnerability Response references](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-references.md) -- The following terms are used in Application Vulnerability Response.\n        - [Exception rule example for Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avm-exception-rule-example.md) -- An example rule based on a known vulnerability for an exception rule.\n      - [Product view](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/application-vulnerability-response/avr-product-view.md) -- The Application Vulnerability Response (AVR) product ingests the weaknesses and vulnerabilities detected by your application security testing tools and provides a single pane of glass to understand the security posture of all the applications in your environment.\n    - [Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-landing.md) -- The ServiceNow Container Vulnerability Response application imports container vulnerable items (CVITs) and according to the rules enables you to remediate container vulnerabilities. Vulnerability data is pulled from internal and external sources, such as the National Vulnerability Database (NVD) or third-party integrations.\n      - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/exploring-cvr.md) -- The Container Vulnerability Response application imports container vulnerable items (CVITs). According to the rules, the feature enables you to remediate the container vulnerabilities. Container Vulnerability Response is available through a separate subscription.\n        - [Container Vulnerability Response remediation task and container vulnerable item states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/container-vulnerabillity-states.md) -- With the Container Vulnerability Response application, you can use the state model to see the status of a remediation task, at any given time. Knowing how each state relates to and affects each other helps you to determine when and how to remediate your container vulnerable items (CVITs).\n      - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/configure-cvr.md) -- Before you run Container Vulnerability Response in your ServiceNow AI Platform instance, you must configure it.\n        - [Install](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/install-and-configure-cvr.md) -- Before you run the Vulnerability Response and Configuration Compliance for Containers application in your ServiceNow AI Platform instance, you must get entitlement and download the application from the ServiceNow Store. Install the application on your ServiceNow AI Platform instance, and complete a few installation steps in the Setup Assistant.\n        - [Configuring granularity keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-configuring-findings-key-granularity.md) -- You can configure the keys that generate Container Vulnerability Response findings (container vulnerable items) to help you determine how and when they are created from imported container vulnerability data.\n          - [Configure granularity keys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-configure-key-granularity.md) -- Configure the keys that generate Container Vulnerability Response findings.\n        - [Define Container Vulnerability Response email notifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-define-email-notifications.md) -- Set up email notifications to share useful information about important updates and activities such as approval and rejection of false-positive requests. Creating an email notification involves specifying when to send it, who receives it, and what it contains.\n          - [Create or edit remediation target notifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-create-remediation-notification.md) -- Vulnerability administrators can edit the remediation target notification or add new ones, specifying when to send the notification, who receives the notification, and what content is in the notification.\n        - [Configure Exception Management for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/configure-exception-management-for-container-vulnerability-response.md) -- Limit the duration of an exception requested and add a questionnaire to the exception or false positive request using the Container Vulnerability Response module. By default, an exception is requested using the ServiceNow Container Vulnerability Response module. You can also request an exception using the GRC: Policy and Compliance Management integration.\n          - [Configure approval rules for Exception Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-exception-mgt-approval-rules.md) -- Starting with Vulnerability Response v15.0, use the flow designer to approve exception requests for exception management, exception rules, and false positive management. If you are deploying Vulnerability Response (VR) for the first time, the flow designer is enabled by default.\n        - [Quick start tests for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/quick-start-tests-cvr.md) -- Validate that Container Vulnerability Response still works after you make any configuration change such as apply an upgrade or develop an application. Copy and customize these quick start tests to pass when using your instance-specific data.\n          - [Run the Automated Test Framework (ATF) test suite for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-run-vr-atf-suite.md) -- Run the Automated Test Framework (ATF) test suite after you install or upgrade the Container Vulnerability Response application.\n      - [Integrate with other applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/integrate-cvr.md) -- Extend the capabilities of Container Vulnerability Response by integrating with other applications.\n        - [AWS Security Exposure Management Container Vulnerability Integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/aws-inspector-sechub-cvr-pointer.md) -- Import container vulnerability data with the AWS Integration for Security Exposure Management application.\n        - [Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/pcc-integration.md) -- The Prisma Cloud Compute integration enables you to scan container images to detect vulnerabilities.\n          - [Preparing for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/prisma-prep-checklist.md) -- You can prepare for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute by performing setup tasks.\n          - [Install the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/install-prisma-cloud-compute.md) -- Before you run the integration on your instance, complete the installation and configuration steps so that the Prisma Cloud Compute product properly integrates with Vulnerability Response and Container Vulnerability Response. This application is available as a separate subscription.\n          - [Configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/prisma-install-and-configure.md) -- Install and configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application. Import data from Prisma Cloud Compute. You can use the imported data to prioritize and remediate vulnerabilities for your docker images and hosts.\n        - [Wiz Container Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/wiz-exploring-cvr-vuln-intcf.md) -- Import container vulnerability data with the Wiz Container Vulnerability Integration that is included with the Wiz Vulnerability Response Integration.\n      - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/remediate-cvr.md) -- Monitoring remediation is a process that begins with reviewing status and ends with closing container vulnerable items (CVITs). Container Vulnerability Response offers tools and procedures to make that process more productive and efficient.\n        - [Container Vulnerability Response calculator rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-calculator-rules.md) -- Vulnerability calculators automate the calculation of initial values for the fields on container vulnerable items. The condition for each calculator is evaluated in order, and the first matching calculator is used.\n        - [Exception management in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-exception-management.md) -- When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to an container vulnerable item (CVIT) that cannot be remediated according to the policy.\n          - [Requesting and approving an exception in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-request-approve-exception.md) -- You can request to defer the remediation of a container vulnerable item (CVIT) for a specified period. For example, as a developer, you can request an exception if a patch is not available for a machine. Approvers who have access can approve requests from other users.\n            - [Request an exception for a container vulnerable item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-raise-exception.md) -- Request an exception for a container vulnerable item (CVIT) that can’t be remediated immediately. For example, as a remediation owner, you can request an exception if a patch isn’t available for a machine.\n            - [Request an exception for a container remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/raise-exception-crt.md) -- Request an exception to defer a container remediation task for a specified period if it can’t be resolved immediately.\n            - [Request an exception for container vulnerabilities using GRC: Policy and Compliance Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/integrate-with-grc-cvr.md) -- Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Container Vulnerability Response.\n            - [Define a policy reason mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/define-policy-exception-reason-choices.md) -- Define reason choices to be available to any user who requests an exception.\n            - [Approve an exception request in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/approve-ex-request_cvr.md) -- Approve exception requests for container vulnerable items or remediation tasks that can't be remediated immediately. You must assess these requests for risk and then approve them for deferral until they can be remediated.\n            - [Defer a container vulnerable item in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/defer-vul-item-cvr.md) -- If you determine that the issue associated with a container vulnerable item (CVIT) is of low risk and can be immediately deferred without further analysis, you can use the Defer feature.\n            - [Request an extension for a deferred container vulnerable item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/extend-defer-container-vul-item.md) -- Request an extension for a deferred container vulnerable item before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n          - [Working with an exception rule in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/working-with-exception-rule-cvr.md) -- You can request an exception for container vulnerable items (CVITs) that can't be remediated or deferred immediately. By automating the VI deferral process, you can defer the matching CVITs based on the rule when the system identifies them.\n            - [Create an exception rule in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/create-exception-rule-cvr.md) -- Create a rule to automatically request an exception for a specific condition for a group of container vulnerable items (CVITs), such as a rule with a condition that is based on the vulnerability severity of these CVITs. With this rule, you can defer new and existing CVITs automatically if they match the approved rule condition.\n            - [Approve an exception rule request in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/approve-ex-rule-request-cvr.md) -- Assess exception rule requests from users so that you can approve or reject these requests.\n            - [Activating an exception rule in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/activating-ex-rule-cvr.md) -- A rule is activated on its \"Valid from\" date. After activation, it automates the exception process for container vulnerable items (CVITs).\n            - [Reopen an exception rule in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/reopen-ex-rule-cvr.md) -- Reopen an exception rule that has been rejected, but you want to resubmit. Reopening the rule moves it to the Draft state.\n            - [Update an approved exception rule in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/update-approved-ex-rule-cvr.md) -- Cancel an approved rule to be able to update it. For example, before you can modify any dates or add a condition to an approved rule, you must cancel it so that the remediation task (VUL) is deleted, and the container vulnerable items (CVITs) move to the Open state.\n            - [Delete an exception rule in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/delete-ex-rule-cvr.md) -- Delete an exception rule that is not required anymore. For example, you can delete a rule if you don't want to defer a container vulnerable item (CVIT) during ingestion.\n            - [Request an extension for a deferred remediation task in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/extend-defer-container-vuln-group.md) -- Request an extension for a deferred remediation task (VUL) before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n            - [Request an extension for an exception rule in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/extend-ex-rule-request-cvr.md) -- Request an extension for a deferred exception rule before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n          - [Marking and approving a false positive container vulnerability item](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/request-approve-fp-cvr.md) -- Container Vulnerable items (CVITs) and remediation tasks (VULs) can be marked as false positives. Approvers with write access can approve such requests from other users.\n            - [Mark as a false positive in Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/raise-fp-request-cvr.md) -- Mark a container vulnerable item (CVIT) or remediation task as a false positive if the warning given by the scanner is not actually an issue. For example, if a CVIT has been decommissioned but the scanner is still raising an issue related to it, mark it as a false positive.\n            - [Approve a false positive](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/approve-fp-request-cvr.md) -- As a false positive approver, you can approve false positive requests from other users.\n        - [Create, edit, and delete Container Vulnerability Response remediation task rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-create-remediation-task-rules.md) -- You can create rules to automatically group container vulnerable items (CVIT) into remediation tasks (CVUL) based on filter conditions. These rules automatically group CVITs as they're imported or manually created.\n        - [Create auto-close rules for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-create-auto-close-rules.md) -- Use auto-close rules to close older container vulnerable items (CVITs) automatically based on the filter conditions that you set.\n        - [Removing assignments from container vulnerable items and remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/unassigning-cvits.md) -- You can clear the Assigned to and Assignment group fields on container vulnerable items directly from the container vulnerable item and remediation task records that you determine might be incorrectly assigned to you or your groups.\n        - [Close a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-close-remediation-task.md) -- If you determine that the issue associated with an application remediation task can be immediately closed without further analysis, you can use the Close feature. Starting with v2.10 of Container Vulnerability Response, the Close button has been removed for an container remediation task.\n        - [IT Operations Management and pattern discovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/itom-pattern-discovery.md) -- When discovery is enabled, information is received from the Information Technology Operations Management (ITOM) team. If the ITOM Discovery is enabled, you can see Kubernetes Namespaces, Kubernetes Clusters, and Kubernetes Services when you open a container vulnerable item (CVIT). Else, you can see Prisma payload information.\n      - [Analytics and Reporting Solutions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-content-pack.md) -- This Platform Analytics Solution contains prepackaged Platform Analytics content for use with other ServiceNow AI Platform products. Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.This Platform Analytics Solution provides an exposure on how vulnerabilities are managed through the various charts.\n        - [Container Vulnerability Response dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-dashboard.md) -- Analytics and Reporting Solutions contain prepackaged Performance Analytics and Reporting content for use with other ServiceNow AI Platform products. This Platform Analytics Solution permits you to track the volume, performance, and progress of vulnerabilities from initial analysis and detection to containment, or remediation. You can filter reports by assignment group, exploits, risk rating, or state.\n        - [Aggregated reports framework for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/vr-common-content-pack-cvr.md) -- Using the aggregated reports framework, you can create reports for the data that involves complex and long-running on-the-fly queries for better performance.Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.\n      - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-reference.md) -- Reference topics containing information about tables, roles, and properties installed with the Container Vulnerability Response.\n        - [Components installed with Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/installed-with-cvr-data.md) -- Several types of components are installed with activation of the Container Vulnerability Response application, including tables, user roles, and scheduled jobs.\n          - [Roles installed with Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/installed-with-cvr-data.md) -- Several types of components are installed with activation of the Container Vulnerability Response application, including tables, user roles, and scheduled jobs.\n          - [Tables installed with Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/installed-with-cvr-data.md) -- Several types of components are installed with activation of the Container Vulnerability Response application, including tables, user roles, and scheduled jobs.\n          - [Scheduled jobs installed with Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/installed-with-cvr-data.md) -- Several types of components are installed with activation of the Container Vulnerability Response application, including tables, user roles, and scheduled jobs.\n        - [Container Vulnerability Response glossary](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-glossary.md) -- Learn about terms and concepts that are unique to Container Vulnerability Response.\n        - [Container Vulnerable Item form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/container-vul-items-fields.md) -- Container vulnerable items (CVITs) are automatically created during third-part vulnerability integration imports.\n        - [Prisma Cloud Compute Configuration form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/prisma-cloud-compute-configuration-form.md) -- The Prisma Cloud Compute Configuration form is accessed from within the Prisma Cloud Compute Integration module.\n        - [Request Exception form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-request-exception-form.md) -- Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Container Vulnerability Response.\n        - [Exception Rule form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/cvr-exception-rule-form.md) -- Create a rule to automatically request an exception for a specific condition for a group of container vulnerable items (CVITs), such as a rule with a condition that is based on the vulnerability severity of these CVITs. With this rule, you can defer new and existing CVITs automatically if they match the approved rule condition.\n      - [Domain separation and Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/container-vulnerability-response/domain-separation-container-vulnerability-response.md) -- Domain separation is supported in Container Vulnerability Response. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n    - [Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vr-config-compliance-landing.md) -- The ServiceNow Configuration Compliance application is a Secure Configuration Assessment (SCA) application that aggregates scan results from integrations with third-party configuration scanning applications. You can prioritize configuration compliance issues using your Configuration Management Database (CMDB). Configuration Compliance tightly integrates with the IT change management process to remediate your non-compliant configurations.\n      - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl.md) -- Use test results obtained from third-party Secure Configuration Assessment (SCA) integrations to verify compliance with security or corporate policies. Identify, prioritize, and remediate non-compliant configuration items.\n        - [Configuration Compliance imported data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl-policies.md) -- The Configuration Compliance application imports policies, tests, authoritative sources, and test results from third-party integrations and stores them in modules for viewing.\n          - [Configuration Compliance discovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl-discovery.md) -- Configuration Compliance data is imported from third-party SCA scanner applications. They structure groups of software and hardware tests into data records to expedite conducting assessments.\n          - [Configuration Compliance correlation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl-correlation.md) -- Configuration Compliance provides prioritization and test result grouping (into remediation task) to aid remediation of non-compliance issues.\n          - [Discovered Items for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-cj-discovered-items.md) -- Assets are automatically matched to configuration items (CIs) using CI lookup rules, when they are imported using the host and test results integrations. Discovered Items give you visibility into how asset identification is mapped to CIs in the CMDB.\n            - [CI changes for discovered items for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/reapply-discovered-items-ci-changes-cc.md) -- The default value of the property sn_sec_cmn.update_on_ci_change is true. So, when the configuration item (CI) for a discovered item is updated, the test results are updated as well.\n            - [Reconcile unmatched discovered items for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/reapply-reconcile-unmatched-discovered-items-cc.md) -- Create a schedule job to reconcile unmatched discovered items. When a test result is created, the configuration item (CI) added to it at the time of creation might be an outdated one.\n            - [Reapply CI lookup rules on selected discovered items for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/reapply-ci-lookup-rules-di-cc.md) -- Reapply configuration item (CI) lookup rules on selected discovered items from the discovered item list view select actions. The administrator might have to edit or update a lookup rule for multiple reasons. If the lookup rule changes, they can reapply them on the discovered items.\n          - [The Tenable Vulnerability Integration with Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-tenable-integration-overview.md) -- The Tenable.io product of the Tenable Vulnerability Integration imports policies, controls (test results), and configuration tests for processing in the Configuration Compliance application.\n        - [CI lookup rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-ci-identifier-rules.md) -- When data is imported from a third-party integration, Configuration Compliance automatically uses host data to search for matches in the Configuration Management Database (CMDB). It does this using CI Lookup Rules. These rules are used to identify configuration items (CIs) and add them to the test result record to aid in remediation.\n          - [Deduplicating existing configuration items for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/reapply-deduplication-cc.md) -- The Duplicate CI Remediator for deduplication tasks is updated with the sn_sec_cmn_src_ci.cmdb_ci property.\n        - [Creating CIs for Configuration Compliance using the Identification and Reconciliation Engine](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-ci-creation-using-ire.md) -- Starting with Configuration Compliance 11.1, you can create configuration items (CIs) in the Configuration Management Database (CMDB) using the Identification and Reconciliation engine (IRE) API. By using the IRE API to create CIs, you can prevent duplicate CIs from being created and you can reconcile CI attributes by allowing only authoritative data sources to write to CMDB.\n        - [Configuration Compliance assignment rules overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-assignment-rules.md) -- Define the criteria by which test results are automatically assigned to an assignment group for remediation.\n          - [Removing assignments from Configuration Compliance remediation tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-unassigninng-trg.md) -- You can clear the Assigned to and Assignment group fields on remediation tasks and their associated test results directly from the test result records and remediation tasks that you determine might be incorrectly assigned to you or your groups.\n        - [Configuration Compliance remediation tasks and remediation task rules overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-groups.md) -- Automatically create remediation tasks (RTs) to analyze results in bulk using remediation task rules. The criteria by which tasks are formed is configured so that you do not have to manually assign test results into remediation tasks.\n        - [Configuring calculator groups and calculators for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-configuring-cc-calcs.md) -- Configuration Compliance calculators are used to update record values when pre-defined conditions are met. The calculators are grouped based on the criteria used to determine how the records are updated.\n        - [Exception management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-ex-mgmt.md) -- When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions for a remediation task that cannot be remediated according to the policy.\n        - [Configuration Compliance change management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-chng-mngment.md) -- As an IT remediation owner, you can create and manage change requests (CHG) directly from remediation tasks (RTs) in the Configuration Compliance application.\n      - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-configuring.md) -- Before you run the application in your ServiceNow AI Platform instance, you must first download and install the Configuration Compliance application from the ServiceNow Store. This application is available as a separate subscription.\n        - [Install](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/install-and-configure-cc.md) -- Before you run Configuration Compliance in your ServiceNow AI Platform instance, you must first download and install the Configuration Compliance application from the ServiceNow Store. This application is available as a separate subscription.\n        - [Create or edit Configuration Compliance assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/create-cc-assign-rules.md) -- Create rules to automatically assign test results based on filter conditions. These rules assign test results as they are imported.\n        - [Configuration Compliance remediation target rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-remed-target-rules.md) -- With remediation target rules, you can set the expected time frames for remediating test results. You can send notifications to users and groups when target dates are approaching and when they are past due.\n        - [Configuration Compliance calculator groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl-calc-groups.md) -- Configuration Compliance calculators are used to update record values when pre-defined conditions are met. The calculators are grouped based on the criteria used to determine how the records are updated.\n        - [Create a Configuration Compliance calculator group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/create-confi-compl-calc-group.md) -- Configuration Compliance calculator groups are used to group calculators based on how you want to use them.\n          - [Configuration Compliance calculators and calculator rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/config-compliance-calculator-rules.md) -- Configuration Compliance automate calculating initial values for the fields on test results. The condition for each calculator is evaluated in order, and the first matching calculator is used.\n            - [Define fields and weights for the risk rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/define-fields-weights-risk-rule.md) -- Customize the parameters and weights for the risk rule so that you can generate risk scores that use the test and asset data that are unique to your organization. By selecting the fields that are included in the risk rule, you can define an effective risk scoring framework.\n            - [Edit risk rollup calculators for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/v11create-rollup-calc.md) -- Edit an existing risk rollup calculator.\n            - [Create, edit, and reapply risk calculators for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/v11reapplycalc.md) -- Calculator rules can be applied to all affected test results and collections on-demand. Vulnerability managers may use this feature adjust their risk calculator configuration and apply changes on-demand to import findings.\n            - [Examples for Configuration Compliance risk score calculation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/config-compliance-risk-calculator-example.md) -- Starting with v13.0 of Configuration Compliance, you can customize the criteria for the default risk rule. Use risk scores provided by third-party vendors like Qualys and Tenable for risk score calculations.\n              - [Add source criticality as a criterion for a risk rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/config-compliance-risk-calculator-example.md) -- Starting with v13.0 of Configuration Compliance, you can customize the criteria for the default risk rule. Use risk scores provided by third-party vendors like Qualys and Tenable for risk score calculations.\n              - [Add business criticality as a criterion for a risk rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/config-compliance-risk-calculator-example.md) -- Starting with v13.0 of Configuration Compliance, you can customize the criteria for the default risk rule. Use risk scores provided by third-party vendors like Qualys and Tenable for risk score calculations.\n              - [Add conditional criterion to the risk calculator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/config-compliance-risk-calculator-example.md) -- Starting with v13.0 of Configuration Compliance, you can customize the criteria for the default risk rule. Use risk scores provided by third-party vendors like Qualys and Tenable for risk score calculations.\n              - [Risk score calculation example for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/config-compliance-risk-calculator-example.md) -- Starting with v13.0 of Configuration Compliance, you can customize the criteria for the default risk rule. Use risk scores provided by third-party vendors like Qualys and Tenable for risk score calculations.\n              - [Risk rollup calculation example for Configuration Compliance (prior to v15.0)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/config-compliance-risk-calculator-example.md) -- Starting with v13.0 of Configuration Compliance, you can customize the criteria for the default risk rule. Use risk scores provided by third-party vendors like Qualys and Tenable for risk score calculations.\n              - [Risk rollup calculation example for Configuration Compliance (v15.0 and later)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/config-compliance-risk-calculator-example.md) -- Starting with v13.0 of Configuration Compliance, you can customize the criteria for the default risk rule. Use risk scores provided by third-party vendors like Qualys and Tenable for risk score calculations.\n        - [Create or edit Configuration Compliance remediation task rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/create-cc-group-rules.md) -- You can create rules to automatically group test results based on filter conditions. These rules automatically group test results as they are imported. Use the filter to limit the test results grouped by this rule, such as selecting all test results with exploits.\n        - [Specify the duration of an exception requested for a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-ex-mgmt-sys-prop.md) -- Use system properties to limit the duration for which an exception is requested for a remediation task. Remediation of the remediation task is deferred for the specified period.\n        - [Configure Exception Management for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/configure-exception-management-configuration-compliance.md) -- Limit the duration of an exception requested and add a questionnaire to the exception using the Configuration Compliance module. By default, an exception is requested using the ServiceNow Vulnerability Response module. You can also request an exception using the GRC: Policy and Compliance Management integration.\n        - [Add an exception approver for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-ex-request-add-approver.md) -- Add users to the approver groups so that you can request an exception for a remediation task in Configuration Compliance.\n        - [Create a Configuration Compliance criticality map](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/create-criticality-map.md) -- Configuration Compliance criticality mapping provides a transform map for third-party source criticality fields to recognizable fields in Configuration Compliance severity.\n        - [Create email notifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-create-email-notification.md) -- Vulnerability administrators can edit the notification or add new ones, specifying when to send the notification, who receives the notification, and what content is in the notification.\n        - [Configure approval rules for Exception Management in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-exception-mgt-approval-rules.md) -- Use the flow designer to approve exception requests for exception management, and exception rules. If you are deploying Configuration Compliance for the first time, the flow designer is enabled by default.\n          - [Create configurations for an approval rule in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-exception-mgt-approval-config.md) -- Define the conditions to filter out matching remediation tasks for an approval level.\n          - [Create approval levels for Exception Management in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-exception-mgt-config-approval-rule.md) -- Define the levels of users and user groups that are going to approve the exception requests.\n          - [Exception management workflow versus flow designer in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-ex-mgt-flow-designer-vs-workflow.md) -- Starting with Configuration Compliance (CC) v13.0, if you are deploying CC for the first time, the flow designer for approving exception requests in exception management is enabled by default. If you are an existing CC user, the default option is workflow.\n      - [Integrate with other applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl-integrations.md) -- Third-party integrations import configuration assessment findings, policies, tests, technologies, authoritative sources, test results along with other vulnerability data into the Configuration Compliance application.\n        - [AWS Security Exposure Management Test results integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/aws-inspector-sechub-cc-pointer.md) -- Import information about misconfigurations for various types of your assets from AWS Security Hub with the AWS Integration for Security Exposure Management application.\n        - [Understanding the Vulnerability Response Integration with Palo Alto Prisma Cloud](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/prisma-cloud-overview.md) -- Prisma Cloud is an API-based cloud infrastructure security solution. It connects to your cloud environment and monitors the resources deployed on the public cloud environments, such as Amazon Web Services (AWS), Microsoft Azure, and so on. You get complete visibility and control over risks within your public cloud infrastructure.\n          - [Preparing for installing the Vulnerability Response Integration with Palo Alto Prisma Cloud](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/preparing-prisma-cloud.md) -- Prepare for installing the Vulnerability Response Integration with Palo Alto Prisma Cloud by performing setup tasks.\n          - [Install and configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/install-and-configure-prisma-cloud.md) -- Install the Vulnerability Response Integration with Palo Alto Prisma Cloud application to use the imported data from Prisma Cloud. Use this data to prioritize and remediate misconfigurations on your assets.\n          - [Configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/configure-vulnerability-response-prisma-cloud.md) -- Configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application. Use the imported data from Prisma Cloud to prioritize and remediate misconfigurations on your assets.\n          - [Verify the Vulnerability Response Integration with Palo Alto Prisma Cloud import run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/verify-integration-run.md) -- Use the Vulnerability Response Integration with Palo Alto Prisma Cloud import run status to verify the success of your integration runs and to identify any issues.\n          - [Data mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-prisma-import-data.md) -- The data from Prisma Cloud is imported in the Configuration Compliance module of the ServiceNow instance.\n          - [Prisma Cloud REST Messages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/prisma-cloud-rest-messages.md) -- Prisma REST messages are used to make calls to the Prisma Application Programming Interface (API) to fetch the compliance data.\n        - [Qualys](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/Qualys-cc-Integration.md) -- The Qualys Policy Compliance collects the data and automatically sends it to the Qualys application, which continuously analyzes and correlates the information. It easily integrates as the Qualys Integration for Security Operations to map configuration findings to CIs and business services to determine the impact and priority of potential misconfigurations.\n          - [Configure PCRS](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-config-qualys.md) -- Starting with v12.6.3 of Qualys Integration for Security Operations, you can use the Qualys PCRS Policy Host Integration and Qualys PCRS Test Results Integration for importing test results with new sets of Qualys APIs. These integrations need a gateway URL to fetch information from Qualys.\n            - [Components installed with the Qualys Integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-qualys-installed-with.md) -- The following roles, scheduled jobs, and tables are installed with the Qualys Integration for Security Operations.\n          - [Update configuration items with the network partition identifier for the Qualys Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/qualys-updateci-npi-cc.md) -- Create unique configuration items (CIs) for assets in your environment that share IP addresses. Identify the distinct assets across your environment and automatically update the CIs on your existing discovered item, vulnerable item, and detection records to give you more details about your vulnerabilities.\n          - [Set Import Filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-qualys-add-filters.md) -- Customize the filtering parameters for your scheduled queries with the Qualys Vulnerability Integration to help you further refine the vulnerability data you import with the supported Qualys integrations.\n          - [Configure Qualys Test Result Granularity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-qualys-tr-granularity.md) -- Configure the Qualys test result granularity to ensure the system imports results at a more detailed level based on your selected configuration keys. In addition to the default keys, you can configure additional keys based on your requirements to increase granularity. Granular imports allow teams to manage their respective assets independently and prevent data from being overwritten when multiple records share common identifiers.\n          - [Resolving Qualys Vulnerability Integration issues](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-qualys-troubleshooting.md) -- Some commonly encountered issues, along with workarounds are discussed.\n            - [Attachments not appearing after import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-attachments-not-appearing.md) -- If attachments are not appearing as expected for data sources or on a security incident after third-party integration imports, check your IP restrictions.\n            - [Modify transform maps](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-t-ChangeTransformMaps.md) -- Transform maps are provided with base configurations and are sufficient usually. You can modify transform mappings depending on the needs of your organization.\n            - [Check XML attachment property size](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-check-xml-prop-size.md) -- Verifies that the XML attachment property is sufficient for large files.\n            - [Data retrieval limitations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-limit-data-retrieved.md) -- By default, there are no restrictions on how data is retrieved from Qualys. Many records can be related to low severity vulnerabilities that a customer is not willing to remediate using their vulnerability response process. Updating the corresponding REST message/method parameters can modify this behavior.\n            - [Qualys Knowledge Base Integration is failing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-qualys-kb-integration-failure.md) -- Resolve Qualys Knowledge Base Integration failure by reducing the payload attachment size received from Qualys to the specified limit.\n          - [Qualys integration run status chart](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-qualys-integr-run-status.md) -- The Qualys Integration Run Status module is a graphical view of the status of Qualys integration runs.\n          - [REST messages](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/qualys-rest-messages-cc.md) -- Qualys REST messages are used to make calls to the Qualys API to fetch the compliance data.\n        - [Understanding the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenableIntegration.md) -- The Vulnerability Response Integration with Tenable application developed by ServiceNow engineering for the Tenable Vulnerability Integration uses data imported from the Tenable.io, Tenable.sc, and Tenable.cs products. This data helps you prioritize and remediate vulnerabilities for your assets. The application is available with a separate subscription from the ServiceNow Store.\n          - [Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-io-integrations-list.md) -- The Tenable.io integrations in the Vulnerability Response Integration with Tenable with Tenable application are available for use with both the Vulnerability Response and Configuration Compliance applications.\n          - [Tenable.sc integrations with the Vulnerability Response application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-sc-integrations-list.md) -- The Tenable.sc integrations in the Vulnerability Response Integration with Tenable application.\n          - [Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-cs-integrations-list.md) -- The Tenable.cs integrations in the Vulnerability Response Integration with Tenable application are available in the Vulnerability Response and Container Vulnerability Response applications.\n          - [Preparing for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-setup-checklist.md) -- Prepare for the ServiceNow Tenable Vulnerability integration by performing the following setup tasks.\n          - [Install the Vulnerability Response Integration with Tenable application using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenableInstall.md) -- Before you run the ServiceNow Tenable Vulnerability Integration, you need to download the Vulnerability Response Integration with Tenable application from the ServiceNow Store and install and configure it using the Setup Assistant in the Vulnerability Response application.\n          - [Data retrieval settings for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-data-rerieve.md) -- The following data retrieval settings help you determine specifically the type and scope of data you want to import from the ServiceNow Tenable Vulnerability Integration to your ServiceNow AI Platform instance.\n          - [REST messages for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-rest-msgs.md) -- The ServiceNow Tenable Vulnerability Integration REST messages are used to make calls to the Tenable API.\n            - [Data transformation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-data-transformref.md) -- After you identify the data to import, it’s retrieved from the Tenable product and processed through a set of data sources and transforms in your instance.\n          - [Set import filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-add-filters.md) -- Customize the filtering parameters for your scheduled queries with the Tenable Vulnerability Integration to help you further refine the vulnerability data you import with the Tenable.io product.\n          - [Tenable Vulnerability Integration reporting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-integration-reporting.md) -- View reports about vulnerabilities and vulnerable items on the Vulnerability Response dashboards.\n            - [Integration run status chart for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-integration-run.md) -- The Tenable Integration Run Status module provides you with a graphical view of the status of Tenable integration runs.\n          - [Initiate rescan for the Tenable.sc integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-tenable-rescan.md) -- Verify your vulnerable items have been remediated between scheduled scanning cycles by initiating rescans in the Tenable platform. You can initiate a rescan on-demand for vulnerable items for the Tenable.sc product from your ServiceNow AI Platform instance.\n          - [Initiate rescan for the Tenable.io integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/vr-tenable-rescan-tenable-io.md) -- Verify that your vulnerable items have been remediated between scheduled scanning cycles by initiating rescans in the Tenable platform. You can initiate a rescan on-demand for vulnerable items for the Tenable.io product from your ServiceNow AI Platform instance.\n          - [Update configuration items with the network partition identifier for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-updateCI-NPI.md) -- Create unique configuration items (CIs) for assets in your environment that share IP addresses. Identify the distinct assets across your environment and automatically update the CIs on your existing discovered item, vulnerable item, and detection records to give you more details about your vulnerabilities.\n          - [Import modifications for the Tenable Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-optional-vul-modify.md) -- Configure optional modifications and streamline some of the data specifically for the Tenable Vulnerabilities import integration in the ServiceNow Tenable Vulnerability Integration.\n          - [Split Tenable detections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/tenable-split-detections.md) -- ServiceNow Vulnerability Response enables the splitting of detections from Tenable scanners, enabling for the creation of a unique vulnerable item (VIT) for each detected vulnerability instance. This split enables the assignment of VITs to various remediation teams, enhancing the management and tracking of vulnerabilities.\n          - [Configure Test Result Granularity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cc-tenable-tr-granularity.md) -- Configure the Tenable test result granularity to ensure the system imports results at a more detailed level based on your selected configuration keys. In addition to the default keys, you can configure additional keys based on your requirements to increase granularity. Granular imports allow teams to manage their respective assets independently and prevent data from being overwritten when multiple records share common identifiers.\n          - [Compliance test uniqueness key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cc-tenable-compliance-test-uniqueness-key.md) -- The Tenable compliance test uniqueness key determines how the system identifies incoming compliance test records during ingestion and whether they are treated as new records or updates to existing ones.\n            - [Configure compliance test uniqueness key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response/cc-tenable-config-test-uniqueness-key.md) -- Configure the uniqueness key for Tenable compliance tests to control how the system identifies configuration test records during ingestion and prevent records from being overwritten when multiple tests share the same control identifier.\n        - [Explore Wiz Test Results and Issues](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/exploring-wiz-ctest-results-int.md) -- Import cloud configuration data with the Wiz Test Results and Issues Integrations with Configuration Compliance that are included with the Wiz Vulnerability Response Integration.\n      - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl-remediation.md) -- Configuration Compliance remediation is primarily a manual process augmented by scheduled jobs (integrations), remediation tasks, workflows, and change requests.\n        - [Manually create a Configuration Compliance remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/create-test-result-group-module.md) -- You can manually create a remediation task from the Remediation Tasks module and perform remediation.\n        - [Manually create a Configuration Compliance remediation task from the Test Results list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/create-test-result-group-list.md) -- You can manually create a remediation task from the Test Result list and perform remediation from the resulting remediation task.\n        - [Create a change request in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-CR-v12-create.md) -- You can create a change request from a remediation task in the Configuration Compliance application.\n        - [Associate a remediation task to an existing change request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-CR-v12-assoc.md) -- Associate a remediation task in Configuration Compliance application to an existing change request.\n        - [Split a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-split-CRG.md) -- From an existing remediation task in the Configuration Compliance application, identify a subset of test results that you want to move to a new Remediation Task.\n        - [Remove assignments from remediation tasks for you or your groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-unassign-trg.md) -- Reassign the test result records in the Configuration Compliance application if the records have been incorrectly assigned to you or your group.\n        - [Approve an unassign request in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/approve-an-unassign-request-in-configuration-compliance.md) -- Approve requests for the removal of remediation tasks from an assignment group or an individual user in the Configuration Compliance application.\n        - [Automatic closing of test results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-auto-close-common.md) -- You can automatically close test results (TRs) associated with retired configuration items (CIs).\n          - [Working with retired configuration items in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-working-with-retired-CIs.md) -- Decommissioned configuration items (CIs) are moved to retired, archived, or deleted state in the Configuration Management Database (CMDB). Configuration Compliance contains test results (TRs) that are made up of CIs. When the state of a CI is updated to retired, the associated TRs are closed with the substate 'CI decommissioned'.\n          - [Automatically close test results related to retired CIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-auto-close-vis.md) -- If the Configuration Management Database (CMDB) changes the life cycle stage status of a configuration item (CI) to retired, you can choose to automatically close the associated test results (TRs).\n        - [Automatically closing stale test results in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-autoclose-tr-overview.md) -- You can activate the Auto-Close Stale Test Results feature to automatically close older test results not recently found by your third-party integrations. Moving these test results to Closed-Stale reduces the number of active test results and remediation tasks in your instance and helps you reconcile assets in your Configuration Management Database (CMDB).\n          - [Use Auto-Close Stale Test Results in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-autoclose-tr.md) -- Activate Auto-Close Stale Test Results (TRs) to automatically close older test results based on filter conditions that you set.\n        - [Close a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/close-test-result-group.md) -- If you determine that the issue associated with a remediation task can be immediately closed without further analysis, you can use the Close feature.\n        - [Requesting and approving an exception for a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-ex-mgmt-request-approve.md) -- You can request to defer the remediation of a remediation task for a specified period. Users who are a part of the approver group can approve exception requests.\n          - [Request an exception for a remediation task in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-ex-request-test-result-group.md) -- Request an exception to defer the remediation of a remediation task for a specified period if it can’t be remediated immediately.\n          - [Request an extension for an exception rule in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/extend-cc-ex-rule-request.md) -- Request an extension for a deferred exception rule before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n          - [Request an exception for remediation tasks using GRC: Policy and Compliance Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/integrate-with-grc-cc.md) -- Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Configuration Compliance.\n          - [Approve an exception request in Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-ex-request-approve.md) -- Approve exception requests for remediation tasks that can't be remediated immediately. You must assess these requests for risk and then approve them for deferral until they can be remediated.\n          - [Define policy reason mappings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/define-policy-reason-mappings.md) -- You can define the reason choices to be available to any user who requests an exception.\n      - [Analytics and Reporting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-pa-cc.md) -- The following reports are provided for monitoring.\n        - [Reporting overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl-overview.md) -- The Configuration Compliance homepage provides an executive view into policies, CIs, tests, and test results, helping security staff pinpoint areas of concern quickly. Configuration Compliance significance charts can be added, as needed. You can also return Configuration Compliance -related information using the global search feature.\n        - [Configuration Compliance dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-content-pack.md) -- This Platform Analytics Solution contains prepackaged Performance Analytics and Reporting content for use with other ServiceNow AI Platform products. Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.This Platform Analytics Solution provides visibility into non-compliant host level and cloud control plane configurations.\n          - [Activate Performance Analytics for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/configuration-compliance-install.md) -- Activate the content pack ServiceNow Store application for the Platform Analytics Solution.\n          - [Viewing the Performance Analytics for Configuration Compliance dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/configuration-compliance-dashboard.md) -- You can manage your most important configuration issues and remediate them quickly by viewing the reports on the Configuration Compliance Performance Analytics (PA) dashboard.\n        - [Aggregated reports framework for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vr-common-content-pack-cc.md) -- Using aggregated reports framework, you can create reports for the data that involves complex and long-running on-the-fly queries for better performance.Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.\n      - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-reference-info.md) -- Several types of components are installed with activation of the Configuration Compliance application, including tables, scheduled jobs, and user roles.\n        - [Components installed with Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/installed-with-config-compliance.md) -- Several types of components are installed with activation of the Configuration Compliance plugin, including tables and user roles.\n        - [View Configuration Compliance test groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/view-vuln-config-compl-policies.md) -- Once you have imported the results of a third-party scan into your instance, you can see your test compliance at the test group level. Use this view before an audit of that test group and any associated test records.\n        - [View Configuration Compliance authoritative sources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/view-vuln-config-compl-auth-sources.md) -- Use this module to view summary information about each authoritative source and to research the source publications that were used to create the record.\n        - [View Configuration Compliance technologies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/view-vlun-config-compl-technologies.md) -- Use this module to view summary information about each authoritative sources and citation (also known, in Qualys, as a framework). You can research the source publications that were used to create the record.\n        - [View Configuration Compliance tests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/view-vuln-config-compl-tests.md) -- Use this module to research detailed information about these tests. Included are the expert source citations that were used when creating them, the third-party configuration policies in which they are used, and the results obtained from the scan.\n        - [View Configuration Compliance test results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/view-vuln-config-compl-test-results.md) -- View Configuration Compliance test results for auditing and remediation. The test results are automatically created during third-party vulnerability integration imports.\n        - [View a remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/view-cc-tr-group.md) -- You can view, or, alternatively, create a remediation task and perform remediation.\n        - [Test result and remediation task state transitions in the Configuration Compliance application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-state-transition.md) -- The states of configuration test records and their associated remediation tasks (RTs) are impacted if test result records are deferred, resolved, reopened, and transferred to other remediation efforts (REs).\n        - [State synchronization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cc-cr-state-synch.md) -- There is a synchronized relationship between the State fields of remediation tasks and the State fields of change requests (CHGs) in the Configuration Compliance application.\n        - [Domain separation and Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/domain-separation-config-compliance.md) -- Domain separation is supported in Configuration Compliance. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n        - [Configuration Compliance criticality maps](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl-critmaps.md) -- Configuration Compliance criticality mapping transforms criticality fields from the source to fields in Configuration Compliance.\n        - [States, precedence, examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl-states.md) -- With Configuration Compliance, you can see a state model to learn what the status of the remediation task is at any given time. The remediation task states control the test result states by precedence.\n        - [Resolving Configuration Compliance import issues](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/vuln-config-compl-troubleshooting.md) -- Resolve issues with third-party integration import.\n          - [Modify Qualys PC Results start date](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/modify-test-results-startdate.md) -- If data is missing for the start date in the Qualys PC Results import, it can be modified.\n        - [CI lookup rules for Microsoft Defender for Cloud Integration for Security Operations and Palo Alto Prisma Cloud](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configuration-compliance/cloud-ci-look-up-for-ms-paloalto.md) -- You can use the configuration item (CI) lookup rules for the Microsoft Defender for Cloud Integration and Palo Alto Prisma Cloud integrations to find a correct match to commonly used resource types in the Configuration Management Database (CMDB).\n    - [Vulnerability Response Workspaces](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-wkspace-overview-v16.md) -- Vulnerability Response Workspaces offer a consolidated view of the features that enables you to multi-task from within the same pane by boosting productivity and saving time.\n      - [Vulnerability Response workspaces overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vulnerability-response-workspaces-overview.md) -- The Vulnerability Manager and IT Remediation Workspaces support Vulnerability Response, Application Vulnerability Response, Container Vulnerability Response, and Configuration Compliance.\n      - [Patch orchestration with the Vulnerability Response Workspaces](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-patch-orch-overview.md) -- You can manage patches and patch deployments for critical vulnerabilities for large groups of your assets with Patch orchestration with Vulnerability Response.\n      - [Vulnerability Response Workspaces and updates to remediation tasks and remediation task rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-overview.md) -- Remediation tasks bundle records (VITs, AVITs, CVITs or CTRs) in the Vulnerability Response Workspaces.\n      - [Configure the Vulnerability Response Workspaces](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-configure-ws.md) -- Before you can use the workspaces, confirm you've completed the following setup tasks.\n      - [Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vulnerability-manager-workspace-landing-page.md) -- The Vulnerability Manager Workspace enables vulnerability managers and analysts to monitor the vulnerabilities and misconfigurations that they care the most about and decide strategically which vulnerabilities they send to IT teams to fix.\n        - [Exploring the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/exploring-vuln-mgr-workspace.md) -- As a vulnerability manager and analyst, get a unified view of all the vulnerability types in the Vulnerability Manager Workspace. You can see host, application, and container vulnerabilities and configuration issues, create watch topics across these vulnerabilities and misconfigurations, create remediation efforts and remediation tasks.\n          - [Home page in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-home-page.md) -- The Home page in the Vulnerability Manager Workspace provides a summary of active records by showcasing visualizations of risk rating, remediation progress, assignments to assignment groups, records in remediation tasks, and vulnerabilities from cloud resources.\n          - [Watch Topics page in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-watch-topic.md) -- The Watch Topics page in the Vulnerability Manager Workspace enables you to create and edit a watch topic. A Watch topic is a set of data visualizations which enables you to monitor a filtered set of records (VITs, AVITs, CVITs and CTRs) over time on a dashboard that might be of a particular interest or priority to your organization.\n            - [Related items list and visualizations in a watch topic](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-wtopic-related-items-v18.md) -- On the Watch Topics page of Vulnerability Manager Workspace, you can create watch topics that are categorized into four modules, Host Vulnerabilities, Container Vulnerabilities, Application Vulnerabilities, and Configuration Test Results. The related items tabs in a watch topic differ for each module.\n          - [Remediation efforts in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-remediation-effort.md) -- A Remediation Effort is a set of records that are associated with a watch topic. The records listed on a remediation effort are static. They are not updated by new import data or changes that you make to watch topics.\n            - [Life cycles of remediation efforts, remediation tasks, and records in the Vulnerability Response Workspaces](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-re-lifecycle.md) -- The states of records and their associated remediation tasks (RTs) are impacted if records are deferred, resolved, reopened, and transferred to other remediation efforts (REs).\n          - [Dashboards page in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-dashboards.md) -- On the Dashboards page of the Vulnerability Manager Workspace, you can view the dashboards in the Next Experience UI and use these dashboards to track and analyze the vulnerabilities.\n          - [List page in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-list-page.md) -- The List page in the Vulnerability Manager Workspace permits vulnerability and security managers and analysts to view remediation progress on records, drill down into records, and view the status of their approval requests and exceptions.\n          - [Bulk edit in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-bulk-edit-overview.md) -- In the Vulnerability Manager Workspace, the bulk edit feature enables you to update multiple vulnerable items (VITs, AVITs, or CVITs) or configuration test results (TRs) simultaneously, streamlining the management and remediation process.\n          - [Understanding compensating controls for risk reduction](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/compensating-controls-overview.md) -- Compensating controls are the measures taken to reduce the risk posed by vulnerabilities that can't be patched immediately. They can be used to mitigate the likelihood or impact of a successful exploit.\n          - [Analytics and reporting solutions for the Unified Vulnerability Response Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-unified-dashboard-content-pack.md) -- The Unified Vulnerability Response Dashboard is a centralized aggregated dashboard that provides visibility from multiple vulnerability scanners and security tools to provide a comprehensive view of an organization's vulnerabilities and risks.\n            - [Unified Vulnerability Response Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-unified-dashboard.md) -- The Unified Vulnerability Response dashboard provides a comprehensive view of an organization's vulnerabilities and risks. The vulnerabilities related to infrastructure, cloud, applications, and containers can be viewed in a centralized dashboard for better visibility and remediation.\n        - [Monitoring and managing vulnerable items and test results in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/using-vulnerability-manager-workspace.md) -- The Vulnerability Manager Workspace enables you to monitor vulnerable items (VITs, AVITs, and CVITs) and Test Results (TRs) using watch topics, and track and manage their remediation progress by creating remediation efforts.\n          - [Open search results in Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-change-app-scope-search.md) -- Open search results in Vulnerability Manager Workspace instead of classic UI by changing the application scope.\n          - [Create and apply filters the summary of active records (VITs, AVITs, CVITs and CTRs)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-home-page-create-filter.md) -- As a vulnerability manager and analyst, you can filter the desired records to visualize their summary on the Home page of the Vulnerability Manager Workspace.\n          - [Use watch topics in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-wtopic-ui-options.md) -- Use watch topics in the Vulnerability Manager Workspace to view vulnerabilities and misconfigurations that are filtered from your imported data from the criteria that you set. Use this information to determine how the vulnerabilities and misconfigurations in each watch topic can impact your environment.\n            - [Create a watch topic in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-create-wt.md) -- Vulnerability managers and analysts can create watch topics using a set of conditions to filter out subsets of records (VITs, AVITs, CVITs or CTRs) that they want to monitor.\n            - [Edit or delete a watch topic in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/edit-delete-watch-topic.md) -- You can edit or delete an existing watch topic in the Vulnerability Manager Workspace.\n            - [Deactivate or activate a watch topic](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/activate-deactivate-watch-topic.md) -- You can deactivate or activate a watch topic in the Vulnerability Manager Workspace.\n          - [Use Remediation Effort records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-remed-eff-rcd-duplicate.md) -- When Vulnerability managers and analysts create remediation efforts (REs), remediation Tasks (VUL, AVUL, CVUL, and CRG) are automatically assigned to IT teams for remediation.\n            - [Create a remediation effort in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-create-rev16.md) -- A remediation effort record is a static list of records that you create from a watch topic in the Vulnerability Manager Workspace.\n            - [Create a remediation task on-demand from Remediation Effort in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-create-rt-frm-re.md) -- Create a remediation task on-demand from a remediation effort. If you create a remediation task on-demand, you choose the records you want to add manually.\n            - [Create a recurring remediation effort in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-create-recurringRE-steal-VI.md) -- You can create and schedule recurring remediation efforts that are generated automatically on the dates and times that you set.\n            - [Transfer records to remediation efforts in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-transfer-VI-to-RE.md) -- You can transfer records from existing remediation efforts into new remediation efforts in the Vulnerability Manager Workspace.\n          - [Add a compensating control to the library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/create-compensatory-control.md) -- As a Vulnerability Manager or Analyst, add a list of compensatory controls to the Compensating Controls library in the Vulnerability Manager Workspace, which can be applied for the risk reduction of host vulnerable items and remediation tasks.\n            - [Restrict or enable risk change for a CVE or TPE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/disable-risk-reduction.md) -- As a Vulnerability Manager and Analyst, you can restrict or enable risk change for the host vulnerabilities associated with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Vulnerability Manager Workspace.\n          - [Rescan records and remediation tasks in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-rescan-vi-VMGR.md) -- To verify that your remediation tasks and records have been resolved between scheduled scanning cycles, initiate rescans from your ServiceNow AI Platform on-demand.\n          - [Re-evaluate the remediation properties of the records in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-reevaluate-remediation-parameters.md) -- Evaluate the assignments, remediation target date, remediation tasks, exceptions, and risk score for a set of records (VITs, AVITs, CVITs or TRs) in the Vulnerability Manager Workspace.\n          - [Direct Deferral of Vulnerable Items (VITs) by Exception Rules Without Remediation Task Creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/direct-deferral-of-vits-by-exception-rules-without-remediation-task-creation.md) -- Exception rules are applied directly to the Vulnerable Items (VIT) eliminating the process of creating a remediation task. Auto- Exception Rule column is added to the form view, which populates the current exception rule applied on the Vulnerable Item (VIT)\n          - [Use the List view in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-vmws-list-view-duplicate.md) -- The List view in the Vulnerability Manager Workspace permits vulnerability and security managers and analysts to view remediation progress on records, drill down into Vulnerability Response records, and view the status of their approval requests and exceptions.\n            - [Create a customized list of records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-create-custom-list.md) -- You can create a customized list in the Vulnerability Manager Workspace.\n            - [Create a remediation task manually in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-create-remediation-task.md) -- Starting with v25.0.4 of Vulnerability Response, you can create remediation tasks manually from the host vulnerable items, application vulnerable items, container vulnerable items, and configuration test results lists on the List page of Vulnerability Manager Workspace. You can also create remediation tasks from the drill-down lists that appear when you click on the visualizations on the Home page.\n            - [Enable or disable the import of test results for a Qualys test group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/enable-disable-imports-qualys.md) -- Starting with v23.0 of Vulnerability Response, control the import of the test results for the tests in a Qualys test group by using the Enable/Disable import button, which is available in the test group's record view.\n            - [Modify the severity for a CVE or TPE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-modify-reset-severity.md) -- As a vulnerability manager or analyst, you can modify the severity level of Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Vulnerability Manager Workspace.\n          - [Approve or reject requests in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-approve-requests.md) -- Approve or reject requests that are submitted by remediation owners.\n          - [Set up email notifications in the Vulnerability Response Workspaces](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-email-notifications.md) -- Identify users for automatic email reminders sent to users in the Remediation Owner user group.\n        - [Remediating vulnerable items and test results in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/remediate-vis-trg-vulnerability-manager-workspace.md) -- In the Vulnerability Manager Workspace, you can remediate vulnerable items and test results by into a watch topic by defining a condition and you can track their remediation progress by creating remediation efforts.\n          - [Using bulk edit in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-using-bulk-edit.md) -- In the Vulnerability Manager Workspace, you can update the state of the records, request exceptions and false positives, and assign records to an assignment group multiple vulnerable items (VITs, AVITs, or CVITs) simultaneously using the bulk edit feature.\n            - [Update the state of records in bulk in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-bulk-edit-update-state.md) -- Update the state of multiple records (VITs, AVITs or CVITs) concurrently according to their remediation progress using the bulk edit feature in the Vulnerability Manager Workspace.\n            - [Bulk edit host vulnerable items with patches and solutions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-bulk-edit-patches-solutions.md) -- Recommend a patch or solution for multiple host vulnerable items concurrently using the bulk edit feature in the Vulnerability Manager Workspace.\n            - [Assign records to an assignment group in bulk](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-bulk-edit-assign.md) -- Assign multiple records (VITs, AVITs, CVITs, or TRs) concurrently to an assignment group using the bulk edit feature in the Vulnerability Manager Workspace.\n            - [Remove assignments for host vulnerable items in bulk](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-bulk-edit-unassign.md) -- Remove yourself or your groups from the  Assigned to  and  Assignment group  fields on host vulnerable items (VITs) or remediation tasks (VUL) if you determine that the records aren’t within your scope for remediation, or if you think that records have been incorrectly assigned to you or to your groups.\n            - [Request bulk exception in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-bulk-edit-request-exception.md) -- Request an exception for multiple records (VITs, AVITs, CVITs or TRs) concurrently using the bulk edit feature instead of manually selecting each record.\n            - [Bulk edit for false positive in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-bulk-edit-request-false-positive.md) -- Mark one or more records (VITs, AVITs, CVITs, or TRs) as false positive concurrently using the bulk edit feature from the Vulnerability Manager Workspace instead of manually selecting each item.\n            - [Close records in bulk in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-bulk-edit-close-records.md) -- Close multiple records (VITs, AVITs, or CVITs) concurrently using the bulk edit feature in the Vulnerability Manager Workspace.\n          - [Request exceptions for remediation tasks and records in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-exceptions-split-VMGR-ws.md) -- From the Vulnerability Manager Workspace, vulnerability managers and analysts can request exceptions and false positives for a remediation task (VUL, AVUL, CVUL or CRG) and record (VIT, CVIT, AVIT or CTR). You can also split a remediation task and create change requests.\n          - [Request an extension for a deferred vulnerable item in the Vulnerability Manager workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/extend-defer-vul-item-ws.md) -- Request an extension for a deferred vulnerable item before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.\n        - [Vulnerability Manager Workspace reference information](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-reference-info.md) -- The following topics provide you with links, reference information, in addition to field data on the forms and records found in Vulnerability Manager Workspace.\n          - [Create Watch Topic form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-create-wt-fields.md) -- The following table describes the fields in the Create Watch Topic form in the Vulnerability Manager Workspace.\n          - [GRC request exception form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-grc-request-ex-fields.md) -- The following table shows the field descriptions for the GRC request exception form.\n          - [Generate remediation digest form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vr-ws-gen-remediation-digest-fields.md) -- The following table shows the fields on the Generate remediation digest form.\n          - [Impact of the compensating controls on risk score and expiration date](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/requesting-approving-risk-reduction.md) -- As a Remediation Owner, you can request risk reduction for a host vulnerable item or remediation task. And the Vulnerability Manager or Analyst can approve these risk reduction requests.\n          - [Examples for remediation task creation in the Vulnerability Manager Workspace and IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/create-remediation-task-examples.md) -- When you create remediation tasks manually in the Vulnerability Manager Workspace and IT Remediation Workspace, records are grouped into a remediation task based on the grouping criteria you select.\n          - [Re-evaluating the exceptions for selected records in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-manager-workspace/vmws-exception-rules-scenarios.md) -- In the Vulnerability Manager Workspace, when you evaluate the exception rules for a set of records in the Re-evaluate and update the remediation properties modal, their deferral status and until date of deferral are updated as per the latest exception rules.\n      - [IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/it-remediation-workspace-landing-page.md) -- IT teams can save time resolving IT-related vulnerabilities by easily creating change requests, rescanning vulnerable items, and submitting exception requests from the IT Remediation Workspace.\n        - [Exploring the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-itro-wkspce.md) -- The IT Remediation Workspace is intended for IT remediation owners and IT groups. It is composed of home and list views as well as data visualizations that you can click that let you see the remediation tasks you've been assigned and how many records assigned to you have solutions.\n          - [View a workflow example in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-view-ITRO-workflow.md) -- View an example of an end-to-end workflow in the IT Remediation Workspace. See how IT specialists might use the workspace to monitor critical vulnerable items (VITs, AVITs, and CVITs) and test results (TRs) and remediate the vulnerabilities assigned to them.\n          - [Home page in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/itr-ws-home-page.md) -- The Home page in the IT Remediation Workspace provides a consolidated list of host, application, container and test result remediation tasks that are assigned to you and your assignment groups.\n          - [Dashboards page in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/itr-ws-dashboards.md) -- The Dashboards page in the IT Remediation Workspace provides the Vulnerability Remediation dashboard in the Next Experience UI which can be used to focus on the remediation tasks and vulnerable items.\n          - [List page in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/itr-ws-list-page.md) -- The List view in the IT Remediation Workspace permits remediation owners to view the records (VITs, AVITs, CVITs, and TRs) assigned to them and their assignment groups, and remediate these vulnerabilities and misconfigurations. You can also view the list of preferred solutions that are recommended for remediating the host vulnerable items (VITs). Along with these lists, you can view the list of exception requests and penetration test assessment requests raised by you, penetration test findings associated with your penetration test assessment requests, supported libraries and other supported data.\n        - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/using-it-remediation-workspace.md) -- The IT Remediation Workspace provides a consolidated list of host vulnerabilities, application vulnerabilities, container vulnerabilities, and misconfigurations that are assigned to you and your group. You can use this workspace to remediate, and request exceptions for vulnerabilities and misconfigurations.\n          - [Open search results in IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/itr-ws-change-app-scope-search.md) -- Set the application scope to IT Remediation Workspace to open your search results in the IT Remediation Workspace instead of classic UI by changing the application scope.\n          - [Use the email digest in the Vulnerability Response Workspaces](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-email-digest.md) -- Use email notifications to view your remediation progress and remind you when tasks are nearing, or are past SLA.\n          - [Create a list in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-IT-list-view.md) -- With the List view in the IT Remediation Workspace, you can view remediation tasks and records assigned to you and your groups. You can also track your exception and false positive requests for remediation tasks (VUL, AVUL, CVUL, and CRG), vulnerable items (VIT, AVIT, and CVIT), and test results (TRs) and view solutions.\n          - [Use records in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-use-vi-record.md) -- Use records to help you view your remediation progress and the impact of vulnerable items on your assets.\n          - [Create a remediation task manually in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/itr-ws-create-remediation-task.md) -- Starting with v25.0.4 of Vulnerability Response, you can create remediation tasks manually from the Host vulnerable items, Application Vulnerable items, Container vulnerable items, and Configuration test results lists on the List page of IT Remediation Workspace.\n            - [Use remediation task records in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-remed-task.md) -- Remediation tasks are created and assigned automatically from remediation efforts. IT teams and remediation owners can view remediation tasks in the IT Remediation Workspace.\n          - [Assign a remediation task or record to yourself in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-assign-to-me.md) -- Assign a remediation task (VUL, AVUL, CVUL, or CRG) or record (VIT, AVIT, CVIT, or TR) to yourself from the List page in the IT Remediation Workspace workspace.\n          - [View configuration items with vulnerabilities in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-remed-task-v16.md) -- The following enhancements were added to remediation tasks with version 16.1 of the Vulnerability Response application.\n          - [Create a change request in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-CRs.md) -- From a remediation task (VUL, AVUL, CVUL, or CRG), create a change request. Alternatively, add a remediation task to an existing change request.\n          - [Split a remediation task in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-split-task.md) -- From a remediation task (VUL, AVUL, CVUL, or CRG), identify a subset of records and create a new remediation task for them.\n          - [Request a false positive for a vulnerable item or remediate task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-mark-fp.md) -- Indicate a false positive request for host vulnerable item (VIT), application vulnerable item (AVIT), container vulnerable item (CVIT), or remediation task (VUL, AVUL, CVUL or CRG) in the IT Remediation Workspace. A false positive is a condition where a scanner incorrectly reports that a vulnerability exists in the system due to situations such as an incorrect classification, improper logic, or an algorithm in the scanner.\n            - [Request a false positive for a set of test results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vmws-tr-false-positive.md) -- Raise a false positive request for a set of test results within a remediation task in the IT Remediation Workspace.\n          - [Request an exception in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-request-exception.md) -- Request an exception for the host vulnerable item (VIT), application vulnerable item (AVIT), container vulnerable item (CVIT) and remediation task (VUL, AVUL, CVUL, or CRG) from the IT Remediation Workspace.\n          - [Request an exception using GRC: Policy and Compliance Management in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-request-exception-grc.md) -- Request a policy exception for the host vulnerable item (VIT), application vulnerable item (AVIT), container vulnerable item (CVIT) or remediation task (VUL, AVUL, CVUL, or CRG) from the IT Remediation Workspace.\n          - [Request a risk modification for a vulnerable item or remediation task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/request-risk-reduction.md) -- Request a risk modification for a host vulnerable item or a remediation task in the IT Remediation Workspace.\n          - [Rescan vulnerable items and remediation tasks in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/vr-ws-rescan-vi-rt.md) -- Verify that your vulnerable items have been remediated between scheduled scanning cycles. Initiate rescans from the IT Remediation Workspace in your ServiceNow AI Platform on-demand.\n            - [Rescan Qualys vulnerable items from the Vulnerability Response workspaces](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/ws-qualys-rescan.md) -- Verify that your vulnerable items have been remediated between scheduled scanning cycles. Initiate rescans in the Qualys product on-demand from the IT Remediation Workspace in your ServiceNow AI Platform instance.\n            - [Rescan Rapid7 vulnerable items from the Vulnerability Response workspaces](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/ws-rapid7-rescan.md) -- Verify your vulnerable items have been remediated between scheduled scanning cycles. Initiate rescans in the Rapid7 product on-demand from the IT Remediation Workspace in your ServiceNow AI Platform instance.\n            - [Rescan Tenable.io and Tenable.sc vulnerable items from the Vulnerability Response workspaces](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/ws-tenable-rescan.md) -- Verify your vulnerable items have been remediated between scheduled scanning cycles. Initiate rescans in the Tenable.io and Tenable.sc products on-demand from the IT Remediation Workspace in your ServiceNow AI Platform instance.\n        - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/it-remediation-workspace-reference.md) -- The following topics provide you with links, reference information, in addition to field data on the forms and records found in IT Remediation Workspace.\n          - [Create change request form fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/itr-ws-create-cr-fields.md) -- The following table shows the fields and their description in the Create change request form.\n          - [Request exception form fields for policy exceptions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/itr-ws-request-exception-form-grc.md) -- The following table shows the fields that you must fill on the Request exception form for policy exceptions.\n          - [Request exception form for risk reduction](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/it-remediation-workspace/itr-ws-request-exception-form-rr.md) -- The following table shows the fields that you must fill on the Request exception form.\n      - [Explore the Vulnerability Assessment Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-vuln-analyst-workspace.md) -- The Vulnerability Assessment Workspace is designed for the Vulnerability event manager to perform exposure assessment, and proactively manage critical vulnerability events especially during the critical vulnerability events such as a zero-day event.\n        - [Exploring exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-exposure-assessment.md) -- Exposure assessment uses the Common Platform Enumeration (CPE) framework, which is a part of the Common Vulnerabilities and Exposures (CVEs) system, to evaluate the vulnerability exposure of your assets to vulnerability software. This assessment is performed using a software discovery model.\n          - [Exposure assessment by CVE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-exposure-assessment-cve.md) -- Exposure assessment uses Common Vulnerabilities and Exposures (CVEs) to assess the exposure of your assets using the software discovery model. You can use the exposure assessment by CVE to identify exposure to potential vulnerabilities.\n            - [Add CVEs to assess exposure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-add-cve.md) -- Add Common Vulnerabilities and Exposures (CVEs) to the exposure configuration list of CVEs in Exposure Assessment to assess the impact of a new vulnerability or zero-day vulnerability.\n            - [Create VIs for CVEs for exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-create-vis-for-cves.md) -- Create vulnerable items (VIs) from the Exposure Assessment page. Vulnerability event managers then analyze this list of VIs and recommend solutions and patches that help the IT team to patch these vulnerabilities.\n            - [Activate or deactivate CVEs for exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-activate-deactivate-cves.md) -- For delta processing of a CVE, you can activate it, thus adding it to the active list of CVEs.\n            - [Export impacted CIs for exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-export-cis.md) -- You can track the impacted assets list for a new CVE by exporting the configuration items (CIs) related to an exposure assessment record to an excel sheet. This sheet can be used to share the assets details and owners to create incidents with the known impacted assets for the zero-day vulnerabilities.\n            - [Confidence score calculation example](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-cve-sample.md) -- Example of calculating the confidence for a zero-day vulnerability based on its Common Vulnerabilities and Exposures (CVE) information.\n              - [View vulnerable software details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-view-vul-software.md) -- View the details of the vulnerable software, in this case, Google Chrome. It is matched against the discovery model and the Common Platform Enumeration (CPE). This CPE version impacts all the Google Chrome versions.\n              - [Confidence score reference tables for exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-confidence-score-ref.md) -- Reference values used to calculate the confidence score.\n          - [Exposure assessment by software](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-exposure-assessment-software.md) -- Exposure assessment for zero-day vulnerabilities, when Common Vulnerabilities and Exposures (CVEs) for the asset or configuration item is not available. It uses the software information to assess exposure, using the software discovery model.\n            - [Add software for exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-add-software.md) -- Add a new software to the Exposure Assessment module to assess the impact of a new vulnerability or zero-day vulnerability.\n            - [Create VIs for software for exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-create-vis-for-software.md) -- Create vulnerable items (VIs) from the Exposure Assessment page. Vulnerability event managers then analyze this list of VIs and recommend solutions and patches that help the IT team to patch these vulnerabilities.\n            - [Activate or deactivate software for exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-activate-deactivate-software.md) -- To stop further delta processing of software, you can choose to deactivate it, thus removing it from the active list of software.\n            - [Export impacted CIs for software in the Vulnerability Assessment workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-export-cis-software.md) -- You can track the impacted assets list for new software by exporting the configuration items (CIs) related to an exposure assessment record to an excel sheet. This sheet can be used to share the assets details and owners to create incidents with the known impacted assets for the zero-day vulnerabilities.\n          - [Exposure assessment by publisher software](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-exposure-publisher.md) -- Assess exposure for zero-day vulnerabilities, when Common Vulnerabilities and Exposures (CVEs) for the asset or configuration item is unavailable. It uses the software information to assess exposure, using the software discovery model.\n            - [Add software by a publisher for exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-add-publisher.md) -- Add software by a publisher to the Exposure Assessment module to assess the impact of a new vulnerability or zero-day vulnerability.\n            - [Create VIs for software by a publisher for exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-create-vis-for-publisher.md) -- Create vulnerable items (VIs) from the Exposure Assessment page to analyze the list of VIs and recommend solutions and patches that can help the IT team to patch the vulnerabilities.\n            - [Activate or deactivate software by a publisher for exposure assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-activate-deactivate-publisher.md) -- Activate or deactivate software by a publisher to stop delta processing of the software and remove it from the active list of software.\n            - [Export impacted CIs for software by a publisher in the Vulnerability Assessment workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-export-cis-publisher.md) -- You can track the impacted assets list for new software by exporting the configuration items (CIs) related to an exposure assessment record to an excel sheet. This sheet can be used to share the assets details and owners to create incidents with the known impacted assets for the zero-day vulnerabilities.\n        - [Exploring vulnerability assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-ws-vuln-assessment.md) -- The Vulnerability Assessment Workspace is designed for the Vulnerability Event Manager to create a vulnerability event and to perform vulnerability assessment, especially during the zero-day vulnerability analysis.\n          - [Create a vulnerability assessment record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/create-vuln-assessment.md) -- Create assessment records for vulnerabilities of interest. After you create the assessment, you can initiate initial risk assessment, manually update the record, and calculate the risk score automatically.\n            - [Update the vulnerability assessment auto-flush record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/update-the-vulnerability-assessment-auto-flush-record.md) -- Update the vulnerability assessment auto-flush record.\n          - [Modify the vulnerability assessment record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/modify-vuln-assessment-record.md) -- Update the Vulnerability Assessment record, post it’s creation. Based on the field's values you can calculate the risk score.\n            - [Delete associated CVEs or affected products from the vulnerability assessment record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/modify-vuln-assessment-record.md) -- Update the Vulnerability Assessment record, post it’s creation. Based on the field's values you can calculate the risk score.\n            - [Add related link to the assessment record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/modify-vuln-assessment-record.md) -- Update the Vulnerability Assessment record, post it’s creation. Based on the field's values you can calculate the risk score.\n          - [Perform an assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/perform-initial-assesment.md) -- After you’ve created the vulnerability assessment record and updated the risk attribute fields, run an assessment of the event record.\n            - [Assessment tab](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-va-ws-assessment-tab.md) -- Review the assessment results in the assessment tab. After you perform an assessment of the vulnerability event, the record is correlated against the data from Software Bill of Materials and Software Asset Management and displayed with visualisations.\n            - [Overview tab](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-va-ws-overview-tab.md) -- Overview of the assessment details display in the Overview tab. After you perform the initial assessment the record is correlated against the data from Software Bill of Materials and Software Asset Management and displayed with visualisations.\n            - [Assign a priority and exposure level to the vulnerability assessment record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/assign-priority-exposure-level-vr-va-ws.md) -- Manually assign priority and exposure level to the vulnerability assessment record.\n          - [Add affected CIs to the assessment record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/add-affected-ci-vr-vuln-assess-ws.md) -- Manually add the CIs in your organization that you think should be associated with the vulnerability assessment record but do not display in the affected CIs after initial assessment.\n          - [Create vulnerable items for the affected CI or affected software component](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-va-ws-create-vi.md) -- Create vulnerable items (VIs) or application vulnerable items (AVITs) from the Vulnerability Assessment Workspace. Vulnerability analysts analyze the list of VIs and recommend solutions and patches that help the IT team to patch these vulnerabilities.\n            - [Create VIs for configuration items without vulnerable items associated](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-va-ws-create-vi.md) -- Create vulnerable items (VIs) or application vulnerable items (AVITs) from the Vulnerability Assessment Workspace. Vulnerability analysts analyze the list of VIs and recommend solutions and patches that help the IT team to patch these vulnerabilities.\n            - [Create application vulnerable items (AVITs) for affected products models or components with no associated application vulnerable items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-va-ws-create-vi.md) -- Create vulnerable items (VIs) or application vulnerable items (AVITs) from the Vulnerability Assessment Workspace. Vulnerability analysts analyze the list of VIs and recommend solutions and patches that help the IT team to patch these vulnerabilities.\n          - [Link the vulnerability assessment record to major security incident in Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/link-vuln-assessment-msim-vr-va-ws.md) -- You can link, propose or promote the assessment record to a Major Security Incident provided you have access to the Major Security Incident Management application.\n          - [CVE Exposure Assessment REST API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerability-response-workspaces/vr-va-ws-cve-exposure-assessment-api.md) -- Review the following information before using the CVE Exposure Assessment REST API to trigger a CVE exposure assessment or create a vulnerability assessment record from an external system.\n    - [Software Bill of Materials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/sbom-landing.md) -- View a list of the open source and third-party software components that you’re using in your application development. Get insights into software licenses, version information, and the known vulnerabilities in your components in the Software Bill of Materials (SBOM) files that you upload into your instance.\n      - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-exploring.md) -- Identify the components used in your organization's applications from Software Bill of Materials (SBOM) files you upload into your instance. Understand any risks associated with using open-source software to help you determine your potential exposure, view license compliance, and fix vulnerabilities.\n        - [Exploring supported applications for Software Bill of Materials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-supported-apps.md) -- Third-party vulnerability intelligence and other integrations with the Software Bill of Materials applications can enhance the data of your uploaded files.\n      - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-configuring.md) -- Download and activate the required applications for the Software Bill of Materials (SBOM) application prior to uploading SBOM files.\n        - [Install supported applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-install-apps.md) -- Download and activate the required applications for the Software Bill of Materials (SBOM) application prior to uploading files.\n        - [Configure Deps.dev, OSV.dev, and PaCE integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-config-osv-deps.md) -- You can edit some of the parameters for the Deps.dev and OSV.dev integrations. There are also two code trigger versions of these integrations that are used strictly for internal workflows, and you should not initiate these integrations on-demand. Additionally, you can activate a scheduled job to create policies using Policy as Code Engine (PaCE).\n      - [Uploading and viewing your SBOM files in the SBOM Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-using-parent.md) -- The SBOM applications enable you to upload files and view details for entities, component inventories, license information and other details in the Software Bill of Materials Workspace.\n        - [Uploading Software Bill of Materials files using a REST API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-preparing-upload.md) -- Review the following information prior to uploading Software Bill of Materials files using an API.\n        - [Upload Software Bill of Materials files manually](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-ingest.md) -- Upload Software Bill of Materials (SBOM) files manually.\n        - [Uploading Software Bill of Materials for DevOps SBOM files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-uploading-devops.md) -- Generate and upload Software Bill of Materials SBOM files for software throughout its continuous integration and continuous deployment development cycles.\n        - [Removing older SBOM records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/sbom-cleanup.md) -- SBOM cleanup removes older software bill of materials records that match conditions you define and can help you reduce your data volume in the SBOM Workspace.\n          - [Configure and run a one-time SBOM cleanup job](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-run-cleanup.md) -- Create and run a one-time cleanup rule to permanently purge older SBOM records that match the conditions you specify.\n        - [Classifying licenses and resolving component licenses in the Software Bill of Materials workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-license-overview.md) -- Classify licenses and resolve (match) them to components, or create licenses in the License administration module in the SBOM workspace. Classifying and matching licenses to your components permits you determine your license compliance for the proprietary, open-source, and vendor-supplied software components you upload in your SBOM files.\n          - [Classify imported licenses in the Software Bill of Materials Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-classify-license.md) -- Classify the component licenses you upload with your SBOM files with the License Classification feature.\n          - [Resolve licenses to components in the Software Bill of Materials Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-assign-license.md) -- Resolve (assign) classified licenses to specific components with the Component License Resolution feature. Assign licenses to components with missing information or incorrect license information or create new licenses so your overall license compliance can be calculated.\n        - [Viewing reports and dashboards in the Software Bill of Materials workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-viewing-data-overview.md) -- Vulnerability analysts view uploaded software bill of materials files in records, data visualizations, as well as enhanced vulnerability intelligence in the Software Bill of Materials (SBOM) Workspace.\n          - [Review the Home page in the Software Bill of Materials Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-home.md) -- Uploaded data is rolled up to the visualizations on the landing (Home) page in the Software Bill of Materials (SBOM) Workspace. Data is modified after you upload files so vulnerability analysts can see trends and review current information about your components.\n          - [Reviewing the Components module in the Software Bill of Materials Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-components-module.md) -- The Components module in the Software Bill of Materials (SBOM) Workspace displays current information about vulnerable, stale, abandoned, and high-risk combinations for the components you import.\n          - [Creating rules for application vulnerable items in the Software Bill of Materials Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-config-sbom-response.md) -- Before you can see application vulnerable items (AVITs) in the Software Bill of Materials (SBOM) Workspace, you must set up the conditions under which AVITs are created.\n          - [View upload status for Software Bill of Materials files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-bom-queue.md) -- Check the upload status for the Software Bill of Materials (SBOM) files that you upload in the BOM Queue module in the Software Bill of Materials (SBOM) Workspace. Track the files that you upload successfully, your upload history, and errors.\n          - [Checking a Software Bill of Materials entity for vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-check-vulnerability-use-case.md) -- Determine whether any vulnerabilities are associated with the components in an uploaded Software Bill of Materials (SBOM) file.\n      - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/sbom-installed-with-app.md) -- Several types of components are installed with activation of the Software Bill of Materials applications, including tables, user roles, and scheduled jobs.\n        - [Create an application vulnerable item rule in the Software Bill of Materials Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sbom-core/vr-sbom-create-avi-rule.md) -- Set up the conditions under which application vulnerable items (AVITs) are created automatically in the AVI Creation Rules module in the Software Bill of Materials (SBOM) Workspace.\n  - [Enterprise security case management applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sir-apps-landing-page.md) -- Enterprise security case management applications include Security Incident Response, a security orchestration and automation response (SOAR) solution that helps you rapidly respond to evolving threats while optimizing and orchestrating enterprise security operations. It eliminates the errors and friction inherent in manual hand-offs across systems, teams, and responsibilities.\n    - [Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-landing-page.md) -- The ServiceNow Security Incident Response application tracks the progress of security incidents from discovery and initial analysis, through containment, eradication, and recovery, and into the final post incident review, knowledge base article creation, and closure.\n      - [Understanding Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/what-is-sir.md) -- With Security Incident Response (SIR), manage the life cycle of your security incidents from initial analysis to containment, eradication, and recovery. Security Incident Response enables you to get a comprehensive understanding of incident response procedures performed by your analysts, and understand trends and bottlenecks in those procedures with analytic-driven dashboards and reporting.\n        - [Domain separation and Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/domain-separation-security-incident-response.md) -- Domain separation is supported in Security Incident Response. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n      - [Security Incident Response setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-sir.md) -- Setup for Security Incident Response involves some mandatory steps and several optional steps, depending on your specific requirements. After you have downloaded Security Incident Response from the ServiceNow Store and installed it, you are ready to run the Setup Assistant to perform basic configuration for Security Incident Response and third-party integrations.\n        - [Install and configure Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-configure-sir.md) -- Before you run Security Incident Response in your instance, you must download it from the ServiceNow Store and complete configuration steps.\n          - [Download and install the Security Analyst Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-configure-new-ui.md) -- Before you run the Security Incident Response new UI in your instance, you must download it from the ServiceNow Store and install it.\n          - [Components installed with Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/installed-with-sir.md) -- Several types of components are installed when you download and activate the Security Incident Response application, including plugin dependencies, user roles, tables, properties, and scheduled jobs.\n          - [Other additional Security Incident Response setup tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_ConfigureSIM.md) -- If you are an administrator in the global domain, you configure how Security Incident Response handles day-to-day operations.\n            - [Lock down security administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_ConfigureSIM.md) -- If you are an administrator in the global domain, you configure how Security Incident Response handles day-to-day operations.\n            - [Manage Restricted Caller Access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_ConfigureSIM.md) -- If you are an administrator in the global domain, you configure how Security Incident Response handles day-to-day operations.\n            - [Run quick start tests for Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_ConfigureSIM.md) -- If you are an administrator in the global domain, you configure how Security Incident Response handles day-to-day operations.\n          - [Setup Assistant reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n            - [Create a Security Incident Response process definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n              - [Understanding Security Incident Response process definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n                - [Security Incident Response Process Selection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n                  - [Select a Security Incident Response process definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n                - [Create a custom Security Incident Response process definition script include](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n                  - [Process Definition script include](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n                - [Correct security incident or task state](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n            - [Create a security incident group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n            - [Create a security incident calculator group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n              - [Create a security incident calculator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n              - [Understanding security incident calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n                - [Security incident risk score calculations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n                  - [Maintain risk score weights](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n            - [Create a Security Incident Response SLA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n              - [Repair security incident SLAs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n            - [Create a Security Incident Response runbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n            - [Create rules to validate user-reported phishing attacks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-assistant-reference.md) -- The Setup Assistant walks you through the steps you need to perform to set up the Security Incident Response base system. This section provides additional information on the complicated steps for which you may require more explanation.\n          - [Configure the Security Analyst Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-new-ui-configure.md) -- Configure the user interface of the Incident record in the Security Analyst Workspace to specify the fields you want to display.\n            - [Set up primary and secondary filters for Security Analyst Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/set-up-filters-for-new-ui.md) -- The Security Analyst Workspace base system includes a set of primary filters for narrowing down the list of security incidents for analysis (for security incidents assigned to you, all open incidents, and so forth) and a set of quick (or secondary) filters for narrowing down the list even further (by new incidents, open incidents, only critical incidents, and so forth).\n            - [Security Analyst Workspace properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-workspace-properties.md) -- These system properties are used to configure the Security Analyst Workspace.\n            - [Additional Security Analyst Workspace configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-new-ui-setup.md) -- Configure the Security Analyst Workspace and define filters, UI actions, and related lists.\n              - [Landing page filter configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-new-ui-setup-landpage.md) -- You can add new filters or modify existing filters that appear in the Security Analyst Workspace.\n              - [Enable UI Actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-new-ui-setup-enable-uiaction.md) -- Before you configure any UI Actions, you must perform certain steps to enable them so that they are available for configuration in the Security Analyst Workspace.\n              - [Form UI actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-new-ui-setup-form-uiaction.md) -- You can configure the UI actions that are displayed in the Security Analyst Workspace.\n              - [Related List configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-new-ui-setup-uiaction.md) -- You can add new related lists or new related list groups, and modify existing groups or related lists that appear in the Security Analyst Workspace.\n                - [Related List UI Actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-new-ui-setup-relatedlist-uiaction.md) -- You can add new UI actions to the related lists that appear in the Security Analyst Workspace.\n              - [Form configuration system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-new-ui-setup-properties.md) -- These system properties define the form refresh intervals for the playbook tasks.\n              - [Enable playbooks for analyst selection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-new-ui-add-playbook.md) -- Add new playbooks to the playbook selection list.\n          - [Troubleshooting Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/troubleshooting-sir.md) -- This section covers important troubleshooting tips and frequently asked questions related to Security Incident Response.\n        - [Security Incident Response Platform Analytics Solutions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-content-pack.md) -- Platform Analytics Solutions contain preconfigured dashboards. The dashboards present important metrics for analyzing your Security Incident Response process, such as new security incidents or the average age of open security incidents.\n          - [CISO dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ciso-dashboard.md) -- This dashboard reveals the overall security posture of your organization, including security vulnerability and incidents.\n          - [Security Incident Management Premium dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-mgmt-premium-dashboard.md) -- This dashboard uses advanced Platform Analytics visualizations to aid security managers to track the volume, performance and progress of security incidents from initial analysis/detection to containment, eradication, and recovery. The licensed version of Performance Analytics is therefore required.\n          - [Security Incident Management dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-mgmt-dashboard.md) -- With this dashboard, security managers can easily track the volume, performance and progress of security incidents from initial analysis/detection to containment, eradication, and recovery.\n          - [Security Incident Explorer dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-explorer-dashboard.md) -- With this dashboard, security managers are able to view security incidents summarized and grouped by category, subcategory, location, priority and business impact. These views let managers quickly gain insight into the frequency in which attacks are occurring and which business services are affected.\n          - [Security Operations Efficiency dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-socpa-dashboard.md) -- Security operations center (SOC) managers can view overall efficiency metrics and measure the individual performance of the SOC team members in the organization.\n      - [Security Incident Response Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-workspace-landing-page.md) -- The ServiceNow Security Incident Response Workspace is a reimagined interface that provides a next-gen user experience for the security analysts and SOC managers. The security analysts can use this to manage the life cycle of security incidents from an initial analysis to containment, eradication, and recovery.\n        - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/exploring-security-incident-response-workspace.md) -- Explore Security Incident Response Workspace to understand how the security analysts and managers perform their day-to-day operations with an improved user experience, do a complete incident investigation, and get an overview of the security incidents, response tasks and SLAs assigned to the security analyst and team.\n          - [SIR Workspace plugins](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/components-installed-with-analyst-workspace.md) -- The following are the required applications to work with Security Incident Response Workspace (sn_si_aw) plugin.\n          - [SIR Workspace features](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/key-features.md) -- The Security Incident Response Workspace consists of the following key features.\n          - [SIR Workspace interface overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/overview.md) -- The SIR Workspace Overview page consists of the Security Incidents and Response Tasks details that are under security analysts and their team.\n          - [Upcoming section](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/upcoming-section.md) -- This section displays the upcoming tasks such as the security incidents and response tasks that are due as on the same day and next day.\n            - [View upcoming tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/analyst-workspace-upcoming-events.md) -- The Security Analyst can view the upcoming tasks related to the Security Incidents and Response Tasks that are due, overdue or breached the defined SLA.\n          - [Quick links section](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/quick-links.md) -- Quick links work like bookmark links. You can add external URLs and quickly access them from within the workspace.\n            - [Working with quick links](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/quick_links.md) -- Add quick links for easy reference.\n          - [Shift Handover Records section](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/shift-handover-records-section.md) -- The section displays the list of Shift Handover records in the Security Incident Response Workspace.\n          - [List view in SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setting-up-list-view-in-analyst-workspace.md) -- The list view consists of the security incidents, response tasks, phishing emails, and assessments.\n            - [Personalize a list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/personalize-a-list.md) -- Security analysts or managers can personalize the security incidents or response tasks or phishing emails custom list view based on their individual preferences.\n            - [Apply quick filters on Security Incidents and Response Tasks lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/use-quick-filters-for-security-incidents.md) -- Apply the predefined quick filters on Security Incidents and Response Tasks lists to get the desired work items.\n            - [Assign Security Incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/assign-security-incident.md) -- Assign security incidents.\n            - [Close multiple security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/close-multiple-incidents-sir.md) -- Close multiple security incidents at the same time to avoid having to close related incidents individually, such as incidents created with a common root cause or false positive incidents.\n            - [Assign Response Tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/assign_response_tasks.md) -- Assign Response tasks for a security issue.\n            - [Report Phish Email](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/report-phish-email.md) -- Report phishing emails from the lists view.\n            - [Working with quick filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-quick-filters.md) -- Quick filters are easily accessible filters that are available on, security incidents and response tasks lists.\n              - [Add or modify quick filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add_quick_filters.md) -- Add or modify quick filters for security incidents or response tasks within the list view.\n            - [Export Security Incidents or Response Tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/export-security-incidents-or-response-tasks.md) -- Export the security incidents or response tasks from the list view.\n            - [Manage Shift Handover records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manage-shift-handover-records.md) -- Use the Shift Handover records list view to create, edit, copy, or delete Shift Handover records. Each Shift Handover record is associated with a Shift Handover Report Template.\n        - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-security-incident-response-workspace.md) -- This section describes the configurations needed to work with the Security Incident Response Workspace.\n          - [Configure ServiceNow Otto for Security Incident Response (SIR)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-now-assist-for-security-operations.md) -- The ServiceNow Otto for Security Incident Response (SIR) application is supported in the Security Incident Response Workspace and in the legacy Core UI (UI16). Use the guided setup in the AI Admin Hub console to configure ServiceNow Otto for Security Incident Response (SIR).\n            - [Configure a skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-skills-for-now-assist-security-incident.md) -- Configure and review the details for a skill in the Guided Setup. You can edit and reactivate a skill from the Guided Setup.\n              - [Configure the Security incident quality assessment skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/config-quality-assessment-skill.md) -- Add natural language rule sets to the Security incident quality assessment skill. Security analysts use these rules to generate a quality assessment report for security incidents.\n              - [Configure the Security incident resolution plan skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/config-resolution-plan-skill.md) -- Add your existing runbooks to the resolution plan generation skill. The runbooks provide additional context to the resolution plan generation skill.\n            - [Customize a skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cust-now-assist-security-incident-skill.md) -- Customize some of the input fields of a generative AI skill to suit the requirements of your environment.\n            - [Inputs and triggers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/input-triggers-now-assist-security-incident.md) -- You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.\n          - [Set up view of SIR Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/set-up-view-of-sir-records.md) -- This section describes how the related lists are grouped and presented on the SIR Related Records tab for easy navigation.\n          - [Configure SI design time investigation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-investigation-canvas-records.md) -- Use this section to configure security incident design time investigation page to add multiple entry points and its associated records within the Security Incident Response Workspace.\n            - [Creating View for associated info tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/creating-view-for-associated-info-tables.md) -- The investigation screen leverages the related list views created on security incident to configure associated lists.\n            - [Adding an entry point list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-an-entry-point-list.md) -- Configure the new entry point list to add it to the investigation page.\n            - [Mapping View of the Associate Info to the entry point list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/map-view-to-the-entry-point-list.md) -- Map the associated info view to the newly added entry point list using the Map Associated Info View action.\n            - [Configure each associated list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-associated-list.md) -- Configure each associated list from the view to handle run time data rendering.\n          - [SIR Workspace Related Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-records.md) -- This section consists of the related lists items that are grouped into sections such as associated observables and configuration items.\n            - [Configure Security Incident Related List](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-records.md) -- This section consists of the related lists items that are grouped into sections such as associated observables and configuration items.\n            - [Configure Response Task Related List](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-records.md) -- This section consists of the related lists items that are grouped into sections such as associated observables and configuration items.\n          - [Define the new Risk Score Calculator Rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/define-risk-score-calculator-rules-sir.md) -- Use the new Risk Score Calculator to define and calculate the risk score of security incidents based on the user-defined criteria, which provide a transparent intelligence scoring of security incidents. The risk score is auto-calculated for the security incident records.\n            - [Risk Score Calculator for Additional Related Tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/risk-score-calculator-related-tables.md) -- The Risk Score Calculator is provisioned with one risk-scoring rule as part of the base system to calculate the risk score of security incidents based on user-defined criteria. However, you can customize and include additional related tables to calculate the risk score.\n          - [Configure Shift Handover](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/config-shift-handover.md) -- Configure Shift Handover settings to provide complete shift information to the next shift analysts.\n            - [Configure Shift Handover Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-shift-handover-templates.md) -- The Admin can define and configure different Shift Handover templates for the Shift Owner to create shift handover records and hand them over to the next shift team.\n            - [Create shifts through Security Incident Response Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-shift-times.md) -- Create shifts through the Security Incident Response Workspace to use when configuring shift handover records.\n          - [Security Incident Response conference call integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-conf-call-capability.md) -- The Security Incident Response Conference Call integration enables you to manage and initiate conference call and chat for analysts, managers and affected users.\n            - [Manage Conference Call users and groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/config-conference-call.md) -- The Admin can configure conference call settings to display a predefined list of users and groups to add to a call.\n            - [Integrate SIR with third-party communication channels](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/integrate-comm-channels.md) -- The SIR Conference Call integration with third-party communication channels such as Microsoft Teams, Zoom, and Cisco Webex, enables you to manage and initiate a call directly from a security incident.\n          - [Configure report templates in Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/daily-status-sir.md) -- You can create report templates that can be used to generate an incident summary or an executive summary for analysis and sharing.\n            - [Create a Report Template in Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-report-template-sir.md) -- Create a new report template for analyst summary or an executive summary for an incident.\n            - [System properties for reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/system-properties-report-sir.md) -- The system properties for Security Incident Response reports are explained below.\n            - [Duplicate a report template in Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/duplicate-report-sir.md) -- Duplicate a report template to edit or reuse an existing template to create a new template.\n            - [Edit a report template in Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/edit-template-sir.md) -- Edit a report template to reuse an existing template to create a new template.\n          - [On-Call scheduling in Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/on-call-schedule-sir.md) -- Use On-Call Scheduling in Security Incident Response to view and manage shifts for your analysts.\n          - [Category management in Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/category-management-sir.md) -- Configure security incident categories and subcategories for granular classification of incidents, which helps you accurately route security incidents.\n            - [Create a security incident category](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-category-sir.md) -- Create a security incident category to use to classify security incidents in Security Incident Response Workspace.\n            - [Create a security incident subcategory](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-subcategory-sir.md) -- Create subcategories for a category for a deeper classification of a security incident in Security Incident Response Workspace.\n          - [View and update Security Incident Response system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-update-sirw-system-properties.md) -- View and update the Security Incident Response Workspace system properties from the Security Incident Response Workspace administration panel to access and update the required properties.\n            - [Configure default landing tab for security analysts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-default-landing-tab.md) -- Configure the default landing tab (Overview or Details) for security analysts when they select a security incident so they directly land on the page where they need to work on.\n            - [Configure auto refresh interval for security incident lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-auto-refresh-for-security-incident-lists.md) -- Configure the refresh interval for security incident lists for automatic update of the security incident list ensuring an updated list for the security analysts.\n            - [Configure default view for contextual menu](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-default-view-for-contextual-menu.md) -- Configure whether the contextual menu panel for a security incident is expanded or collapsed by default.\n            - [Configure the preview modal for attachment upload](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-attachment-upload-preview-modal.md) -- Configure whether the preview modal appears when security analysts attach files to a security incident record.\n          - [Create quick filters for Security Incidents and Response Tasks lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-quick-filters-for-security-incidents.md) -- Create quick filters to create reusable, predefined filters that appear on the security incidents and response tasks list pages enabling security analysts to filter the list items without adding the filter conditions each time.\n          - [Timeline in Security Incident Response Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/timeline-sir-workspace.md) -- The timeline provides a chronological view of events related to a security incident. Events appear as point events or range events. Administrators can configure which events appear on the timeline and what details are shown in event popovers.\n            - [Configure timeline event configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-timeline-events-sir.md) -- Create or modify timeline event configurations to control which events appear on the security incident timeline.\n        - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-sir-workspace.md) -- Security Analysts and managers use SIR Workspace to perform day-to-day operations with an improved user experience, do complete incident investigation, and get an overview.\n          - [Use generative AI skills](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-now-assist-for-security.md) -- Security analysts can close security incidents quickly from within their flow of work with the generative AI skills supported by ServiceNow Otto for Security Incident Response (SIR).\n            - [Summarize a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/summarize-security-incident-now-assist-sec-incident.md) -- Understand the context of a security incident with the Security Incident summarization generative AI skill.\n            - [Generate closure notes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/generate-closure-notes-si-now-assist-sec-incident.md) -- Automatically generate a draft of the closure notes for a security incident when you close it. The draft is editable and will be reviewed before closing the security incident, and it can be used or modified as needed. Closure notes provide information about the resolution of a security incident to other analysts, managers, and key stakeholders.\n            - [Generate recommended actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/generate-recommended-actions-now-assist-for-security.md) -- Automatically generate the next steps your analysts can take to help them close a security incident in the Security Incident Response Workspace. The recommended steps are based on existing security incidents and knowledge articles.\n            - [Generate a post-incident analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/generate-pia-report-now-assist-security-incident.md) -- Automatically generate a post-incident analysis for a security incident that includes a root cause analysis, impact assessment, and learning and recommendations information.\n            - [Explore correlation insights](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/generating-insights-for-now-assist-for-security.md) -- Generate correlation insights to avoid duplicating your investigation into affected users, configuration items, and observables and resolve the security incident that you're working on quickly. You select the criteria from a security incident that you want to base the correlation insights on.\n              - [Generate correlation insights](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/generate-correlation-insights-now-assist-sir-entry-points.md) -- Generate and view correlation insights in the Security Incident Response Workspace to help you connect past events to the security incident you're working on.\n              - [Generate correlation insights in the ServiceNow Otto panel](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/generate-correlation-insights-now-assist-for-security.md) -- Generate correlation insights from the ServiceNow Otto panel to help you connect past events to the security incident that you're working on.\n            - [Explore Security incident quality assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/na-sir-quality-assessment.md) -- Use generative AI to create a quality assessment report of a security incident. The reports are generated using a predefined, natural language rule set. The report provides an overall assessment summary followed by the detailed assessment for all the rules.\n              - [Generate a quality assessment report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/na-sir-generate-quality-assessment-report.md) -- Generate a quality assessment report for a security incident using a predefined rule set.\n            - [Request generative AI skills](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/request-genai-from-now-assist-panel-now-assist-sec-incident.md) -- Request a security incident summary or closure notes from the ServiceNow Otto panel.\n          - [Use agentic workflows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-now-assist-ai-agents-sir.md) -- Use the Security Incident Response AI agentic workflows to complete security incident tasks.\n            - [Close security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/now-assist-sir-close-incident-usecase.md) -- The Wrap up security incident agentic workflow enables security analysts to close a security incident.\n              - [Close a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/close-sir-incident-aiagent.md) -- Chat with an AI agent in the ServiceNow Otto panel to help you close a security incident.\n            - [Resolve security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/now-assist-sir-resolve-incident-ai-workflow.md) -- Chat with an AI agent in the ServiceNow Otto panel to help you create a resolution plan for a security incident and to resolve it.\n              - [Resolve a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/resolve-sir-incident-aiagent.md) -- Chat with an AI agent in the ServiceNow Otto panel to resolve an incident.\n            - [Analyze security incident data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/analyze-data-sir.md) -- Analyze and get insights into your security incident data using available prompts or natural language queries from the ServiceNow Otto panel.\n            - [Analyze security operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/now-assist-sir-soc-efficiency-usecase.md) -- The Analyze security operations metrics agentic workflow helps security operations center managers analyze the performance of their security teams.\n              - [Analyze security operations metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/assess-metrics-sir-aiagent.md) -- Chat with an AI agent from the ServiceNow Otto panel to help you gain insight into how efficiently your security analysts are working with security incidents resolution.\n            - [Generate SIR Shift Handover Report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-incidents-shifthandover-ai-agent.md) -- Chat with an AI agent in the ServiceNow Otto panel to use the Generate SIR Shift Handover Report agentic workflow to help you add a security incident's detail to a shift handover report.\n              - [Add security incident to shift handover report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-incident-shift-handover.md) -- Chat with an AI agent in the ServiceNow Otto panel to add a security incident details to a shift handover report.\n          - [Working with Security Incident Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-analyst-workspace.md) -- The Security Incident Record consists of the following.\n            - [Security Incident Overview section](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-overview.md) -- The Overview section on the workspace presents the key information associated with the security incident.\n            - [Security Incident Details section](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-details.md) -- This section displays the security incident form fields that are rendered from the security incident classic UI.\n              - [Security incident Details tab](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-details-form.md) -- This section describes all the fields of the Details tab of a security incident.\n            - [SIR Workspace Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-workspace-orchestration-activities.md) -- Security Incident Response Workspace orchestration activities will help the security analysts to view the investigation canvas and perform various actions that are applicable.\n              - [Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-investigation-canvas.md) -- Security Incident Response Workspace allows the Security Analysts to view the key information associated with the security incident during the incident remediation process. The key information also includes the related lists such as Observables, Threat Lookup Results, Sighting Search, Observable Enrichment, and so on.\n                - [Explore Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/explore-investigation-in-sir-workspace.md) -- The primary objective of the investigation canvas is to present the necessary security incident data in one common place.\n              - [Unified experience framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-workspace-capability-framework.md) -- In the classic UI, the experience is disjointed when performing orchestration activities such as running threat look, performing sighting search, and so on. Each capability has its own experience while executing it. In the new workspace, there is unified experience across all capabilities.\n                - [Capabilities and modal screens](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/capabilities-and-modal-screens.md) -- The following table below describes the capabilities and applicable screens.\n                - [Examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/unified-expereince-example.md) -- This example demonstrates the unified experience framework capabilities.\n                  - [Example 1: Run Threat Lookup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/example-1-select-implementations-threat-lookup.md) -- The example below demonstrates the implementation(s).\n                    - [Select implementations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/implementation-selection.md) -- Select one or more implementations as applicable.\n                  - [Example 2: Run Sighting Search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/common-inputs.md) -- The example below demonstrates the common inputs capability action.\n                    - [Add common inputs to an implementation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/common-inputs.md) -- The example below demonstrates the common inputs capability action.\n                  - [Example 3: Run Additional Actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/example-3-add-specific-runtime-details-inputs.md) -- Add specific runtime details inputs to an implementation, Run Additional Actions.\n                    - [Add specific inputs to an implementation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/example-3-add-specific-runtime-details-inputs.md) -- Add specific runtime details inputs to an implementation, Run Additional Actions.\n            - [Security Incident Response Tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-tasks.md) -- All the response tasks associated with a security incident are displayed within the Response Tasks section.\n              - [Create a Response Task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create_response_task.md) -- Create response tasks to track separate actions to be performed to respond to the security issue.\n            - [Security Incident Response Other Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-other-records.md) -- This section displays the other records such as IT related records and email records. Under IT records, Incident, Change Request, Problem and Outages are displayed.\n              - [Create an incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-other-records.md) -- This section displays the other records such as IT related records and email records. Under IT records, Incident, Change Request, Problem and Outages are displayed.\n              - [Link multiple ITSM records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-other-records.md) -- This section displays the other records such as IT related records and email records. Under IT records, Incident, Change Request, Problem and Outages are displayed.\n              - [Create a problem task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-other-records.md) -- This section displays the other records such as IT related records and email records. Under IT records, Incident, Change Request, Problem and Outages are displayed.\n              - [Create a change request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-other-records.md) -- This section displays the other records such as IT related records and email records. Under IT records, Incident, Change Request, Problem and Outages are displayed.\n              - [Create outage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-other-records.md) -- This section displays the other records such as IT related records and email records. Under IT records, Incident, Change Request, Problem and Outages are displayed.\n              - [Compose Emails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-other-records.md) -- This section displays the other records such as IT related records and email records. Under IT records, Incident, Change Request, Problem and Outages are displayed.\n            - [Security Incident Response Post Incident Review](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-response-post-incident-review.md) -- Post incident review appears when an incident is moved to a Review state.\n            - [Update information in security incident related records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/edit-related-records-in-list.md) -- Edit related records for a security incident in Security Incident Response Workspace directly from the Related Records tab without having to leave the current context.\n            - [TISC integration within SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/tisc-sir-workspace.md) -- The following section includes information about the Threat Intelligence Security Center integration from within the SIR workspace context.\n              - [Send data from SIR Workspace to TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/send-sir-to-tisc.md) -- Learn how the data is collaborated and shared between the Threat Intelligence Security Center (TISC) and Security Incident Response (SIR) Workspaces.\n                - [System properties to send data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/tisc-integrations-system-properties.md) -- Review the system properties for TISC integrations to combine with SIRW. You can configure these properties to control how both applications manages the integrations.\n                - [Add security incident to TISC case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-incident-to-case.md) -- Add security incidents to TISC case records.\n                - [Add observables to TISC Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/observables-to-case.md) -- Add observables to TISC case records.\n                - [Send Observables to TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/tisc-context-in-sir-workspace.md) -- Using this feature the security analyst can push the observables data from SIR to TISC. Using the TISC Context, you can check if the observables are present in TISC, if not security analyst can push the data whenever required.\n                - [Send Threat Lookup to TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/send-threat-lookup-to-tisc.md) -- Using this feature the security analyst can push the threat lookup data from SIR to TISC. Using the TISC Context, you can check if the threat lookup results are present in TISC, if not security analyst can push the data whenever required.\n                - [Send Sighting Search to TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/send-sighting-search-to-tisc.md) -- Using this feature the security analyst can push the sighting search data from SIR to TISC. Using the TISC Context, the analyst can check if the sighting search data is present in TISC, if not the security analyst can push the data whenever required.\n                - [Send Observable Enrichment to TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/send-observable-enrichment-to-tisc.md) -- Using this feature the security analyst can push the sighting search data from SIR to TISC. Using the TISC Context, the analyst can check if the sighting search data is present in TISC, if not the security analyst can push the data whenever required.\n              - [Working with TISC Context](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/working-with-tisc-context.md) -- TISC context facilitates viewing threat intelligence data such as observables within the security incident response workspace.\n                - [Add observables to TISC Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/tisc-si-case.md) -- Use this section to add security incidents or observables to a TISC case.\n                - [Link and unlink TISC records to a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/tisc-link-unlink-records-sir.md) -- Link TISC records such as observables, threat actors, and malware to a security incident, or unlink records that you no longer need.\n                - [View Enrichment Results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/tisccontext-enrich-results.md) -- TISC context facilitates viewing threat intelligence data such as observables within the security incident response workspace.\n              - [Enable security incidents for vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/tisc-view-security-context.md) -- Access threat intelligence context for security incidents directly within the Security Incident Response Workspace. TISC context helps you understand related threats and make informed decisions during incident response.\n            - [Reports in Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/report-templates-sir.md) -- All the reports associated with a security incident are available within the Reports section for analysis and sharing.\n              - [Create a report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-report-sir.md) -- Analysts can create a report in Security Incident Response to include the status of an incident and share it via email.\n              - [Edit a report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/edit-report-sir.md) -- Analysts can modify an unpublished report in Security Incident Response and share it via email.\n              - [Delete a report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/delete-report-sir.md) -- You can delete a report in Security Incident Response which is in published or draft state.\n            - [Collaborate using conference call or chat in Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/collab-sir-call-chat.md) -- You can collaborate with analysts and affected users to resolve or discuss about an incident in Security Incident Response application.\n              - [Start a conference call in Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/initiate-conf-call-sir.md) -- Using conference call, security analysts can collaborate with other analysts and affected users in real-time. These calls facilitate the exchange of information to help resolve incidents.\n              - [Add participants to active Conference Call](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-members-conf-call-sir.md) -- You can add participants to an active conference call if you have not added them before starting the conference call.\n              - [Start a Sidebar chat in Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/initiate-chat-sidebar-sir.md) -- Using Sidebar, security analysts can collaborate with others in real-time based on a Workspace task-based or interaction-based record. These Sidebar discussions facilitate the exchange of information and knowledge to help resolve issues faster and with higher-quality outcomes.\n            - [Viewing incident details with a relationship graph](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-relationship-graph.md) -- Relationship graphs in the Security Incident Response workspace visually display the connections between a security incident and its related items to help you analyze the full context of a security incident.\n              - [Customize a relationship graph](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-relationship-graph-config.md) -- Visualize and analyze security incidents and their associated data in a relationship graph.\n              - [Create a relationship graph for an incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-relationship-graph-sir.md) -- Create a node relationship graph in Security Incident Response so you can better analyze a security incident by correlating it with malicious observables, configuration items (CIs), similar security incidents (SIRs), response tasks, and other related information.\n            - [MITRE attack and defend technique graph](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mitre-attack-defend-graph-sir.md) -- The MITRE attack and defend technique graph provides security analysts with an interactive, node-based visualization of attack techniques, defense techniques, and associated artifacts for a security incident.\n            - [View and filter the incident timeline](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-filter-incident-timeline-sir.md) -- View the chronological timeline of events for a security incident and filter by event type to focus on relevant activities.\n          - [Security Incident Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-playbook.md) -- Invoke the security incident playbook flow automatically or manually.\n            - [Add Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-playbook.md) -- Invoke the security incident playbook flow automatically or manually.\n          - [Prerequisites for the Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/getting-started-with-processes.md) -- You need the following roles and plugins to build the Playbooks.\n          - [Rebuilding existing playbooks in Workflow Studio](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/rebuilding-existing-playbooks-on-pad.md) -- You can’t convert existing flows directly into playbooks in Workflow Studio. Each flow designer step that creates a response task to guide the analyst must be broken down into separate actions or subflows.\n          - [Activity Definitions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/build-activities.md) -- The ServiceNow AI Platform provides a few activity definitions within the base system. In addition, for the playbooks that SIR Workspace base system, there are a few activity definitions defined in the base system under Enterprise Security Case Management PAD Commons application.\n            - [Example Activity Definition: Send email](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/example-activity-definition-send-email.md) -- The following is an example of Send email activity definition.\n              - [Create an Activity Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/steps-to-create-an-activity-action.md) -- Following is procedure to create an activity action.\n            - [Submit to CSF X Sandbox](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/submit-to-csf-x-sandbox.md) -- Submit to CSF X Sandbox is an example of an activity definition process.\n          - [Sample Playbooks for SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-workspace-playbooks.md) -- You can create or configure playbooks for SIR Workspace quickly and easily without writing complicated code. You can use these playbooks to resolve security threats in a step-by-step manner. You can invoke the security incident playbook flow automatically or manually.\n          - [Working with MSI Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/working-with-msi-records.md) -- Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization.\n            - [Propose as Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/propose-to-major-security-incident.md) -- Propose a security incident as a Major Security Incident (MSI).\n            - [Promote to Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/promote-to-major-security-incident.md) -- Promote a security incident to major security incident.\n            - [Link to Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/link-to-major-security-incident.md) -- Link a security incident to a major security incident as child security incident(s).\n          - [Working with Form UI actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/enable_workspace_form_ui_actions.md) -- Following are the UI actions that are displayed on the security incident form.\n          - [Security Incident Closure workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/security-incident-closure-workflow_0.md) -- Close the security incident by updating the incident state.\n          - [Handle security incidents using AWA](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/handle-incidents-using-awa.md) -- Handle security incidents assigned to you in SIR Workspace using Advanced Work Assignment.\n        - [View SIR Workspace Dashboards](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/working-with-analysts-dashboard.md) -- This section present the important metrics to analyze your Security Incident Response process such as new security incidents or the average age of open security incidents.\n          - [Security Incident AI ROI Summary dashboard overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ai-roi-summary-dashboard-overview.md) -- The Security Incident AI ROI Summary dashboard derives its values from Platform Analytics indicators and an estimation framework rather than from live queries. Knowing how each metric is calculated helps you interpret the time, monetary, and adoption figures that the dashboard reports.\n            - [Review Security Incident AI ROI Summary dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ai-roi-summary-dashboard.md) -- The Security Incident AI ROI Summary dashboard displays time savings, monetary value, and adoption metrics for ServiceNow Otto capabilities. Use this dashboard to measure AI impact across your Security Incident Response team.\n          - [View Security Analyst Overview dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-security-analyst-overview-dashboard.md) -- With this dashboard, security analysts can view security incidents summarized based on analysts’ critical priority work, high priority work, security Incidents that are assigned to the analyst, tasks assigned to the analysts, and incident count.\n          - [View Security Incident Explorer dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-security-incident-explorer-dashboard.md) -- With this dashboard, security managers are able to view security incidents summarized and grouped by category, subcategory, location, priority and business impact.\n          - [View Security Incident Management dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-security-incident-management-dashboard.md) -- With this dashboard, security managers can easily track the volume, performance and progress of security incidents from initial analysis/detection to containment, eradication, and recovery.\n          - [View Security Operations Efficiency dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-security-operations-efficiency-dashboard.md) -- Security operations center (SOC) managers can view overall efficiency metrics and measure the individual performance of the SOC team members in the organization.\n          - [View Security Incident Response Premium KPIs dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-sir-premium-kpis-dashboard.md) -- With this dashboard, security managers can track and view the volume, performance, and progress of security incidents from initial analysis/detection to containment, eradication, and recovery.\n          - [View Context Sensitive Analytics - SI dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-context-sensitive-analytics-si-dashboard.md) -- With this dashboard, managers and analysts can view the open security incidents, the average age of open Security Incidents, the average close time of security incidents, the percentage of security incidents that were opened and closed on the same day, and the percentage of the incidents that were not updated in the last 5 days and 30 days.\n          - [View CISO dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-ciso-dashboard-overview.md) -- This dashboard provides the Chief Information Security Officers (CISOs) with a high-level overview of security incidents and weekly incidents trends on the instance in the form of graphical charts. These charts help you effectively view and analyze how the Security operations center (SOC) performs.\n          - [View CISO Reporting Overview dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-ciso-reporting-overview-dashboard.md) -- This dashboard provides the Chief Information Security Officers (CISOs) with a high-level reporting overview of the security incidents and weekly incidents trends on the instance in the form of graphical charts. These charts help you effectively view and analyze how the Security operations center (SOC) performs.\n          - [View Security Incident Manager Overview dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-security-incident-manager-dashboard.md) -- This dashboard provides managers with a high-level overview of the critical or high priority security incidents at a team level, SLAs that are about expire in 24 hours, and weekly incidents trends on the instance in the form of reports and graphical charts.\n          - [View Security Incident Response Health dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-sir-health-dashboard.md) -- Security Incident Response Health dashboard feature provides a centralized view of critical aspects related to incident response process implementation, issues/errors encountered, and performance metrics. It serves as a vital tool for monitoring and optimizing the effectiveness of an organization's security incident response capabilities.\n      - [Security incident creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-creation.md) -- Security incidents can be created manually from the form, or automatically via security events received from integrated third-party alert monitoring tools, such as Splunk.\n        - [Security incident manual creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-manual-creation.md) -- You can create a security incident from the Security Incident form, as well as from several other forms.\n          - [Create from Security Incident list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_ManuallyCreateSecurityIncident.md) -- In addition to automatic methods for creating security incidents, you can create them manually, as needed.\n          - [Create from Security Incident Catalog](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manual-si-creation-catalog.md) -- Users in your company can use the Security Incident Catalog to request various types of security-related analysis.\n          - [Create from Event Management alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manually-create-si-from-em-alert.md) -- When Event Management is activated, you can manually create security incidents from the Alert form.\n        - [Security incident automatic creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_3rdPartyAlertMonToolInteg.md) -- Third-party monitoring tools, such as Splunk, can be integrated with Security Incident Response so that security events imported from those tools automatically generate security incidents. You can also import data from third-party tools into security alerts.\n          - [Security incidents created from events and alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_ScIncdUseAlrts.md) -- As events are imported from alert monitoring tools, they are first processed by Event Management and grouped into alerts. These alerts can be used to create security incidents based on customizable alert rules, or manually reviewed to select those alerts to be investigated as a security incident.\n            - [Data imported into security alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_DataImportedIntoSecAlerts.md) -- When an event is created with more JSON-encoded data, that data is imported into any field with a name that matches the fieldName of that value in the JSON data.\n          - [Create security incidents from User Reported Phishing emails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/urp-about.md) -- Use this feature to create security incidents from user reported phishing emails.\n            - [Required components and plugins](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/urp-about.md) -- Use this feature to create security incidents from user reported phishing emails.\n            - [Set up ingestion rules for User Reported Phishing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/urp-about.md) -- Use this feature to create security incidents from user reported phishing emails.\n            - [Define User Reported Phishing properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/urp-about.md) -- Use this feature to create security incidents from user reported phishing emails.\n            - [Email records created from phishing emails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/urp-about.md) -- Use this feature to create security incidents from user reported phishing emails.\n            - [Transform emails records to security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/urp-about.md) -- Use this feature to create security incidents from user reported phishing emails.\n            - [Security incident from phishing emails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/urp-about.md) -- Use this feature to create security incidents from user reported phishing emails.\n              - [User Reported Phishing in the Security Analyst Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/urp-about.md) -- Use this feature to create security incidents from user reported phishing emails.\n            - [Frequently Asked Questions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/urp-about.md) -- Use this feature to create security incidents from user reported phishing emails.\n        - [Record creation from security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/file-creation-from-si.md) -- After you have created and saved a security incident, you can create a change request (CHG), incident (INC), or problem (PRB) record from it. You can also create a customer service case from any security incident.\n          - [Create a change, incident, OT change request, or problem](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_CrtChgOrPrbFromSI.md) -- After you have created and saved a security incident, you can create a change request (CHG), incident (INC), OT change request, or problem (PRB) record from it.\n          - [Create a Customer Service case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-cs-case-from-si.md) -- Security Incident Response ships with a default field mapping that maps a security incident to a Customer Service (CS) case. You can create a CS case from any security incident, edit the Priority, and also add Optional notes.\n          - [Add a security incident to a security case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-sec-inc-to-case.md) -- If you determine that a security incident requires a higher level of analysis, add it to a new or existing case.\n          - [Create response tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_CreateResponseTask.md) -- After a security incident has been created, you can create response tasks to track separate actions to be performed to respond to the security issue.\n      - [Manage Predictive Intelligence for User Reported Phishing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-ml-predictive-intelligence-urp.md) -- The Predictive Intelligence for User Reported Phishing feature provides a significant solution in triaging and prioritizing user reported phishing emails.\n        - [Predictive Intelligence for User Reported Phishing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-ml-urp.md) -- This feature assists security analysts in triaging and prioritizing user reported phishing emails.\n        - [Required components and plugins](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-ml-urp-comp.md) -- To use Predictive Intelligence for User Reported Phishing, you must install the following applications\n        - [Final verdict generation for User Reported Phishing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-ml-urp-final.md) -- Security Incident Response teams can now drive the finalized verdict for a user reported phishing record based on results from predictive intelligence and threat enrichment integrations.\n        - [Troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-ml-urp-trouble.md) -- This section covers a few common problem scenarios.\n      - [Configure Predictive Intelligence for User Reported Phishing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-ml-urp-configure.md) -- Configure and prepare the model to identify user reported phishing emails.\n      - [Assigning security analysts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/r_AgentAssignment.md) -- Depending on your settings in the SIR Administration Configuration screen, you can assign security analysts to security incidents manually; automatically by using a workflow; or automatically by using auto-assignment.\n        - [Manual analyst assignment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/r_AgentAssignment.md) -- Depending on your settings in the SIR Administration Configuration screen, you can assign security analysts to security incidents manually; automatically by using a workflow; or automatically by using auto-assignment.\n        - [Workflow-based security analyst assignment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/r_AgentAssignment.md) -- Depending on your settings in the SIR Administration Configuration screen, you can assign security analysts to security incidents manually; automatically by using a workflow; or automatically by using auto-assignment.\n        - [Automatic security analyst assignment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/r_AgentAssignment.md) -- Depending on your settings in the SIR Administration Configuration screen, you can assign security analysts to security incidents manually; automatically by using a workflow; or automatically by using auto-assignment.\n      - [Process Mining Workspace for Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-process-mining.md) -- Process Mining scan through security incident audit logs and identify factors contributing to inefficiencies such as multiple reassignments, prolonged hold times, and periods of inactivity for security incidents. Organizations can use this information to address the inefficiencies.\n        - [Create process mining project for security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-proj-proc-min-sir.md) -- Create a project in Process Mining Workspace using the pre-build process models definitions from the content pack to scan through audit logs of security incident records and identify inefficiencies in your security incident life cycle.\n        - [Process Mining use cases for security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/proc-min-use-cases-sir.md) -- The following Process Mining use cases provide various analysis methods that you can use to identify inefficiencies during the resolution of your security incidents.\n      - [Managing security incidents and inbound requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manage-si-details.md) -- After a security incident has been created, there are numerous types of information that can be added and viewed as your analysis of the issue progresses toward resolution.\n        - [Create an inbound request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_CreateSecurityIncidentRequest.md) -- Unlike security incidents, inbound requests are generally of a lower priority. Requests for a lookup, scan, or a new badge are examples of inbound requests.\n        - [Manage observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sec-inc-observables.md) -- Observables are artifacts found on a network or operating system that are likely to indicate an intrusion. Typical observables are IP addresses, MD5 hashes of malware files or URLs, or domain names. Threat Intelligence observable table data is available from within a security incident.\n          - [Show IoC information for a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/show-ioc-info-for-si.md) -- You can view IoC information, such as observables and sightings search results associated with a security incident.\n          - [Create a security incident observable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-si-observable.md) -- You can create and view an observable within a security incident and take appropriate action. Having observables available in the security incident is scalable and reduces response time.\n          - [Manage file observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manage-file-observables.md) -- Manage file observables provides stringent security measures to store the suspicious files and enables the files type observables for sandbox integration.\n          - [Edit a security incident observable list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/edit-si-observable.md) -- You can edit which observables in the list associated with a security incident to display.\n          - [Add multiple security incident observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-multiple-si-observables.md) -- To save time, you can add multiple security incident observables to the security incident observables list.\n          - [Automatic security incident observable log data enrichment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-observ-data-enrich.md) -- When certain applications and integrations are set up, including Threat Intelligence and the Palo Alto Networks - Firewall integration, observables information in a security incident can be automatically enriched with threat log data whenever the Source IP for its observables is modified.\n          - [Publish observables to a third-party watchlist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/run-publish-watchlist.md) -- You can publish one or more observables or associated indicators to a third-party watchlist. Currently, the only implementation that supports this functionality is CrowdStrike Falcon Host.\n        - [Manage lookups and scans](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_Scans.md) -- You can perform lookups and vulnerability scans from security incidents and from the security incident catalog to identify potential threats and vulnerabilities.\n          - [Submit an IoC Lookup request from a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_SubmitThrtReqFromSecInc.md) -- An IoC lookup automatically runs whenever observables are added to a security incident. Also, if your security incident has attachments, they can be easily found with the press of a button.\n          - [Submit an IoC Lookup request from the Security Incident Catalog](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_SubmitThrtScnReqFromCat.md) -- If the Security Incident Response plugin is activated, you can submit threat lookups for files, hash values, URLs, and IP addresses from the Security Incident Catalog. The requests are submitted and you can view the results in the My Requests module.\n          - [Submit scan request from security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_SubmitVScanReqFromSecInc.md) -- If your security incident has one or more configuration items (servers, computers, and so on), they can be scanned for vulnerabilities from the Security Incident Response form.\n          - [Submit scan request from SIR catalog](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_SubmitVScanFromSecCat.md) -- You can submit vulnerability scans for CIs and IP addresses from the Security Incident Response catalog. The requests are submitted and you can view the results in the My Requests module.\n        - [Define new on-demand orchestrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/define-new-on-demand-orchs.md) -- In the base system, you can select on-demand orchestrations that execute predefined workflows. You can define new on-demand orchestrations to customize how workflows are invoked from the Run Orchestration choice lists.\n          - [Register new Security Operations applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/register-new-secops-apps.md) -- In the base system, Security Operations applications are automatically registered when they are activated. Registration allows the workflows associated with the applications to be available for on-demand orchestration requests. If needed, you can define new applications and associate workflows with them for on-demand orchestration.\n        - [Add information to a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add_inc_details_to_si.md) -- After a security incident is created, you can add more details to aid in analysis, such as access roles and different kinds of notes.\n          - [Add problems, changes, and incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-rel-recs-to-si.md) -- You can add related records, such as problems, changes, and incidents to existing security incidents.\n        - [Invoke a process dump for an enriched process in Windows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/procdump-windows.md) -- A security analyst can run a process dump on a specific process, dump it into a file, and post it to a shared site on an internal network. An analyst can then view a deny listed process, highlighted in red in a security incident, and perform additional analysis.\n        - [View information in a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/perform-addtl-tasks-on-si.md) -- You can perform several other actions on an existing security incident using the related links.\n          - [Parent and child security incident relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_ParentChildRelationships.md) -- You can associate and track the impact of any given issue using parent and child security incident relationships in Security Incident Response.\n          - [View affected items for a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/show-affected-items-for-si.md) -- You can view affected items, such as CIs, affected users, unmatched affected users, and affected services associated with a security incident.\n            - [Add unmatched affected user for security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-unmatched-affected-user-for-si.md) -- Add affected users that could not be matched to the existing system user records during data processing for preserving the context for the security analysts.\n          - [View related items for a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/show-related-items-for-si.md) -- You can view related items, such as similar and child security incidents, related users, vulnerability groups, and vulnerable items associated with a security incident.\n          - [View enrichment data for a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/show-enrich-data-for-si.md) -- You can view enrichment data, such as running processes, running services, and network statistics associated with a security incident.\n          - [View response task information for a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/show-response-tasks-for-si.md) -- You can view response task information, such as task SLAs, risk score audits and outages associated with a security incident.\n          - [View related events and alerts in security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_ViewRelatedAlerts.md) -- As a security incident is being worked on, you can view the details of the events. For alerts, you can view and acknowledge these alerts, and create incidents or security incidents from them as needed.\n          - [View security incident to customer service case mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-cs-field-mapping.md) -- Security Incident Response ships with a default field mapping that maps a security incident to a Customer Service case. You can view the security incident to CS case default map.\n          - [View a Security Incident Response runbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-runbook.md) -- Runbooks give you access to procedures related to tasks you're working on.\n          - [Identify affected configuration items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_ViewBSMMap.md) -- If you know which resource (server, desktop or other configuration item) is behind a security incident and want to identify related resources and business services that can be affected, you can use the Business Service Management (BSM) map.\n        - [Calculate the severity of a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/calculate-si-severity.md) -- You can calculate the severity of a security incident using predefined calculators.\n        - [Search for and delete phishing emails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/search-delete-exchange-emails.md) -- Deleting phishing emails can help reduce exposure to a specific attack across an organization. You can manage phishing emails on your email server by searching, granting approvals, and deleting them.\n        - [Create a security incident knowledge article](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_CrtScrIncdtKnwArt.md) -- As you work with security incidents and response tasks, knowledge articles automatically display to provide pertinent information about the task you're performing. Your organization can create and maintain articles in the security incident knowledge base.\n        - [Escalate a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/escalate-security-incident.md) -- If an escalation path exists for a security incident, the Escalate button is available in the security incident header.\n        - [Manage post incident activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_PostIncidentReview.md) -- Based on the requirements of your business, a review of the origins and handling of security incidents is often needed.\n          - [Assign post incident review roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/assign-pir-roles.md) -- You can target questions to specific pre-defined groups by assigning roles to Post Incident Review (PIR) categories.\n          - [Post incident review report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/new-post-incident-review-report.md) -- The Post Incident Review (PIR) reports feature enables you to set up and download the post incident review reports using the Post Incident Review tab.\n            - [Manage Post Incident Review Report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/new-manage-post-incident-review-report.md) -- Manage post incident review report includes the information that was configured and applied by the Security Admin, and the security analysts can modify the timeline filters at run-time and download it.\n          - [Configure an assessment trigger condition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/post-incident-review-setup.md) -- Define rule conditions and generate required and optional assessments for specific security incidents.\n            - [Assessment trigger conditions examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/assessment-trigger-conditions-usecase.md) -- The following examples provide different scenarios on how mandatory and optional assessment trigger conditions are generated.\n          - [Perform a questionnaire-based post incident review](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_PerformPostIncidentReview.md) -- You may decide that a post incident review of the security incident is warranted. A post incident review describes what happened, helps to determine why the incident occurred, and identifies how it can be avoided or handled in the future.\n            - [Create post incident review questionnaire categories](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_CreatePIRSurveyCategories.md) -- You can use the post incident review questionnaire categories that come with the base system or create your own categories.\n            - [Compose post incident review questions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_CmpsPstIncdRvwQtns.md) -- You can use the post incident review questions that come with the base system or create your own questions.\n          - [Create post incident review assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-pir-assignment-rules.md) -- In addition to manually adding users to a Post Incident Review (PIR) assessment list for a security incident, you can define assignment rules for automatically adding users or group to the list.\n        - [Close security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_ClosingSecIncidents.md) -- When a security incident has transitioned to the Review state, it’s possible to close it and enter an appropriate closure code. Closure codes can be searched on later for ease of location.\n          - [Add closure information to a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-closure-info-to-si.md) -- When a security incident is in the Review or Closed state, you can enter closure information.\n        - [Restrict access to security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/restrict-access-security-incidents.md) -- Manage the access of the security incidents that contains sensitive information. You can enforce security incident restrictions to determine who can access a certain incident and limit the access only to specific users or groups.\n      - [Manage security threats using the Security Analyst Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-new-ui.md) -- Security Incident Response includes a new user interface called the Security Analyst Workspace that features powerful tools for assisting in analysis, including the playbook, peek view, and tabs for working on multiple security incidents.\n        - [Resolve security threats with the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/use-the-playbook.md) -- Use the Playbook to resolve certain types of security threats in a step-by-step manner. For example, you can resolve phishing attacks and threats caused by malicious code activity using playbooks.\n          - [Resolving user-reported phishing attacks with the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/use-the-playbook.md) -- Use the Playbook to resolve certain types of security threats in a step-by-step manner. For example, you can resolve phishing attacks and threats caused by malicious code activity using playbooks.\n          - [Associate a knowledge article with a playbook task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/use-the-playbook.md) -- Use the Playbook to resolve certain types of security threats in a step-by-step manner. For example, you can resolve phishing attacks and threats caused by malicious code activity using playbooks.\n          - [Add a custom task to the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/use-the-playbook.md) -- Use the Playbook to resolve certain types of security threats in a step-by-step manner. For example, you can resolve phishing attacks and threats caused by malicious code activity using playbooks.\n        - [Sightings searches on phishing and malware attacks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sighting-searches-on-phishing-attacks.md) -- Perform sightings searches on emails or observables to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL occur in your network. Each occurrence is considered a sighting. Sightings searches for observables must be configured for your log stores or security information and event management (SIEM).\n          - [Perform an email sightings search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sighting-searches-on-phishing-attacks.md) -- Perform sightings searches on emails or observables to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL occur in your network. Each occurrence is considered a sighting. Sightings searches for observables must be configured for your log stores or security information and event management (SIEM).\n          - [Perform an observable sightings search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sighting-searches-on-phishing-attacks.md) -- Perform sightings searches on emails or observables to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL occur in your network. Each occurrence is considered a sighting. Sightings searches for observables must be configured for your log stores or security information and event management (SIEM).\n          - [Create sightings search configuration records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sighting-searches-on-phishing-attacks.md) -- Perform sightings searches on emails or observables to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL occur in your network. Each occurrence is considered a sighting. Sightings searches for observables must be configured for your log stores or security information and event management (SIEM).\n      - [Playbook Resources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-flow-library.md) -- Security Incident Response provides a rich set of playbook resources that include a comprehensive library of playbooks, subflows, and actions. You can create or configure playbooks quickly and easily without writing complicated code. You can use these playbooks to resolve security threats in a step-by-step manner.\n        - [Activate a Security Incident Response flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/getting-started-phishing-playbook.md) -- Security administrators and flow designers can use the Security Incident Response flows to automate the process of resolving security incidents in the organization.\n        - [Security Incident Response playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-about-flows.md) -- You can invoke the security incident playbook flow automatically or manually.\n          - [Process-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbooks-process-based.md) -- The playbook component works only for playbooks built in Workflow Studio and not for flows. However, existing flow-based playbooks will continue to work and the activities will be continuing to be rendered as response tasks.\n            - [Playbook for Manual Phishing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-manual-phishing.md) -- The Manual Phishing Playbook provides step-by-step guidance for your analysts on how they can manually resolve specific types of security threats in your phishing activities.\n              - [Create playbooks for Manual Phishing in Workflow Studio](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-process-manual-phishing.md) -- Use these steps to create playbooks for Manual Phishing in Workflow Studio.\n                - [Add parallel activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/parallel-activities.md) -- If the When to Start field is set to With Previous, then parallel activities can be initiated.\n              - [Using the Manual Phishing playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-manual-phishing-playbook.md) -- Use these steps to learn how you can use the Manual Phishing playbook in the SIR Analyst Workspace and its capabilities.\n              - [Workspace Playbook summary](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-workspace-playbook-summary.md) -- The following describes the process summary.\n            - [Playbook for Automated Phishing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-automated-phishing.md) -- The Automated Phishing playbook provides step-by-step guidance for your analysts on how they could resolve specific types of security threats in your Automated Phishing activities.\n              - [Create processes for Automated Phishing in PAD](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-process-automated-phishing.md) -- Use these steps to create processes for Automated Phishing in the Process Automation Designer (PAD).\n              - [Using the Automated Phishing playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-automated-phishing-playbook.md) -- Use these steps to learn how you can use the Automated Phishing playbook in the SIR Analyst Workspace and its capabilities.\n            - [Playbook for Manual Malware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-malware-manual.md) -- The Manual Malware playbook provides step-by-step guidance on how analysts can manually resolve malware alerts more efficiently.\n              - [Create processes for Manual Malware in PAD](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-process-manual-malware.md) -- Use these steps to create processes for Manual Malware in the Process Automation Designer (PAD).\n              - [Using the Manual Malware playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-manual-malware-playbook.md) -- Use these steps to learn how you can use the Manual Malware playbook in the SIR Analyst Workspace and its capabilities.\n            - [Playbook for Automated Malware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-automated-malware.md) -- The Automated Malware playbook provides a sequence of automated steps that helps analysts resolve malware alerts more efficiently.\n              - [Create processes Automated Malware in PAD](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-process-automated-malware.md) -- Use these steps to create processes for Automated Malware in the Process Automation Designer (PAD).\n              - [Using the Automated Malware playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-automated-malware-playbook.md) -- Use these steps to learn how you can use the Automated Malware playbook in the SIR Analyst Workspace and its capabilities.\n            - [Playbook for Failed Login Manual](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-failed-login.md) -- The Failed Login Manual playbook provides guidance and helps optimize the investigation of failed login security incidents.\n              - [Create processes for Failed Login Manual in PAD](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-process-failed-login-manual.md) -- Use these steps to create processes for Failed Login Manual in the Process Automation Designer (PAD).\n              - [Using the Failed Login Manual playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-failed-login-manual-playbook.md) -- Use these steps to learn how you can use the Failed Login Manual playbook in the SIR Analyst Workspace and its capabilities.\n          - [Flow-based Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-flow-based.md) -- Using the Flow Designer, security administrators and flow design authors can more easily transition from manual or undocumented playbooks to automated and repeatable playbooks. The drag-and-drop feature provides flexibility in moving objects, condition checks, parallel branching, decision tables, and more.\n            - [Playbook for Automated Phishing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/flow-designer-and-phishing-response.md) -- The Automated Phishing playbook helps you resolve certain types of security threats in a step-by-step manner. With the flow designer templates, you can automate the steps in the phishing response playbook and resolve incidents quickly and efficiently.\n              - [Run the automated phishing response playbook flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/run-phishing-playbook.md) -- Using the flow designer, you can define and automate tasks in the playbook to analyze and resolve phishing attacks against your organization.\n                - [View flow action designer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/action-phishing-playbook.md) -- You can drill down to the Action Designer to view detailed information about the actions being performed for a specific step in the automated phishing response playbook flow.\n                - [View subflow designer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/subflow-phishing-playbook.md) -- You can drill down to the Subflow Designer to view detailed information about the subflow being executed as part of the automated phishing response playbook flow.\n            - [Playbook for Automated Malware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-about-malware-flow.md) -- The Automated Malware playbook provides a sequence of automated steps that helps you resolve malware alerts quickly and efficiently.\n              - [Run the automated malware playbook flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/run-malware-playbook.md) -- Use this flow to automate tasks in the playbook to analyze and resolve malware attacks against your organization.\n            - [Playbook for Failed Login Manual](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-flow-library2.md) -- When a user makes certain unsuccessful login attempts (according to the SIM configuration), a security incident is created.\n            - [Playbook for Child Security Incident Automation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-flow-library4.md) -- Duplicate security incidents are categorized as child security incidents and are rolled up to the parent security incidents.\n            - [Playbook for Office 365 - Malicious File Detected](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-office-malicious-file-detected-.md) -- This playbook provides systematic remediation steps for investigating malicious files detected in Office 365.\n              - [Set up the Office Malicous File Detected playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-office-malicous-file-detected.md) -- Use the following steps to set up the Office Malicous File Detected playbook.\n              - [Use the Office 365 Malicious File Detected playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-office-malicous-file-detected.md) -- Use this playbook to investigate malicious files detected in Office 365. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Office 365 Malicious File Detected playbook.\n            - [Playbook for Repeat Detection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-repeat-detection.md) -- This playbook helps you determine if the incident response has been provided on an exact or similar phishing report in the past and automatically works on the new report similarly.\n              - [Set up the Repeat Detection playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-repeat-detection.md) -- Use the following steps to set up the Repeat Detection playbook.\n              - [Use the Repeat Detection playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-repeat-detection-playbook.md) -- Use this playbook to investigate if the incident response has been provided on an exact or similar phishing report in the past and automatically works on the new report similarly. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Repeat Detection playbook.\n            - [Playbook for Spoofed Emails (using the same Display name)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-spoofed-emails-display-name.md) -- This playbook provides systematic remediation steps to investigate Spoofed Emails, which get triggered when spoofed names for emails are sent to the organization's employees.\n              - [Set up the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-spoofed-emails.md) -- Use the following steps to set up the Spoofed Emails playbook.\n              - [Use the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-spoofed-emails.md) -- Use this playbook to investigate Spoofed Emails, which get triggered when spoofed names for emails are sent to the organization's employees. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Spoofed Emails (using the same Display name) playbook.\n            - [Playbook for Endpoint Detection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-endpoint-detection.md) -- This playbook provides systematic remediation steps to investigate malware alerts triggered on a host or endpoint (For example, a malicious file detection).\n              - [Set up the Endpoint Detection playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-endpoint-detection.md) -- Use the following steps to set up the Endpoint Detection playbook.\n              - [Use the Endpoint Detection playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-endpoint-detection.md) -- Use this playbook to investigate malware alerts triggered on a host or endpoint. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Endpoint Detection playbook.\n            - [Playbook for Possible Password Spray](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-possible-password-spray.md) -- This playbook provides systematic remediation steps to investigate password spray alerts triggered by multiple failed logins (too many authentication failures from more than one IP address for the same user).\n              - [Set up the Possible Password Spray playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-possible-password-spray.md) -- Use the following steps to set up the Possible Password Spray playbook.\n              - [Use the Possible Password Spray playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-possible-password-spray.md) -- Use this playbook to investigate password spray alerts triggered by multiple failed logins (too many authentication failures from more than one IP address for the same user). The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Possible Password Spray playbook.\n            - [Playbook for T1003 - Detect Credential Dumping Tools](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-detect-credential-dumping-tools.md) -- This playbook provides systematic remediation steps to investigate an incident involving credential dumping activities.\n              - [Set up the T1003 - Detect Credential Dumping Tools playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-detect-credential-dumping.md) -- Use the following steps to set up the T1003 - Detect Credential Dumping Tools playbook.\n              - [Use the T1003 - Detect Credential Dumping Tools playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-detect-credential-dumping.md) -- Use this playbook to investigate an incident involving credential dumping activities. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the T1003 - Detect Credential Dumping Tools playbook.\n            - [Playbook for Email Domain Spoofing Detection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-email-spoof-detection.md) -- This playbook helps with the early stage triage of user-reported phishing submissions by alerting the analyst to the possibility of a look-alike domain in the Phisher's email address.\n              - [Set up the Email Spoof Detection playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-email-spoof-detection.md) -- Use the following steps to set up the Email Spoof Detection playbook.\n              - [Use the Email Domain Spoofing Detection playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-email-spoof-detection.md) -- Use this playbook to find a similarity match between the Phisher's sender email domain with a trusted domain name exists in the observable repository. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Email Domain Spoofing Detection playbook.\n            - [Playbook for Typo Squatted Domain](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-typo-squatted-domain.md) -- This playbook provides systematic procedures for investigating misspelled domains and collaborating with the organization’s legal department for take-downs. Typo Squatted domains are intentionally misspelled domain names that closely resemble legitimate ones. Attackers take advantage of spelling errors to lead them to an ill-intended website for financial exploitation or other malicious activities.\n              - [Set up the Typo Squatted Domain playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-typo-squatted-domain.md) -- Use the following steps to set up the Typo Squatted Domain playbook.\n              - [Use the Typo Squatted Domain playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-typo-squatted-domain.md) -- Use this playbook to investigate misspelled domains and collaborating with the organization’s legal department for take-downs. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Typo Squatted Domain playbook.\n            - [Playbook for Credential Sniffing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-credential-sniffing.md) -- This playbook provides system remediation steps to investigate an incident involving credential sniffing activities performed through the sys_installation_exit table in a ServiceNow instance.\n              - [Set up the Credential Sniffing playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-credential-sniffing.md) -- Use the following steps to set up the Credential Sniffing playbook.\n              - [Use the Credential Sniffing playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-credential-sniffing.md) -- Use this playbook to investigate an incident involving credential sniffing activities performed through the sys_installation_exit table in a ServiceNow instance. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Credential Sniffing playbook.\n            - [Playbook for T1070 - Windows Events Logs Cleared](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-windows-events-log.md) -- This playbook provides remediation steps to investigate incidents that track event types where the user removes security logs. Whenever the Security log is cleared, the events 517 and 1102 are logged regardless of the Audit System Event policy status.\n              - [Set up the T1070 - Windows Events Logs Cleared playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-windows-events-logs.md) -- Use the following steps to set up the T1070 - Windows Events Logs Cleared playbook.\n              - [Use the T1070 - Windows Events Logs Cleared playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-windows-events-logs.md) -- Use this playbook to investigate incidents that track event types where the user removes security logs. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the T1070 - Windows Events Logs Cleared playbook.\n            - [Playbook for OSquery of External Address in /etc/hosts file](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-osquery-external-address.md) -- This playbook provides systematic remediation steps to investigate incidents that indicate that an internal hostname or domain has been assigned to an external IP address on the local DNS(/etc/hosts) of a Linux server.\n              - [Set up the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-osquery-external-address.md) -- Use the following steps to set up the OSquery of External Address in the /etc/hosts file playbook.\n              - [Use the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-osquery-external-address.md) -- Use this playbook to investigate incidents that indicate that an internal hostname or domain has been assigned to an external IP address on the local DNS(/etc/hosts) of a Linux server. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the OSquery of external address in the /etc/hosts file playbook.\n            - [Playbook for User Deleting Bash History - Cloud](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-deleting-bash-history.md) -- This playbook provides systematic remediation steps to investigate incidents that indicate if someone was trying to remove the bash history (.bash_history) file from a Linux server.\n              - [Set up the User Deleting Bash History playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-deleting-bash-history.md) -- Use the following steps to set up the User Deleting Bash History playbook.\n              - [Use the User Deleting Bash History playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-deleting-bash-history.md) -- Use this playbook to investigate incidents that indicate if someone was trying to remove the bash history file from a Linux server. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the User Deleting the Bash History (.bash_history) playbook.\n            - [Playbook for successful VPN attempts from service accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-successful-vpn-attempts.md) -- This playbook provides systematic remediation steps to investigate incidents that track successful login attempts from service accounts through VPN. Service accounts aren’t supposed to have login events from a VPN, and such events could be indicators of either brute force or possible exposure of the account's credentials.\n              - [Set up the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-successful-vpn-attempts.md) -- Use the following steps to set up the Successful VPN Attempts from the Service Accounts playbook.\n              - [Use the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-successful-vpn-attempts.md) -- Use this playbook to investigate incidents that track successful login attempts from service accounts through VPN. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Successful VPN Attempts from the Service Accounts playbook.\n            - [Playbook for Attempted Access to Deactivated Accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-attempted-access-deactivated-accounts.md) -- This playbook triggers when an employee whose account is terminated, disabled, or separated attempts to log in with their credentials. User’s identity state in Sail point generally gets updated to disabled on their termination date.\n              - [Set up the Attempted Access Deactivated Account playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-attempted-access-deactivated-accounts.md) -- Use the following steps to set up the Attempted Access Deactivated Account playbook.\n              - [Use the Attempted Access to Deactivated Accounts playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-attempted-access-deactivated-accounts.md) -- Use this playbook when an employee whose account is terminated, inactive, or separated attempts to log in with their credentials. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Attempted Access to Deactivated Accounts playbook.\n            - [Playbook for T1003 - Defense Evasion - Mimikatz DCShadow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-defense-evasion-mimikatz-dcshadow.md) -- This playbook provides systematic remediation steps to investigate incidents suspected to be caused by Mimikatz DCShadow. DCShadow is a feature in Mimikatz that simulates the behavior of a Domain Controller (a server controlling Active Directory) to inject its own data, bypassing most of the standard security controls (including SIEMs).\n              - [Set up the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-defense-evasion-mimikatz-dcshadow.md) -- Use the following steps to set up the T1003 - Defense Evasion - Mimikatz DCShadow playbook.\n              - [Use the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-defense-evasion-mimikatz-dcshadow.md) -- Use this playbook to investigate security incidents suspected to be caused by Mimikatz DCShadow. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the T1003 - Defense Evasion - Mimikatz DCShadow playbook.\n            - [Playbook for T1003 - Credential Dumping - Mimikatz DCSync](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-credential-dumping-mimikatz-dcsync.md) -- This playbook provides systematic remediation steps to investigate incidents suspected to be caused by Mimikatz DCSync. This playbook triggers when one of the Mimikatz functions (lsadump::dcsync) is used. The function is typically used on attacked Domain Controllers (DC).\n              - [Set up the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-credential-dumping-mimikatz-dcsync.md) -- Use the following steps to set up the T1003 - Credential Dumping - Mimikatz DCsync playbook.\n              - [Use the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-credential-dumping-mimikatz-dcsync.md) -- Use this playbook to investigate incidents suspected to be caused by Mimikatz DCSync. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the T1003 - Credential Dumping - Mimikatz DCsync playbook.\n            - [Playbook for Okta User Login Failures from Multiple IPs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-okta-user-login-failures-ips.md) -- This playbook provides systematic remediation steps to investigate incidents for user login failures on Okta.\n              - [Set up the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-okta-user-login-failures-multiple.md) -- Use the following steps to set up the Okta User Login Failures from Multiple IPs playbook.\n              - [Use the playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-okta-user-login-failures-multiple.md) -- Use this playbook to investigate security incidents for user login failures on Okta. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Okta User Login Failures from Multiple IPs playbook.\n            - [Playbook for ModSec Brute force by IP Burst](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-modsec-bruteforce-ip.md) -- This playbook provides systematic remediation steps to investigate incidents of brute force attempts on the login pages from multiple IPs detected by ModSec. The event conditions could be set at the ModSec policy itself and will raise an alert at Splunk when the event is created at ModSec.\n              - [Set up the ModSec Brute force by IP Burst playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-setup-modsec-bruteforce.md) -- Use the following steps to set up the ModSec Brute force by IP Burst playbook.\n              - [Use the ModSec Brute force by IP Burst playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-modsec-bruteforce-ip-playbook.md) -- Use this playbook to investigate incidents of brute force attempts on the login pages from multiple IPs detected by ModSec. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the ModSec Brute force by IP Burst playbook.\n        - [Security Incident Response playbook actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cj-sir-flow-library-1.md) -- This section describes the actions provided in the Flow Designer action library.\n      - [Visual representation of Security Incident Response reporting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_SIRHomepage.md) -- Security managers can use the high-level graphical interfaces such as maps, treemaps to pinpoint areas of concern.\n        - [Security Incident Response Overview dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_SIROverview.md) -- The Security Incident Response Overview dashboard provides an executive view into security incident activity, providing trends and reports, and drill-downs into specific data.\n          - [Access Security Incident Response Explorer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/access-sec-in-resp-explorer.md) -- You can access the Security Incident Response Explorer dashboard to view security incident activity in order to instantly pinpoint areas of concern and quickly resolve issues.\n          - [Security incident map](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_SecurityIncidentGeoHeatmap.md) -- The security incident map provides data by geographical location. The world map is highlighted in every area in which an incident occurs. When the Security Incident Analytics plugin is activated, you can add the security incident map to the Security Incident Response overview. After it has been added, you can configure the map by modifying the map filters.\n            - [Add map to Security Incident Response overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_AddGeoHeatmapToSIROverview.md) -- You can add the map to the Security Incident Response overview to view security incident data by geographical location. A map allows you to drill down to security incident information by location.\n            - [Modify security incident map](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_ModifySecIncGeoHeatmap.md) -- Administrators in the global domain, can modify how the security incident map handles security incidents using filters.\n          - [Security incident treemaps](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_ConfigureTreemaps.md) -- When the Security Incident Analytics plugin is activated, you can add the security incident - service impact and security incident - real-time treemaps to the Security Incident Response overview. After they have been added, you can configure the treemaps by modifying treemap categories and indicators.\n            - [Add treemaps to the Security Incident Response overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_AddTreemapsToSIRHomepage.md) -- Treemaps display hierarchical (tree-structured) data as a set of nested rectangles. Each branch of the tree is given a rectangle, which is then tiled with smaller rectangles representing subbranches. Treemaps allow you to display security incident information in a dynamic, engaging way.\n            - [Create or update a treemap category](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_DfnSvcImpctTmapDmn.md) -- You can modify the predefined categories for the security incident treemaps or create categories as needed.\n            - [Create or update a treemap indicator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_CreateUpdateTreemapIndicator.md) -- You can modify the predefined indicators for a treemap category or create new indicators. For each indicator, you can configure its data source and specify how lists of security incidents are opened from treemaps that are viewed with the indicator.\n          - [Add vulnerability significance charts to an overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_AddVulnSignTreemaps.md) -- If the Vulnerability Response plugin is activated, you can add vulnerability significance definition charts and other visualizations to the Overview.\n      - [Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/major-security-incident-management-landing-page.md) -- The ServiceNow Major Security Incident Management application tracks the progress of Major Security Incident (MSI) from discovery to analysis, propose, promote, and link security incidents, and closure.\n        - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/exploring-major-security-incident-management.md) -- Explore Major Security Incident Management to understand how the application works in terms of tracking high priority critical security incidents, which are identified as a threat to the organization.\n          - [Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/major-security-incident-management.md) -- Track and manage various activities that are typically part of resolving a major security incident through Major Security Incident Management. Through an intuitive workspace, incident managers and those working on an incident can propose and promote incidents to major incidents, track major security incident activities, and easily collaborate with colleagues.\n          - [Get started with MSIM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-started-with-msim.md) -- Review the following information before you start working with Major Security Incident Management.\n          - [Checklist for MSIM setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/msim-checklist.md) -- Before using the ServiceNow Major Security Incident Management (MSIM) application, download the application from the ServiceNow Store.\n          - [Major Security Incident Management roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/msi-roles.md) -- Assign roles to ensure that users can perform all necessary actions within the MSIM application.\n          - [Environment reference for MSIM setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/msim-environment-reference.md) -- Use this reference table to track environment-specific values while you set up Major Security Incident Management. Complete one column per environment.\n        - [Integrate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/integrate-with-other-applications.md) -- Extend the capabilities of Major Security Incident Management and connect with ServiceNow AI Platform instance by integrating with Microsoft applications.\n          - [Integrate Major Security Incident Management with Microsoft SharePoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/integrate-msim-sharepoint.md) -- Integrate your Microsoft SharePoint with Major Security Incident Management.\n            - [Register application at Azure portal](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-azure-app-msim.md) -- Register a new application at Azure portal for Microsoft SharePoint integration.\n            - [Use certificates for authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/use-certificate-auth-msim.md) -- Request an access token with a certificate credential.\n            - [Configure Microsoft SharePoint with Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/config-sharepoint-msim.md) -- Establish a connection between Major Security Incident Management and Microsoft SharePoint to enable document collaboration and management of security incidents.\n            - [Commands to grant Azure application access to the Microsoft SharePoint site](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/grant-azure-app-access-sharepoint-site-commands.md) -- Use one of the following three methods to grant your registered Azure application write access to the Microsoft SharePoint site at the site level, using the Microsoft Graph API.\n          - [Integrate Major Security Incident Management with Microsoft Teams](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/integrate-teams-msim.md) -- Integrate your Microsoft Teams with Major Security Incident Management.\n            - [Register an application at Azure portal for Microsoft Teams connections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/register-teams-app-msim.md) -- Register a new application at Azure portal for Microsoft Teams integration and grant access to the Azure app.\n            - [Configure Microsoft Teams connection with Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-teams-msim.md) -- Set up Major Security Incident Management with Microsoft Teams connection.\n          - [Establish MS Teams Graph connection on ServiceNow AI Platform](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/msim-micorsoft-team-requirements.md) -- Integrate ServiceNow AI Platform instance and Microsoft Teams account by establishing a Microsoft Teams Graph connection.\n            - [Using Certificates for authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-certificates-for-authentication.md) -- Request an access token with a certificate credential.\n              - [Attach a Java Key Store certificate for MS Teams](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/attach-a-java-key-store-certificate-for-ms-teams.md) -- Enable the JWT Bearer Grant token authentication by attaching a valid Java Key Store (JKS) certificate.\n              - [Configure the JWT signing key for MS Teams](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-the-jwt-signing-key-for-ms-teams.md) -- Create a JSON Web Token (JWT) signing key to assign to your Java Key Store certificate.\n              - [Configure the JWT provider for MS Teams](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-the-jwt-provider-for-ms-teams.md) -- Add a JSON Web Token (JWT) provider to your ServiceNow instance.\n              - [Establish a connection using certificates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/establish-a-connection-using-certificates.md) -- Establish a connection between newly created Microsoft Teams graph application using certificates.\n            - [Using Client Secret value](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-client-secret-value.md) -- Use client secret value to configure the Graph application registry record.\n              - [Establish a connection using client secret](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/establish-a-connection-using-client-secret.md) -- Establish a connection between newly created Microsoft Teams graph application with ServiceNow AI Platform instance.\n              - [Activate MS Teams chat connector](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-microsoft-teams-chat-connector-for-existing-users.md) -- If you are an existing user, then follow the procedure in this section to activate Microsoft Teams chat connector for MS Teams Graph Spoke user.\n          - [Major Security Incident Management Conference Call Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/integrate-msim-conference-calls.md) -- With Major Security Incident Management conference calls integration, you can collaborate with your customers and peer agents to resolve customer issues using the video and screen sharing options in Microsoft Teams, Cisco Webex, or Zoom from the MSIM application.\n            - [Start a conference call](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/start-conference-call.md) -- Start a conference call from a task or a major security by inviting one or more users to join a conference call. The conference call would start only when at least two participants join.\n            - [Add participants to a conference call](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-participants-conference-call.md) -- Add participants to a conference call using the search option on the Start conference call pop-up to find and add the required participants. You can also add participants by selecting the participants from the Recommendations list, which provides participant recommendations to add to the conference call.\n            - [Mute participants in a conference call](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mute-unmute-participants.md) -- As an MSI manager or a conference call host, you have the option to mute a particular participant or all the participants on the conference call.\n            - [View conference call details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-conference-call-details.md) -- Conference calls are listed as system activities in the Activity section of the major security incident and also listed in the Conference calls related list. You can view details like Conference bridge name, organizer name, date, time, duration of the call, active and inactive participants.\n            - [Integrate MSIM Conference Calls with Microsoft Teams](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/integrate-msim-conf-call-ms-teams.md) -- The Conference Call Microsoft Teams integration enables you to manage and initiate a Microsoft Teams conference call directly from a major security incident.\n              - [Use the MSIM Conference Call Microsoft Teams integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-conf-call-ms-teams-integration.md) -- The following steps give you a walkthrough of how you can manage and initiate a Microsoft Teams conference call directly from a major security incident.\n            - [Integrate MSIM Conference Calls with Zoom](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/integrate-msim-conf-calls-zoom.md) -- The Conference Call Zoom integration enables you to manage and initiate a Zoom conference call directly from a major security incident.\n              - [Use the MSIM Conference Call Zoom integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-conf-call-zoom-integration.md) -- The following steps give you a walkthrough of how you can manage and initiate a Zoom conference call directly from a major security incident.\n            - [Integrate MSIM Conference Calls with Cisco Webex](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/integrate-msim-conf-calls-webex.md) -- The MSIM Conference Call Cisco Webex integration enables you to manage and initiate a Cisco Webex conference call directly from a major security incident.\n              - [Use the Conference Calls Cisco Webex integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-conf-call-webex-integration.md) -- The following steps give you a walkthrough of how you can manage and initiate a Cisco Webex conference call directly from a major security incident.\n        - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-major-security-incident-management.md) -- Install and configure Major Security Incident Management application.\n          - [Configure File Explorer Component](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/file-explorer.md) -- The File Explorer workspace component organizes and tracks the collection of artifacts (files) related to a major security incident. It is designed to support integration with any third-party file hosting provider such as Microsoft SharePoint in the Major Security Incident Management workspace.\n            - [Get Started with File Explorer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-started-with-fe.md) -- Review the following information before you start working with File Explorer Component.\n            - [Configure File Explorer repository drive](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/file-explorer-repository-config.md) -- Configure the File Explorer repository drive to establish a connection between your MSIM workspace and Microsoft SharePoint, enabling team members to manage incident documents centrally.\n            - [Configure Folder and File Action Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/folder-file-action-settings.md) -- Configure the folder and file actions you would like to be enabled from the File Explorer component on the Major Security Incident Management workspace, using the Folder and File Action Settings setup page. As an MSI Administrator, you can control the individual Folder and File Actions displayed on the File Explorer Component.\n            - [Create Folder Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/file-explorer-folder-templates.md) -- Use Folder Templates to automatically create unique folders for different Major Security Incident types. The folder templates within the File Explorer Component are used to create a base folder structure for the security incident in the Microsoft SharePoint.\n            - [File Explorer Activity Stream in Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activity-stream-on-the-workspace.md) -- Use the File Explorer section from the Major Security Incident Management workspace to display the folders and files, the sequence those were created in Microsoft SharePoint document library.\n            - [File Explorer troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/file-explorer-troubleshooting.md) -- The troubleshooting section can help you resolve some of the technical issues that you may encounter when setting up File Explorer component.\n              - [Scheduled jobs for File Explorer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/file-explorer-troubleshooting.md) -- The troubleshooting section can help you resolve some of the technical issues that you may encounter when setting up File Explorer component.\n              - [Available File Explorer system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/file-explorer-troubleshooting.md) -- The troubleshooting section can help you resolve some of the technical issues that you may encounter when setting up File Explorer component.\n              - [File Explorer Flow Designer Subflows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/file-explorer-troubleshooting.md) -- The troubleshooting section can help you resolve some of the technical issues that you may encounter when setting up File Explorer component.\n          - [Configure Microsoft Teams](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/chat-channel-provider-config.md) -- Configure Major Security Incident Management with Microsoft Teams which helps communication over the chat to resolve Major Security Incident.\n            - [Get started with Microsoft Teams](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-started-with-microsoft-teams.md) -- Review the following information before you start working with Microsoft Teams as a connector application.\n            - [Activate MS Teams as a chat provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/chat-provider-configuration.md) -- Activate Microsoft Teams by validating the Microsoft Teams Connection.\n            - [Create a chat channel template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-chat-channel-template-for-msim.md) -- Configure Chat Teams and Channel Templates to create chat teams and channels to collaborate, track the chat conversations, and add users and user groups to those Chat Channels. These Channel templates are created in the Microsoft Teams when a major security incident is promoted.\n            - [View Chat Message Activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/chat-message-activity.md) -- Chat message activity is recorded and displayed on the Collaboration tab of the Major Security Incident Management workspace.\n            - [Microsoft Teams Chat Connector troubleshooting for MSIM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/microsoft-teams-chat-connector-troubleshooting-for-msim.md) -- Troubleshooting the scheduled jobs, system properties, and Microsoft Teams flow designer subflows for Microsoft Teams chat connector.\n              - [Scheduled jobs for Microsoft Teams](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/microsoft-teams-chat-connector-troubleshooting-for-msim.md) -- Troubleshooting the scheduled jobs, system properties, and Microsoft Teams flow designer subflows for Microsoft Teams chat connector.\n              - [Microsoft Teams Chat Connector Functional Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/microsoft-teams-chat-connector-troubleshooting-for-msim.md) -- Troubleshooting the scheduled jobs, system properties, and Microsoft Teams flow designer subflows for Microsoft Teams chat connector.\n          - [Configure Slack chat connector for major security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-slack-chat-connector-msi.md) -- Integrate and collaborate with Slack to resolve Major Security Incident to view and filter collaboration chat activities.\n            - [Get started with Slack chat connector configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-started-slack-chat-configuration.md) -- Review the following information before you start working with Slack as a connector application.\n            - [Create a chat channel template for Slack](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-chat-channel-template-slack.md) -- Configure Chat Teams and Channel Templates to create chat teams and channels to collaborate, track the chat conversations, and add users and user groups to those Chat Channels. These Channel templates are created in Slack when a major security incident is promoted.\n            - [Activate Slack as a channel provider](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-slack-channel-provider.md) -- Activate Slack by validating the Slack connection.\n            - [View chat message activities in Slack](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-chat-message-activities-slack.md) -- Chat message activity is recorded and displayed on the Collaboration tab of the Major Security Incident Management workspace.\n          - [Customize SI to MSI flows (optional)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/customize-si-to-msi-flows-for-msim.md) -- Copy and customize the SI to MSI promotion flows to control how File Explorer and chat channels are configured when a Security incident is promoted to a Major Security Incident.\n        - [Administer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-msi-administration-settings.md) -- Plan and configure your Major Security Incident Management implementation.\n          - [Enable proposal, promotion and linking](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-msi-administration-settings.md) -- Plan and configure your Major Security Incident Management implementation.\n          - [Tag security incidents as major security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-msi-administration-settings.md) -- Plan and configure your Major Security Incident Management implementation.\n          - [Configure labels for major security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-msi-administration-settings.md) -- Plan and configure your Major Security Incident Management implementation.\n          - [Configure labels for major security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-msi-administration-settings.md) -- Plan and configure your Major Security Incident Management implementation.\n          - [Configure timeline categories for major security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-msi-administration-settings.md) -- Plan and configure your Major Security Incident Management implementation.\n          - [Set notification preferences for MSIM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-msi-administration-settings.md) -- Plan and configure your Major Security Incident Management implementation.\n          - [Configure MSI closure activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-msi-administration-settings.md) -- Plan and configure your Major Security Incident Management implementation.\n        - [MSIM workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/msim-workspace.md) -- Major Security Incident Management provides a dedicated workspace for managing major security incidents specifically designed for the Major Security Incident manager.\n        - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/major-security-incident-setup.md) -- Managers can use Major Security Incident Management workspace to view the proposed, promoted, linked, and rejected incident records and track their related activities.\n          - [Propose, promote, and link incident records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/promoting-sir-to-msim.md) -- Propose or promote security incidents as major security incidents when incidents are identified as critical threat to the organization.\n            - [Propose as a Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/propose-as-msi.md) -- Propose a security incident to a major security incident.\n            - [Promote to a Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/promote-msi.md) -- Promote a security incident to a major security incident or reject promoted proposals through the Major Security Incident Management (MSIM) Workspace.\n            - [Link to Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/link-si-msi.md) -- Link security incidents to a major security incident.\n          - [Using MSI List view in the MSIM workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/list-view-in-msim.md) -- With the list view in the MSIM workspace, you can view proposed, promoted, and rejected major security incidents.\n          - [View Major Security Incident impact metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/viewing-trend-charts-and-progress-of-msi.md) -- Provides up-to-date summary reporting of the impact and progress of major security incidents, which is an important aspect of managing a major security incident using the new workspace.\n          - [View Major Security Incident trend charts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/viewing-msi-impact-metrics.md) -- View the major security incident impact progress metrics visualized as bar graphs and charts.\n          - [Update Major Security Incident details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/msim-details-tab.md) -- View and update specific details related to the major security incident such as Incident Record Details, Active Team participants, and the corresponding activity log.\n            - [Restrict access to certain major security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/restrict-access-major-security-incidents.md) -- Manage access to sensitive major security incidents by restricting view and modify permissions to authorized users and groups.\n          - [Link additional records to Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/linking-additional-records-to-major-security-incidents.md) -- In the workspace, use the linking records functionality to link any related Security Incident records and its child security incidents, Remediation Tasks from Vulnerability Response, and Security Cases from Threat Intelligence to a Major Security Incident (MSI) record.\n          - [Unlink records from Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/unlinking-msi-records.md) -- Using the Major Security Incident Management workspace, unlink the major security incident records from the Linked Records section.\n          - [Manage tasks in a Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/tasks-tab.md) -- The Task tab enables you to track and manage all the tasks associated with a major security incident from the MSIM workspace. You can view the various tasks using the default Visual Task Board (Kanban view) or the List view.\n            - [Manage tasks using the Visual Task Board](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manage-tasks-using-vtb.md) -- Track and manage all the tasks associated with a major security incident using the Visual Task Board (Kanban view).\n            - [Manage tasks using the List view](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manage-tasks-using-list-view.md) -- Track and manage all the tasks associated with a major security incident using the List view.\n          - [Track collaboration activity via MSIM workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/collab-tab.md) -- Track chat and file activities related to resolving major security incidents through the MSIM Workspace.\n            - [Interact with files and folders](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/collab-tab.md) -- Track chat and file activities related to resolving major security incidents through the MSIM Workspace.\n            - [Manage Chat Channels communications using Microsoft Teams](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/collab-tab.md) -- Track chat and file activities related to resolving major security incidents through the MSIM Workspace.\n            - [Manage Chat Channels communications using Slack](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/collab-tab.md) -- Track chat and file activities related to resolving major security incidents through the MSIM Workspace.\n            - [Manage activity stream conversations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/collab-tab.md) -- Track chat and file activities related to resolving major security incidents through the MSIM Workspace.\n          - [Create and distribute MSIM Status Reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/creating-and-distributing-major-security-incident-status-reports.md) -- As a Major Security Incident (MSI) manager, you can create and distribute the different status reports to different stakeholders at various intervals based on the configured report template or a previous status report throughout the course of the major security incident resolution.\n        - [Manage MSIM status reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/reports-and-metrics.md) -- Status Reports provide preconfigured trend charts with actionable data visualizations to improve security operations processes, measure and analyze the resolution timeline, overdue count, and status of each assigned task.\n          - [Configure Major Security Incident status reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manage-status-reports-for-major-security-incident-management.md) -- Configure major security incident reports to set up and download the reports according to your business needs throughout the life cycle of the major security incident record remediation process.\n            - [Create a Report Template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-report-template.md) -- Create various report templates, which can be applied to the major security incidents and generate a status report. You can add standard and custom Major Security Incident Response form fields to the report template that are dot-walkable. In addition, you can format and configure the report based on your requirements using sections, subsections, and its elements.\n              - [Add Branding to your Report Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-branding-to-your-report-templates.md) -- Add branding to your reports. You can add header and footer image, header and footer text. You can include this branding information in any of the report template types that you want to create other than the two predefined reports.\n              - [Use Visualizations in Report Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-widgets-in-your-report-templates.md) -- Use report widgets to define and include User Interface Builder (UIB) elements such as data visualizations in the MSIM status reports.\n              - [Use Reports Lists in Report Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-reports-lists-in-your-report-templates.md) -- Use report lists to define and include the related list artifacts to generate lists in the PDF based on your configured MSI list records.\n              - [Use Template Scripts in your Report Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-template-scripts-in-your-report-templates.md) -- Create a script to include the related lists data, date operations, and any other data that aren’t directly dot-walkable.\n              - [Preview the Report Template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/preview-status-reports.md) -- Use the Preview functionality to preview your design-time report template to generate and share the report with other stakeholders during run time from the Major Security Incident Management workspace.\n            - [Create a Report Section Template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-report-section-template.md) -- A report can further be divided into various sections. Use the Report section to break down the report into multiple sections and reorganize them in order.\n            - [Create a Report Subsection Template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-report-subsection-template.md) -- Use the report subsection to further organize the section into multiple subsections and configure their alignment and position using the available types such as Text side panel, Primary, and Secondary.\n            - [Create Report Subsection Element template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-report-subsection-element-template.md) -- Use subsection elements to further organize a subsection into multiple elements. Subsection elements help define visualizations, lists, free-form text more declaratively with filter options such as assignment groups and labels.\n              - [Create a Free Form Type Element](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-free-form-type-element.md) -- Create a free form element type to define the free form text more declaratively with filter options such as assignment groups and labels.\n              - [Create a Visualization Type Element](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-visualization-type-element.md) -- Create a visualization element type to define the visualization elements more declaratively with filter options such as assignment groups and labels.\n              - [Create a List Type Element](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-list-type-element.md) -- Create a list type element, which defines the related list elements more declaratively with filter options such as assignment groups and labels.\n              - [Create a Custom Type Element](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-a-custom-type-element.md) -- Create a list type element, which defines the related list elements more declaratively with filter options such as assignment groups and labels.\n            - [Add system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/adding-system-properties-to-your-status-reports.md) -- Add system properties to control MSIM application behavior. Following are the default system properties that are introduced as part of the Major Security Incident Management status reports.\n        - [MSIM Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/msim-playbooks.md) -- You can invoke the Major Security Incident Management playbook flow automatically or manually.\n          - [Playbook for Legal Request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-legal-request.md) -- The Legal Request playbook provides step-by-step guidance on how you can inform legal about the latest summary of an MSI so that they can notify the SEC in the 4-day time frame that is required for material breaches.\n            - [Create processes for Legal Request playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-create-processes-legal-request.md) -- Use these steps to create processes for Legal Request playbook in the Process Automation Designer (PAD).\n            - [Using the Legal Request playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/playbook-using-the-legal-request.md) -- Use these steps to learn how you can use the Legal Request playbook in the MSIM Workspace and its capabilities.\n        - [Rollup Framework for MSIM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/roll-up-framework-for-major-security-incident-management.md) -- Extends the capability of linking the source records from Major Security Incident Management workspace.\n          - [Configure Linked Records in Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configuring-linked-records-in-major-security-incident-management.md) -- Use Linked Records Configuration to store the information of task tables that can be used to link/promote/propose to Major Security Incident.\n          - [Configure Rollup Records in Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/roll-up-record-configuration-in-major-security-incident-management.md) -- Configure Roll up records in Major Security Incident Management to control the information, which will be rolled up when the source record is linked/proposed/promoted as Major Security Incidents.\n          - [Configure List Layout in Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/list-layout-confguration.md) -- Configure list layout to customize the layout and labels used in Major Security Incident Management workspace such as Incident Impact, Linked Records, and Threat Intelligence tabs.\n          - [Rollup example use case implementation for a Security Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/use-case-for-a-security-case.md) -- The following steps explain an example use case on how to add support to link/propose/promote to Major Security Incident for a Security Case table.\n            - [Step 1. Create linked record configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/creating-linked-record-configuration-for-security-case.md) -- Create a Linked Record configuration for a Security Case.\n            - [Step 2. Create a view for modal window](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/creating-a-view-for-modal-window-for-security-case.md) -- Create a view for modal window for a Security Case.\n            - [Step 3. Create UI actions for Source Table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/creating-ui-actions-for-source-table.md) -- Create UI actions for the source table for a Security Case.\n            - [Step 4. Create view for Linked Record tab](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/creating-a-view-for-the-new-linked-record-tab.md) -- Customize the List layout for a Security Case table when it is displayed on the Link Records page with the Major Security Incident Management workspace.\n            - [Step 5. Add Access Control Lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/adding-access-control-lists-for-msim-workspace-users.md) -- Add Access Control Lists (ACLs) for Major Security Incident Management workspace users.\n            - [Step 6. Create business rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/creating-required-business-rules-for-security-case.md) -- Create required business rules for a Security Case.\n            - [Step 7. Create rollup record configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-rollup-record-configurations.md) -- Create rollup record configuration to link and unlink additional records to MSI.\n              - [Writing script for a Security Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-rollup-record-configurations.md) -- Create rollup record configuration to link and unlink additional records to MSI.\n          - [Perform on demand atomic rollup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/perform-on-demand-atomic-rollup.md) -- Rollup framework cannot handle updates to the existing linked records. In such cases, on demand atomic rollup should happen for linked records, which can be achieved via business rules.\n      - [Security Incident Response integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir_integrations.md) -- All the Security Operations core applications and non-core third-party integrations are available from the ServiceNow Store. This section provides instructions for activating the integrations and configuring both ServiceNow and third-party integrations. Also included are some basic guidelines for developing your own integrations, as well as details on specific integrations included in the base system.\n        - [ArcSight ESM Event Ingestion integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm.md) -- The ArcSight ESM event ingestion integration with the Security Incident Response product allows security incident analysts to collect correlated events and automate creation of security incidents with the ServiceNow platform. Data is ingested continually based on a configured polling schedule, and it is used by analysts to identify and respond to potential cyber security threats.\n          - [Set up instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-setup-sn.md) -- The following section lists the setup tasks that you are required to complete in your ServiceNow AI Platform instance prior to installing the application from the ServiceNow Store.\n            - [Set up Query Viewer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-setup-queryviewer.md) -- Create a query viewer and define filters that will include recently created correlation events that will be ingested ServiceNow.\n            - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-install-configure.md) -- Before you run the integration on your ServiceNow AI Platform instance, complete these installation and configuration steps so the application properly integrates with the Security Incident Response and Security Operations products on your ServiceNow AI Platform instance.\n            - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-create-profile.md) -- As a user with the sn_si.admin role, you create a profile in your ServiceNow AI Platform instance and determine which correlation events create security incidents. Before ServiceNow AI Platform Security Incident Response (SIR) security incidents are created from correlation events, the field values from events are displayed on a layout of a ServiceNow AI Platform security incident so that you can preview how the actual security incident will be created.\n              - [Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-create-profile-name.md) -- You can set up a profile to ingest correlation events.\n              - [Select correlation events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-create-profile-eventsearch.md) -- Based on the ArcSight ESM source and the Query Viewer configured, select a correlation event rule for the profile.\n              - [Map event fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-create-profile-about-mapping.md) -- After you identify the specific correlation event rule from the list, the next step is to map correlation event fields to the fields in the security incident form.\n                - [Create mappings for ArcSight ESM event ingestion integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-create-profile-mapping.md) -- In this step, you ingest sample correlation events and map values to the SIR security incident fields.\n              - [Preview security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-create-profile-preview.md) -- After you complete the mapping step, preview the values that you mapped in a ServiceNow AI Platform Security Incident Response (SIR) security incident. This preview step permits you to verify that you have mapped all the correlation fields that you want displayed on the security incident.\n              - [Create a schedule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-create-profile-schedule.md) -- You can define the polling or pull schedule for new correlated events. During this step, you can verify the existing settings for correlation event retrieval or modify the scheduling as needed. This step also permits you to retrieve historical correlation events using a date range.\n              - [Automate event updates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-create-profile-additional.md) -- The ArcSight ESM integration has a bi-directional interface that allows for both correlation events to create security incidents, as well as an ability to update the correlation events once the security incident is created and/or closed with relevant incident details such as security incident number, assignment group, SIR incident URL, and so on.\n          - [Integration Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-settings.md) -- Use this option to modify the ArcSight ESM default ingestion settings.\n          - [Troubleshoot](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-troubleshoot.md) -- This section provides information on how to troubleshoot any errors that may occur during event ingestion.\n          - [Copy profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-copy-profile.md) -- Copy an existing profile and its associated settings instead of creating new profiles. If you are creating multiple profiles, and you want to reuse the settings of an existing profile, you may prefer to copy profiles to save time.\n          - [Format correlation event values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-esm-create-profile-script.md) -- In addition to the directly mapped fields from the ingested correlation event values, use the script editor to format field values on the security incident during the mapping step.\n          - [Subflow execution](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arsight-esm-flows-actions.md) -- Using the Integration Hub and Flow Designer, several flows, subflows, and actions are available with the ArcSight ESM integration.\n        - [Amazon Web Services (AWS) Security Hub integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/aws-security-hub-integration.md) -- AWS Security Hub is a cloud security posture management (CSPM) service that provides automated and continuous security checks and best practice checks against your AWS resources.\n          - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-started-with-aws-security-hub-integration.md) -- Activate and set up the AWS Security Hub findings integration for Security Operation plug-in to interface with your ServiceNow instance and Security Incident Response product.\n          - [Register](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-aws-security-hub.md) -- Register your application in the AWS Security Hub portal and grant your users with read and write access to the application.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-configure-aws-security-hub-integration.md) -- Install and configure the AWS Security Hub integration from the ServiceNow Store on your ServiceNow AI Platform instance to start ingesting AWS Security Hub findings.\n          - [Create profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-a-profile-for-aws-security-hub-integration.md) -- Create an AWS Security Hub profile in your ServiceNow AI Platform instance which you are going to use to ingest data from AWS Security Hub and create a corresponding security incident in Security Incident Response Workspace.\n          - [Map finding fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/map-aws-security-hub-finding-fields.md) -- Map the individual AWS Security Hub finding fields to the fields on the SIR security incident so that you can create incidents with the mapped data.\n          - [Define filter and aggregation criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/aws-security-hub-profile-filter-and-aggregation-criteria.md) -- You can define and set filter conditions so that you can specify which incoming findings should create security incidents. You can also define additional incident field criteria that allows an incoming finding to be appended to an open security incident instead of creating an another security incident for the same finding.\n            - [Set filtering conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/aws-security-hub-profile-filter-and-aggregation-criteria.md) -- You can define and set filter conditions so that you can specify which incoming findings should create security incidents. You can also define additional incident field criteria that allows an incoming finding to be appended to an open security incident instead of creating an another security incident for the same finding.\n            - [Define Aggregation conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/aws-security-hub-profile-filter-and-aggregation-criteria.md) -- You can define and set filter conditions so that you can specify which incoming findings should create security incidents. You can also define additional incident field criteria that allows an incoming finding to be appended to an open security incident instead of creating an another security incident for the same finding.\n          - [Schedule finding retrieval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/schedule-retrieve-and-ingest-finding-data.md) -- Set a schedule to retrieve the finding data and to ingest the AWS Security Hub findings that match the criteria in the profile.\n          - [Automate updates and closures](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/automate-security-hub-finding-updates.md) -- Automate the updates and closures of findings on AWS Security Hub according to the SIR incident status. The AWS Security Hub integration has a bi-directional interface that enables findings ingestion to create security incidents and to update the findings' status according to the changes in the SIR incident.\n          - [Preview findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-form-after-findings-ingestion.md) -- After the ServiceNow AI Platform ingests the AWS Security Hub finding, a security incident is created and the updates are made to that security incident record.\n          - [AWS Domain Separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/aws-domain-separation.md) -- Domain separation is supported for AWS Security Hub application. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n        - [Carbon Black - Incident Enrichment integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/carbon-blk-inc-enrich-landing-page.md) -- Use the Carbon Black integration to investigate and respond to security incidents using APIs to query and interact with endpoints associated with security incidents.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-configure-carbonblack-inc-enrich.md) -- The Carbon Black incident enrichment facilitates the investigation of a security incident by querying logs for potentially malicious indicators. Before you can use the Carbon Black - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate Endpoint Base URL and MID server.\n        - [Carbon Black integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/carbon-black-landing-page.md) -- The Carbon Black integration enables you to investigate and respond to security incidents using APIs to query and interact with endpoints associated with security incidents.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-configure-carbonblack.md) -- Carbon Black is an advanced security system easily integrating with Security Operations. Before you can use the Carbon Black integration, you must download the integration from the ServiceNow Store and add the appropriate Endpoint Base and API Token.\n        - [Check Point Anti-bot - Email Parser integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/checkpt-antibot-integration.md) -- Check Point Anti-bot - Email Parser integration is supported using an email parser that consumes email notifications from Check Point Anti-bot to create security incidents and drive enrichment and response workflows.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-checkpt-antibot.md) -- The Check Point Anti-bot - Email Parser integration uses email notifications to drive enrichment, and response workflows.\n        - [Check Point Next Generation Threat Prevention integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/check-point-ng-integration.md) -- This document describes the steps required to integrate Check Point Next Generation Threat Prevention (NGTP) capabilities with ServiceNow Security Incident Response (SIR) so that applications function properly together.\n          - [Check Point NGTP setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/chk-pt-ngtp-setup.md) -- Before you can use the Check Point NGTP integration, you must create an API account, set up policies, and activate the integration.\n            - [Create API account](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-api-acct.md) -- An API account role is required in your ServiceNow AI Platform instance for this integration. The Username and Password associated with this account are created in the ServiceNow AI Platform and entered in Check Point, so the Check Point authenticates with the ServiceNow AI Platform when retrieving Block List entries.\n            - [Set up integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/set-up-chk-pt-ngtp.md) -- Complete the following steps to set up the Check Point Next Generation Threat Prevention integration. This would ensure that the pre-requisites for the integration to work are in place.\n            - [Activate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-chk-pt-ngtp-integration.md) -- If you have not installed the application, follow the instructions to install it.\n          - [Working with block lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/working-with-block-lists.md) -- The ServiceNow Check Point Next Generation Threat Prevention Integration supports Block Lists that accept IP, URL, and Domain observables.\n            - [Create a block list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-block-list-for-chk-pt-ngtp.md) -- Create a Block List in your ServiceNow AI Platform instance. Once approved and activated, you can create entries for these Block Lists from observables determined to be malicious on Now Platform Security Incident Response (SIR) incidents and request approval to block them.\n            - [Activate a block list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-blk-list.md) -- After the Block List has been created in your ServiceNow AI Platform and the URL is available, the Check Point administrator configures the Block List as Custom Intelligence Feed on all the Check Point Next Generation Gateways. Before it can accept Block List entries, the Block List must be configured in Check Point and activated in the ServiceNow AI Platform.\n            - [Configure a block list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-blk-list-as-custom-intell-feed.md) -- The firewall administrator must configure the Custom Intelligence Feed corresponding to the Block List created in NOW platform.\n            - [Submit entries from incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/submit-blk-list-entries-from-si.md) -- Observables attached to a security incident record are submitted for approval as Block List entries to different Block Lists. An optional approval process for Block List entries is part of the preconfigured workflow. The Gateway imports Block List entries — IP addresses, URLs, domains — that are included in Block Lists.\n            - [Submit entries from Block List](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/submit-blk-list-entries-from-table.md) -- For observables determined to be malicious, and not associated with a specific Now Platform security incident, you submit Block List entries from the block list.\n            - [Approve block list entries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/approve-blk-list-entries.md) -- An approval process for Block List entries is part of the preconfigured workflow. You approve Block List entries before the entries are activated on Block Lists. After you approve the Block List entry, the Gateway retrieves the entry, and your observable is blocked from that point forward.\n            - [Block list entry exceptions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/block-list-exceptions.md) -- There are restrictions for adding Block List entries to Block Lists. If duplicate, compatibility, or CIDR (Classless Inter-Domain Routing) conflicts exist when you try to add Block List entries to Block Lists, error messages are displayed that help you resolve these errors.\n            - [Edit the security tag name](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/edit-sec-tag-name-optional.md) -- If the Display tag check box is selected when you create the Block List record, you can edit the tag names and colors of the security tags. Security tags help you track observables that are already blocked.\n            - [Uninstall the Check Point NGTP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/Uninstall-check-point-ngtp.md) -- If you want to uninstall Check Point NGTP Integration from your ServiceNow AI Platform instance and remove all remnants from the integration, refer to the ServiceNow documentation site for instructions on uninstalling applications.\n        - [CrowdStrike Falcon Host integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/crowdstrike-falcon-host-landing-page.md) -- The CrowdStrike Falcon Host integration allows you to push observables in a security incident into a watchlist, making them able to generate additional alerts. This integration is an implementation of the CrowdStrike Falcon Host - Publish to Watchlist workflow.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-configure-crowdstrike-host.md) -- The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including the CrowdStrike Falcon Host integration. Before you can use the CrowdStrike Falcon Host integration, you must download it from the ServiceNow Store and then add a user name and password.\n          - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secops-integration-crowdstrike-publish.md) -- The Security Operations CrowdStrike Falcon Host - Publish to Watchlist flow designer is used to specify the watchlist for generating alert or events. The alerts and events are displayed in the CrowdStrike Falcon Host system based on how it is configured.\n        - [CrowdStrike Falcon Insight integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/CrowdStrike-Falcon-Insight-for-Security-Operations-integration.md) -- With the CrowdStrike Falcon Insight for Security Operations integration, you can make remediation actions on the endpoints in real time, use profiles to gather details about the host, and make specific queries or actions on the endpoint using the ServiceNow AI Platform Security Incident Response product.\n          - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-started-with-the-crowdstrike-falcon-insight-integration.md) -- You can activate and set up the CrowdStrike Falcon Insight to interface with your ServiceNow AI Platform instance and Security Incident Response product.\n          - [Generate client ID and secret key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-api-clients-and-keys.md) -- Create the CrowdStrike API client and generate the client ID and key, which you use to configure the CrowdStrike Falcon Insight integration.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-configure-crowdstrike-falcon-insight.md) -- Install and configure the CrowdStrike Falcon Insight for Security Operations application from the ServiceNow Store on your ServiceNow AI Platform instance.\n          - [Create an approval group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-approval-group.md) -- Create an approval group for the CrowdStrike Falcon Insight for Security Operations integration that can approve requests for isolating host machines, restoring them to the network, and initiating sightings searches.\n          - [Create profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-a-capability-profile-for-the-crowdstrike-falcon-insight-integration.md) -- Create a profile and select the CrowdStrike Falcon Insight capabilities that you want the profile to run.\n          - [Configure profile settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-profiles-and-security-incidents-for-the-crowdstrike-falcon-insight-integration.md) -- Configure your profile settings so that the profile triggers only under the conditions that you set.\n          - [Set trigger condition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/define-trigger-conditions.md) -- You can configure the profile settings so that a profile runs only when a set of specific conditions is met or you can set up a profile to search for specific field values on a security incident.\n          - [Verify trigger conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-integration-configuration.md) -- Test the profile and verify that the trigger condition filters that you have configured work as expected.\n          - [Trigger profile manually](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manually-trigger-profile-from-security-incident.md) -- Trigger a profile manually after you review a security incident.\n          - [Create and configure a profile for the sighting search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-and-configure-a-profile-for-sightings-search-with-the-crowdstrike-falcon-insight-integration.md) -- Use sightings searches for CrowdStrike Falcon Insight to locate infected machines across your organization's network and to address security incident response cases.\n          - [Create indicators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-indicator-cs-falcon-insight.md) -- Create and manage threat indicators that synchronize directly with CrowdStrike Falcon Insight, enabling consistent, up‑to‑date threat intelligence across your security environment.\n          - [Block Request Category List](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cs-fal-in-block-req-category.md) -- Block Request Category List classify observables in ServiceNow based on the block or allow action selected in the CrowdStrike platform. The Category List provides options to initiate a change request for list approval. This ensures that approvals are routed and processed seamlessly as part of the Block Request capability flow.\n          - [Block List Entries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cs-fal-insight-block-list-entries.md) -- The Block List Entries display records created through Block Requests with the Block action. It lists blocked Hash observables with a Success or Expired status and provides key details such as observable type, source, status, active state, date added, and complete activity history, including status and expiration updates from the CrowdStrike platform.\n          - [Allow List Entries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cs-fal-insight-allow-list-entries.md) -- The Allow List Entries display records created through Block Requests with the Allow action. It lists allowed hash observables with a Success or Expired status and provides key details such as observable type, source, status, active state, date added, and complete activity history, including status and expiration updates from the CrowdStrike platform.\n          - [Trigger additional actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-additional-crowdstrike-falcon.md) -- The CrowdStrike Falcon Insight integration supports running additional actions like regular expression (regex). The CrowdStrike Falcon Insight integration provides 40 additional actions with the base system.\n          - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-crowdstrike-falcon-host-integration-aws.md) -- Use the CrowdStrike Falcon Insight integration to leverage the CrowdStrike Falcon Insight capabilities on the SIR Analyst workspace.\n        - [CrowdStrike Next-Gen SIEM integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/crowdstrike-next-gen-integration-secops.md) -- The CrowdStrike Next-Gen SIEM integration automatically ingests detection data that may indicate potential security incidents and streamlines the creation of security incidents in the ServiceNow Security Incident Response (SIR), ensuring timely and effective response.\n          - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-started-with-cs-ng-siem-integration.md) -- Activate and set up the CrowdStrike Next-Gen SIEM integration for Security Operation plug-in to interface with your ServiceNow AI Platform instance and Security Incident Response product.\n          - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cs-ng-siem-integration.md) -- Install and configure the CrowdStrike Next-Gen SIEM integration for Security Operations application from the ServiceNow Store on your ServiceNow AI Platform instance.\n          - [Create a detection profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-a-profile-cs-ng-siem.md) -- Determine the CrowdStrike Next-Gen SIEM detections that are suitable for creating security incidents by creating a detection profile in your ServiceNow AI Platform instance.\n          - [Set correlation rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/select-correlation-rules-cs-ng-siem.md) -- After creating a CrowdStrike Next-Gen SIEM detection profile, select correlation rules to map corresponding detections to a security incident. Correlation rules are refreshed every time a profile is opened and new rules are available for selection. The CrowdStrike Next-Gen SIEM integration supports multiple profiles.\n          - [Map detection fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/map-crowdstrike-next-gen-inc.md) -- Map the individual CrowdStrike Next-Gen detection fields to the fields on the SIR security incident so that you can create detections with the mapped data.\n          - [Define filter and aggregation criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/filtering-and-aggregation-cs-ng-siem.md) -- Define and set filter conditions to specify which incoming CrowdStrike Next-Gen SIEM detections should create security incidents. You can also define additional detection field criteria that allows an incoming detection to be appended to an open security incident instead of creating an incident.\n            - [Set filtering conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/filtering-and-aggregation-cs-ng-siem.md) -- Define and set filter conditions to specify which incoming CrowdStrike Next-Gen SIEM detections should create security incidents. You can also define additional detection field criteria that allows an incoming detection to be appended to an open security incident instead of creating an incident.\n            - [Define aggregation conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/filtering-and-aggregation-cs-ng-siem.md) -- Define and set filter conditions to specify which incoming CrowdStrike Next-Gen SIEM detections should create security incidents. You can also define additional detection field criteria that allows an incoming detection to be appended to an open security incident instead of creating an incident.\n          - [Schedule detection retrieval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/schedule-retrieve-and-ingest-inc-data.md) -- Configure a schedule to define how and when you pull detections from the CrowdStrike Next-Gen SIEM tenant.\n          - [Automate detection updates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/automate-inc-crowdstrike-ng.md) -- Automate detection updates and closures based on the Security Incident Response incident status. The CrowdStrike Next-Gen SIEM integration enables detections to create security incidents and also to update the incidents after they are created or closed.\n        - [CrowdStrike Falcon X Sandbox integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/crowdstrike-falcon-sandbox-overview.md) -- With the CrowdStrike Falcon X Sandbox for Security Operations integration, you can submit files and URLs as part of the security incident response process to CrowdStrike Falcon X Sandbox to perform a detailed malware and threat analysis.\n          - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/crowdstrike-falcon-sandbox-getting-started.md) -- Activate and set up the CrowdStrike Falcon X Sandbox to interface with your ServiceNow instance and Security Incident Response product.\n          - [Set up submission configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-sandbox-submission-configurations.md) -- Set up the Sandbox configuration to define the analysis environment and runtime options for your security incident record submissions for the malware analysis.\n          - [Submit observables to Sandbox](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/submit-files-or-urls-to-sandbox.md) -- You can manually submit a file or URL to a sandbox when certain incident criteria, such as category is phishing, are met.\n          - [Automate submissions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/flow-designer-crowdstrike-falcon-sandbox-integration.md) -- Automate your file or URL submissions by using the CrowdStrike Falcon X Sandbox integration and Workflow Studio as part of your incident response workflow. The integration includes flow templates that you can use for your security incident records.\n          - [Monitor submission results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-sandbox-submission-results.md) -- Results for all Sandbox submissions are shown in the Sandbox Submission Results tab for every security incident.\n          - [Tag security incidents with the Sandbox submission status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sandbox-tags.md) -- Tag security incidents with the Submission Initiated and Submission Complete tags.\n          - [Review global settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/review-sandbox-global-settings.md) -- Review and modify the global sandbox settings if you are experiencing issues with file or URL submission results.\n        - [Elasticsearch Incident Enrichment integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/elasticsearch-landing-page.md) -- The Elasticsearch - Incident Enrichment integration searches your logs and adds relevant sighting information to your security incidents.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-configure-elasticsearch.md) -- Elasticsearch is a distributed, RESTful search and analytics engine that easily integrates with Security Operations. Before you can use the Elasticsearch - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate API Base URL and login credentials.\n        - [FireEye Endpoint Security integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/fireye-overview.md) -- FireEye Endpoint Security (HX series) helps organizations to inspect and analyze which contains known and unknown threats on any endpoint.\n          - [Set up instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/fireeye-setup-procedure.md) -- Verify and review the following configuration procedure to set up NowPlatform instance for Fireeye integration.\n          - [Timestamp settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-timestamp-settings.md) -- Configure and verify the timestamp settings before the installation procedure.\n          - [Configure integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/fireeye-install-configure-source.md) -- Install and configure the application from ServiceNow Store on your ServiceNow AI Platform instance.\n            - [FireEye Default Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/additional-configurations.md) -- Following are the additional configuration settings after you complete the installation.\n          - [create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-capability-profile-for-fireeye-hx-integration.md) -- Create a profile and select the FireEye HX capabilities that you want the profile to run.\n          - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/understand-trigger-conditions-work-with-configuration-item.md) -- After you create a profile and select the FireEye capabilities that you want the profile to run, configure the profile settings so that it runs only when a set of specific conditions are met.\n          - [Configure profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-profiles-security-incidents-for-fireeye-integration.md) -- After you create a profile and select the FireEye HX capabilities that you want the profile to run, configure the settings so that the profile can be invoked only under the defined conditions.\n            - [Verify the Trigger Condition Filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-the-configured-trigger-conditions.md) -- Test the profile and verify that the trigger condition filters that you have configured are working as expected.\n          - [Trigger a FireEye capability profile from Related Links](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/trigger-fireeye-capability-profile.md) -- Trigger a capability profile manually after reviewing a security incident from related links.\n          - [Trigger a capability profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/trigger-fireeye-capability-related-list.md) -- Trigger a capability profile manually from the configuration item related list.\n          - [FireEye Get File Capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/fireeye-get-capability.md) -- File acquisition requests instruct an Endpoint Security Agent to obtain a file from its host endpoint. File acquisitions are used for static or dynamic analysis of potential or verified compromises, as well as for evidence retention during insider threat investigations. Get File capability should be created as a separate profile.\n          - [FireEye Additional Actions on Endpoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/fireeye-additional-actions-on-endpoint.md) -- FireEye integration supports running additional actions beyond the gold standard actions.\n          - [configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-configure-profile-for-sightings-search-with-fireeye-integration.md) -- Configure the sightings search profile using the following procedure.\n          - [Invoke Sighting Search from a Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/invoke-sighting-search-from-security-incident.md) -- Invoke the sightings search from a SIR security incident by following the below procedure.\n        - [Have I been pwned? integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/haveibeenpwned-landing-page.md) -- The Security Operations Have I been pwned? integration enables you to submit lookups on domain names and email addresses to determine whether user personal data has been compromised by data breaches.\n          - [Have I been pwned? integration setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/haveibeenpwned-setup.md) -- Have I been pwned? is a free resource used to assess if someone may have been put at risk due to their online account being compromised or \"pwned\" in a data breach. It easily integrates with Security Operations.\n            - [Threat Lookup - Have I been pwned? flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/threat-lookup-haveibeenpwned-wf.md) -- The Threat Lookup - Have I been pwned? flow performs a lookup on selected observables. If the observables are of a type recognized by Have I been pwned?, the observables are scanned for malware, and the results are returned.\n            - [Activate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-haveibeenpwned.md) -- The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including the Security Operations Have I been pwned? integration. Before you can use the Have I been pwned? integration, you must download it from the ServiceNow Store.\n            - [Update X.509 certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/update-cert-pawnd.md) -- If you require an SSL connection for the integration, there are circumstances when the certificate provided by the third-party vendor is either not yet trusted in ServiceNow or has expired. This task is optional.\n        - [HPE Security ArcSight ESM - Email Parser integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-emailparser-integration.md) -- The HPE Security ArcSight ESM - Email Parser integration is supported using an email parser that consumes email notifications from ESM to create security incidents.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-arcsight-emailparser.md) -- HPE Security ArcSight ESM - Email Parser integration uses email notifications from ESM to drive enrichment, and response workflows.\n        - [HPE ArcSight Logger - Incident Enrichment integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/arcsight-logger-landing-page.md) -- The HPE ArcSight Logger - Incident Enrichment integration searches your logs and adds relevant sighting information to your security incidents.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-configure-arcsight-inc-enrich.md) -- HPE ArcSight Logger streams real-time data and categorizes them into specific logs and easily integrates with Security Operations. Before you can use the HPE ArcSight Logger - Incident Enrichment integration, you must download it from the ServiceNow Store and add API URL and login credentials.\n        - [Hybrid Analysis integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/hybrid-analysis-lookups.md) -- The Hybrid Analysis application is part of an open online community in which users analyze files and URLs for threats. You share results and utilize research from the community for more effective incident responses. When integrated with the ServiceNow AI Platform Security Operations product, the shared threat intelligence provides you with additional insight into the severity of specific observables.\n          - [Install and configure Hybrid Analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-configure-hybrid-analysis.md) -- Before you run the integration on your instance, complete the installation and configuration steps so the Hybrid Analysis application properly integrates with ServiceNow AI Platform Security Operations.\n          - [Verify expected results for Hybrid Analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-expected-results-hybrid-analysis-.md) -- Observables are generated automatically by a security incident and scanned by the application. Locate the lookup results on the security incident to verify the threat lookup has run successfully. Also view raw data and run threat lookups on child observables.\n          - [(Optional) Manually attach an observable for Hybrid Analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/attach-an-observable-manually-hybrid-analysis.md) -- You can manually attach observables when you want to perform threat lookups on observables that are not attached to a security incident on the initial event trigger. Also, you might perform this task when you want more information about a related observable.\n        - [IBM QRadar Offense Ingestion Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm.md) -- The IBM QRadar Offense Ingestion integration allows you to automatically fetch IBM QRadar offenses and convert them into security incidents and enable automated response actions.\n          - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-install-configure.md) -- Before you run the integration on your ServiceNow AI Platform instance, complete these installation and configuration steps so the application properly integrates with the Security Incident Response and Security Operations products on your ServiceNow AI Platform instance.\n          - [Set up instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-setup-sn.md) -- The following section lists the setup tasks that you are required to complete in your ServiceNow AI Platform instance prior to installing the application from the ServiceNow Store.\n            - [Setup IBM QRadar profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-create-profile.md) -- As a user with the sn_si.admin role, you create an offense profile in your ServiceNow AI Platform instance and determine which offenses create security incidents. Before ServiceNow AI Platform Security Incident Response (SIR) security incidents are created from offenses, the field values from offenses are displayed on a layout of a ServiceNow AI Platform security incident so that you can preview how the actual security incident will be created.\n              - [Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-create-profile-name.md) -- You can set up a profile to ingest offenses.\n              - [Select IBM QRadar rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-create-profile-eventsearch.md) -- Based on the IBM QRadar Source, select one or more IBM QRadar rules for the profile.\n              - [Map offense fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-create-profile-about-mapping.md) -- After you have selected the rules, the next step is to map offense, event, or flow fields to the fields in the security incident form.\n                - [Ingesting the sample IBM QRadar offenses](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-create-profile-ingestion.md) -- You can ingest sample offenses for one or more selected IBM QRadar rules.\n                - [Map offense fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ibm-qradar-mapping-process.md) -- Map individual offense, event, and flow fields to fields on a ServiceNow AI Platform SIR security incident.\n              - [Preview security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-create-profile-preview.md) -- After you complete the mapping step, preview the values that you mapped in a SIR security incident. This preview permits you to verify that you have mapped all the offense fields that you want displayed on the security incident.\n              - [Define schedule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-create-profile-schedule.md) -- You can define the schedule for the offense ingestion. During this step, you can verify the default settings for the offense retrieval or modify the scheduling as needed. This step also permits you to retrieve historical offenses using a date range.\n              - [Automate offense updates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-create-profile-additional.md) -- The IBM QRadar integration has a bi-directional interface that allows for both offenses to create security incidents, as well as an ability to update the offenses once the security incident is created and/or closed with relevant incident details such as security incident number, assignment group, security incident URL, and so on.\n          - [Configuration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-intg-settings.md) -- Use this option to modify the IBM QRadar ingestion integration default system properties.\n          - [Optional: Copy a IBM QRadar profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-copy-profile.md) -- Copy an existing profile and its associated settings instead of creating new profiles. If you are creating multiple profiles, and you want to reuse the settings of an existing profile, you may prefer to copy profiles to save time.\n          - [Domain separation and IBM QRadar Offense Ingestion](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-domain-sep.md) -- Domain separation is supported in IBM QRadar offense ingestion. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n          - [Security Incident Response form after offense ingestion](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-ibm-sir-changes.md) -- After an IBM QRadar offense has been ingested, a security incident is created and the corresponding updates are made to the security incident record.\n          - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ibm-qradar-flow-designer.md) -- Using the Flow Designer and Integration Hub functionality, several subflows and actions have been built as part of the IBM QRadar offense ingestion integration.\n          - [Troubleshoot](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ibm-qradar-trouble.md) -- This section covers important troubleshooting tips and frequently asked questions related to IBM QRadar offense ingestion.\n        - [IBM QRadar - Incident Enrichment Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/qradar-landing-page.md) -- The IBM QRadar - Incident Enrichment integration searches your logs and adds relevant sighting information to your security incidents.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-configure-qradar-inc-enrich.md) -- IBM QRadar is an enterprise security information and event management (SIEM) product that integrates easily with Security Operations. Before you can use the IBM QRadar - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate API Base URL and API Key.\n        - [LogRhythm Overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ovrview-logrhythm.md) -- The mapping flexibility of this integration provides an analyst with visibility to events and related alarm data that can be integrated into ServiceNow AI Platform security incidents for further investigation and remediation.\n          - [Set up the REST API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/drilldown-api-lr.md) -- You use the LogRhythm REST API key to gather additional event details for individual alarm fields. The API key provides details that are unavailable using the LogRhythm REST API.\n          - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-config-logrhythm.md) -- Before you run the integration on your instance, complete the installation and configuration steps so the application properly integrates with Security Operations on the ServiceNow AI Platform.\n          - [Create an alarm profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-alarm-profile-logrhythm.md) -- In an alarm profile that you create and name, you specify which alarms you want to pull from the LogRhythm Client Console. You also define how they are mapped to fields on a ServiceNow AI Platform security incident.\n            - [Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mapping-logrhythm.md) -- After selecting the LogRhythm source that you want to ingest, you need to map individual LogRhythm alarm fields to the ServiceNow AI Platform security incident fields.\n              - [Map LogRhythm alarm fields to security incident fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/logrhythm-map-alarms.md) -- You map individual alarm fields to the security incident fields. The preconfigured mapping can be edited, and color coding provided for the fields helps you monitor alarms you have already mapped. This step helps you visualize how your edits impact the fields on the security incident.\n            - [Filter alarms for LogRhythm](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/filter-alarms-logrhythm.md) -- Setting filtering criteria for alarms after you have mapped fields helps you determine which alarms should be ingested into the SIR application. Filtering alarms helps you significantly reduce the number of alarms you ingest when the alarm profile is activated.\n            - [Previewing the security incident with mapped LogRhythm alarm values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/preview-si-logrhythm.md) -- After you have completed the mapping step, preview the values that you mapped to the fields on the security incident. This preview step permits you to verify that you have mapped all the critical LogRhythm alarm fields you want displayed on the security incident.\n            - [Schedule and retrieve LogRhythm alarms](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/schedule-and-alarm-retrieval-logrhythm.md) -- After you preview the security incident with the LogRhythm alarms that you have selected and mapped, you are ready to schedule alarm retrieval. After you complete this step, the alarm profile is ready to be activated.\n            - [Additional options for LogRhythm alarms](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-alarm-closure-logrhythm.md) -- The LogRhythm Enterprise integration provides you the ability to automatically update or close the LogRhythm alarms based on the security incidents.\n          - [Additional configurations for the LogRhythm integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-system-and-troubleshooting-properties.md) -- Use the LogRhythm Integration Settings to modify the preset system and troubleshooting properties as per you requirements.\n            - [Format field values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/add-scripted-values-logrhythm.md) -- In addition to the directly mapped fields from the pulled alarm values, and the alarm values you enter manually, you can use the script editor to format field values on the security incident during the mapping step which is optional.\n            - [Copy alarm profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/copy-alarm-profile-logrhythm.md) -- Copy an existing profile and its associated settings instead of creating a new alarm profile. If you are creating multiple alarm profiles for different types of alarms and you want to reuse the settings of an existing profile, you can copy alarm profiles to save time. This process is optional.\n            - [Disable automated alarm](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/disable-auto-alarm-logrhythm.md) -- Disable the automated alarm closure capability if you no longer want to view the security incident closure information on the LogRhythm Web Console. Once deactivated, the ServiceNow AI Platform no longer closes alarms within the LogRhythm Web Console. This process is optional.\n            - [View drill down events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/drilldown-events.md) -- View the related raw or base events for a LogRhythm alarm in the security incident.\n          - [Troubleshooting the LogRhythm integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/troubleshooting-logrhythm-integration.md) -- Troubleshoot connectivity and alarm ingestion issues.\n            - [Verify connectivity for LogRhythm](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-connectivity.md) -- Verify your connection to the LogRhythm Client Console by sending curl requests to test the LogRhythm REST API. The verification process is optional.\n            - [Script execution and system log for LogRhythm](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/script-execution-logrhythm.md) -- If you are troubleshooting an alarm ingestion issue, you can override the default five-minute polling interval to view results immediately. In this scenario, call the script execution manually to execute polling. This execution is optional.\n        - [McAfee ePO integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcaffee-epo-overview-arch.md) -- The McAfee ePO integration endpoint detection and response (EDR) capability that helps Security Operations Center (SOC) analysts identify cyberthreats and repair the damage caused by malicious files.\n          - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-integration-architecture.md) -- The following topic is an overview of the system architecture and lists key features of the integration. This section also provides information about the setup steps that you are required to complete in your ServiceNow AI Platform instance and in the McAfee ePolicy Orchestrator (McAfee ePO) console prior to installing the application from the ServiceNow Store.\n          - [Checklist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo_checklist.md) -- Use this checklist to guide you through all the tasks of the integration. The following checklist includes setup and installation tasks and examples of use cases that include expected results for the integration.\n          - [Set up instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcaffee-epo-setup-now.md) -- The following section lists the setup tasks that you’re required to complete in your ServiceNow AI Platform instance prior to installing the application for the McAfee ePO integration.\n          - [Set up console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-setup-mcafee.md) -- The following section lists the setup steps that you're required to complete in your McAfee ePO console before installing the application from the ServiceNow Store for the integration.\n          - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcaffe-epo-install.md) -- Before you invoke the workflows for the integration, install and configure the McAfee ePO application from the ServiceNow Store on your ServiceNow AI Platform instance. The configuration is required to connect to the McAfee ePO console.\n          - [Edit security tags](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-match-tags.md) -- As part of the setup for the integration, edit the security tag names that you created in your McAfee ePO console in your ServiceNow AI Platform instance. Edit the tag names in your ServiceNow AI Platform instance so that they match the names of the tags in your McAfee ePO console.\n          - [Create an approval group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-approval-group-mcafee.md) -- Create an approval group for the McAfee ePO for Security Operations integration that can approve requests for isolating host machines, restoring them to the network.\n          - [Capability profiles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-creating-profiles.md) -- As a user with the security incident administrator (sn_si.admin) role, you create profiles for the McAfee ePO capabilities in your ServiceNow AI Platform instance. You group queries or actions in profiles and determine which McAfee ePO capabilities you want to run when a new security incident is created.\n            - [Create a capability profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-create-profile.md) -- Create a profile and select the McAfee ePO capabilities that you want the profile to run.\n            - [Define triggering conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-alternate-ci.md) -- After you create a profile and select the McAfee ePO capabilities that you want the profile to run, you configure the settings of the profile so that it runs only when a set of specific conditions are met.\n            - [Configure settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-configuring-profile.md) -- After you create a profile and select the McAfee ePO capabilities that you want the profile to run, configure the settings so that the profile is invoked only under the specific conditions that you define.\n              - [Configure the profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-configure-profile.md) -- Configure your profile settings so that the profile triggers only under the conditions that you set.\n              - [Initiate malware scan](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-config-scan-malwr.md) -- After you create a profile with the Initiate Malware Scan capability and any other McAfee ePO capabilities that you want the profile to run, configure the settings of the profile so that it is invoked under the specific conditions that you define.\n          - [Trigger profile manually](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-submit-ih-fm-si.md) -- Trigger a capability profile manually from a ServiceNow AI Platform Security Incident Response (SIR) security incident.\n          - [Trigger additional actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-additional-actions-mcafee.md) -- The List Threat Events and Initiate Malware Scan capabilities can be triggered from Run Additional Actions.​\n          - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-mcafee-integration-aws.md) -- Use the McAfee ePO integration to leverage the McAfee ePO capabilities on the SIR Analyst workspace.\n          - [Initiate malware scan](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-test-incident-malscan.md) -- After you configure a profile for the malware scan, test the profile and view the security incidents that match the settings of your profile. Preview the scan results on the related lists of a ServiceNow AI Platform Security Incident Response (SIR) security incident.\n          - [Test incidents and approve requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-test-incident-ih.md) -- The test and preview step permits you to validate that the host isolation and remove host isolation workflow results are returned as expected for the profile.\n          - [Edit a tag](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-epo-edit-security-tag.md) -- You may prefer to edit the names and colors of the start and complete tags for the initiate malware scan and isolate host capabilities. The start and complete tags help you quickly identify which capabilities are invoked from ServiceNow AI Platform Security Incident Response (SIR) security incidents.\n        - [McAfee ESM - Email Parser integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-esm-emailparser-integration.md) -- The ESM - Email Parser integration is supported by an email parser that consumes email notifications from ESM to create security incidents.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-mcafee-esm-emailparser.md) -- McAfee ESM - Email Parser integration uses email notifications from ESM to drive enrichment, and response workflows.\n        - [McAfee ESM - Incident Enrichment Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mcafee-esm-landing-page.md) -- McAfee ESM - Incident Enrichment integration searches your logs and adds relevant sighting information to your security incidents.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-configure-mcafee-esm-inc-enrich.md) -- McAfee ESM protects endpoints against viruses, spyware, Trojan horses, and other malware threats and integrates easily with Security Operations. Before you can use the McAfee ESM - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate API Base URL and login credentials.\n        - [Microsoft Azure Sentinel integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/microsoft-azure-sentinel-integration.md) -- Microsoft Azure Sentinel is a cloud-based Security Information Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution. You can use the Microsoft Azure Sentinel integration to ingest Azure Sentinel incidents and automatically create security incidents in Security Incident Response.\n          - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-started-with-microsoft-azure-sentinel-integration.md) -- Activate and set up the Microsoft Azure Sentinel - Incident Ingestion for Security Operation plug-in to interface with your ServiceNow AI Platform instance and Security Incident Response product.\n          - [Register and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-microsoft-azure-portal.md) -- Register your application in the Microsoft Azure portal and grant your users with read and write access to the application.\n          - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-configure-microsoft-azure-sentinel-integration.md) -- Install and configure the Microsoft Azure Sentinel integration from the ServiceNow Store on your ServiceNow AI Platform instance to start ingesting Azure Sentinel incidents.\n          - [Create profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-a-profile-for-microsoft-azure-sentinel-integration.md) -- Create an incident profile in your ServiceNow AI Platform instance and determine the Microsoft Azure Sentinel incidents that are suitable for creating security incidents.\n          - [Map incident fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/map-azure-sentinel-incident-fields.md) -- Map the individual Microsoft Azure Sentinel incident fields to the fields on the SIR security incident so that you can create incidents with the mapped data.\n          - [Set filter conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/filter-and-aggregation-criteria.md) -- You can define and set filter conditions so that you can specify which incoming Microsoft Azure Sentinel incidents should create security incidents. You can also define additional incident field criteria that allows an incoming incident to be appended to an open security incident instead of creating an incident.\n            - [Set the filtering conditions for security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/filter-and-aggregation-criteria.md) -- You can define and set filter conditions so that you can specify which incoming Microsoft Azure Sentinel incidents should create security incidents. You can also define additional incident field criteria that allows an incoming incident to be appended to an open security incident instead of creating an incident.\n            - [Define aggregation conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/filter-and-aggregation-criteria.md) -- You can define and set filter conditions so that you can specify which incoming Microsoft Azure Sentinel incidents should create security incidents. You can also define additional incident field criteria that allows an incoming incident to be appended to an open security incident instead of creating an incident.\n          - [Schedule data retrieval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/schedule-retrieve-and-ingest-incident-data.md) -- Set a schedule to retrieve the incident data and to ingest the Microsoft Azure Sentinel incidents that match the criteria in the profile.\n          - [Automate incident updates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/automate-incident-updates.md) -- Automate the incident updates and closures by the SIR incident status. The Microsoft Azure Sentinel integration has a bi-directional interface that enables both incidents to create security incidents and to update the incidents after the security incident is created or closed.\n          - [Copy profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/copy-an-azure-sentinel-profile.md) -- Copy an existing profile and its associated settings instead of creating a profile. When you create multiple profiles, you can reuse the settings of an existing profile by copying these profiles.\n          - [Review record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-form-after-incident-ingestion.md) -- After the ServiceNow AI Platform ingests the Microsoft Azure Sentinel incident, a security incident is created and the updates are made to that security incident record.\n          - [Review settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sentinel-integration-settings.md) -- Review the Microsoft Azure Sentinel integration settings so that you can modify the system properties to suit your environment.\n          - [Domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/azure-sentinel-domain-separation.md) -- Domain separation is supported for this application. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n          - [Compare integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/comparing-azure-sentinel-and-graph-security-api-integrations-with-sir.md) -- You can view the differences between Microsoft Azure Sentinel and Microsoft Graph Security API integrations and choose the right integration with your ServiceNow AI Platform instance.\n        - [Microsoft Defender for Endpoint integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/microsoft-defender-for-endpoint-integration.md) -- The Microsoft Defender for Endpoint enables you to proactively inspect, analyze, and contain known and unknown threats on any endpoint.\n          - [Register and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-ms-azure-portal-using-defender-endpoint-api.md) -- Register the Microsoft Defender for Endpoint application in the Microsoft Azure portal and grant the read and write access to the application.\n          - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/set-up-microsoft-defender-for-endpoint.md) -- The following section lists the setup tasks that you are required to complete in your ServiceNow AI Platform instance prior to installing the Microsoft Defender for Endpoint application from the ServiceNow store.\n          - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-microsoft-defender-source.md) -- Install and configure the Microsoft Defender for Endpoint integration from the ServiceNow Store on your ServiceNow AI Platform instance. Start creating capability profiles using the configurations.\n            - [Additional configuration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/microsoft-defender-default-settings.md) -- There are additional configuration settings you must perform after you complete the installation.\n          - [Map Observable type](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/map-the-ms-defender-for-endpoint-indicator-types.md) -- Map the ServiceNow Observable type with the Microsoft Defender for Endpoint indicator type. This mapping would be used in Observable Enrichment and Create Indicator actions in Microsoft Defender.\n          - [Create capability profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-capability-profile-for-microsoft-defender-for-endpoint.md) -- Create a profile and select the Microsoft Defender for Endpoint capabilities that you want the profile to run.\n          - [Trigger conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/trigger-conditions-configuration-item.md) -- After you create a profile and select the Microsoft Defender for Endpoint capabilities that you want the profile to run, configure the profile settings so that the profile runs only when a set of specific conditions is met.\n          - [Configure a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-profiles-and-security-incidents-for-ms-defender-for-endpoint.md) -- Create a profile and select the Microsoft Defender for Endpoint capabilities that you want the profile to run. You need to configure the settings so that the profile can be triggered only under the defined conditions.\n            - [Verify trigger condition filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-the-trigger-condition-filters.md) -- Validate the profile, and verify that the trigger condition filters that you have configured are working as expected.\n          - [Trigger capability profile from related links](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/trigger-ms-defender-endpoint-profile-related-links.md) -- Trigger a capability profile manually after reviewing a security incident from related links.\n          - [Trigger capability profile from configuration item related list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/trigger-ms-defender-endpoint-profile-ci-relatedlist.md) -- Trigger a capability profile manually from the configuration item related list.\n          - [Additional Configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/additional-configurations-in-defender.md) -- The Microsoft Defender for Endpoint integration supports running additional actions beyond the standard actions.\n            - [Configure Isolate Host capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/isolate-host-ms-defender-for-endpoint.md) -- Isolate the host from accessing the network in Microsoft Defender for Endpoint based on the severity of the attack. Isolating the host from the network enables you to prevent any other malicious activities or potential attacks on other hosts.\n            - [Configure Remove Host Isolation capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/remove-isolation-ms-defender-for-endpoint.md) -- If needed, remove the isolation of a host that was previously isolated from the network in Microsoft Defender for Endpoint. You can prevent any other malicious activities or potential attacks on other hosts.\n            - [Configure Run Antivirus Scan capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/run-antivirus-scan-capability-ms-defender.md) -- Remotely initiate an anti virus scan to help identify and remediate malware that might be present on a compromised device. Run the scan as part of the investigation or response process.\n            - [Configure Restrict App Execution capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/restrict-app-execution-capability-ms-defender.md) -- To contain an attack, restrict or lock a device and prevent subsequent attempts of potentially malicious programs from running.\n            - [Configure Remove App Restriction capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/remove-app-restriction-capability-ms-defender.md) -- If needed, remove the restrictions of any application on the device.\n            - [Configure Get Related Machines from Defender capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-related-machines-defender-capability-ms-defender.md) -- Get the list of related machines of specific observables.\n            - [Configure Stop and Quarantine File capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/stop-and-quarantine-file-capability.md) -- Stop and quarantine files from the Microsoft Defender platform.\n          - [Create and configure profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-and-configure-profile-sightings-search-with-ms-defender.md) -- Create and configure the sightings search profile automatically using the Microsoft Defender for Endpoint.\n            - [Perform manual sighting search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/perform-manual-sighting-search-ms-defender-endpoint.md) -- Select individual or multiple observables and perform a manual sighting search in Microsoft Defender for Endpoint to determine the prevalence of a threat over time.\n            - [Perform automatic observable enrichment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/observable-enrichment-ms-defender-endpoint.md) -- Perform an automatic observable enrichment in Microsoft Defender for Endpoint to enrich observables with additional information from various sources.\n            - [Perform manual observable enrichment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/perform-manual-observable-enrichment-ms-defender-endpoint.md) -- Select individual or multiple observables and perform a manual observable enrichment to enrich observables with additional information from Microsoft Defender for Endpoint.\n          - [Create indicators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-indicators-ms-defender-endpoint.md) -- Create indicators from associated observables of the security incident using the Microsoft Defender for Endpoint.\n            - [Update indicators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/update-indicator-in-microsoft-defender-for-endpoint-using-the-microsoft-defender-indicator-form-view.md) -- Update the existing indicators in Microsoft Defender for Endpoint from the list context-menu or from the form view of the Microsoft Defender Indicator respectively.\n          - [Domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/domain-separation-in-ms-defender-endpoint-integration.md) -- Domain separation is supported in Microsoft Defender for Endpoint integration. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.\n          - [Configure rate limit](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/rate-limit-configuration-ms-defender-endpoint.md) -- Configure the rate limit of the API and timeout for the rate limit for Microsoft Defender for Endpoint integration.\n        - [Microsoft Defender integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-defender.md) -- The Microsoft Defender integration for ServiceNow Security Operations ingests alerts and incidents into the ServiceNow Security Incident Response (SIR) platform for centralized case management. Bi-directional synchronization keeps status and work notes aligned across both platforms, ensuring teams working in either system maintain consistent information without discrepancies.\n          - [Install and Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-ms-defender.md) -- Install and Configure Microsoft Defender integration from the ServiceNow Store to control how incidents are retrieved, processed, and converted into security incidents within SIR.\n          - [Create an incident profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-defender-profile.md) -- Determine the Microsoft Defender incidents that are suitable for creating security incidents by creating an incident profile in your ServiceNow AI Platform instance.\n          - [Map incident fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/microsoft-defender-mapping.md) -- Map Microsoft Defender Incident, and Event Fields to SIR Incident Target Fields.\n          - [Define filter and aggregation criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-def-filtering-and-aggregation.md) -- Define filter and aggregation conditions to control which Microsoft Defender incidents generate new security incidents and whether incoming incidents should be merged into existing ones. These conditions ensure accurate incident grouping and prevent unnecessary duplication.\n          - [Schedule incident retrieval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-defender-schedule-inc.md) -- Set a schedule that determines how frequently Microsoft Defender incidents are pulled into SIR to ensure timely and efficient ingestion.\n          - [Automate incident updates and closures](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-defender-additional-op.md) -- Automate incident updates and closures based on the incident status. The Microsoft Defender integration has a bi-directional interface that enables incidents to create security incidents and to update the incidents after the security incident is created or closed.\n        - [Microsoft Exchange Online integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-exchange-online-lookups.md) -- For the Microsoft Exchange Online integration application by ServiceNow, the ServiceNow AI Platform Security Incident Response (SIR) product is integrated with the Microsoft Exchange Online service, one of the cloud-based services in the Microsoft Office 365 suite of products. Your Security Operation Center (SOC) analyst can search your corporate email environment for security-related threats and remove and remediate phishing emails with email search and delete capabilities.\n          - [Set up account](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-azure-account.md) -- Complete the following setup tasks in your Microsoft Azure portal prior to installing the ServiceNow application for this integration. This account permits access to the Microsoft Exchange Online tenant for email message details.\n          - [Install](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-configure-ms-exchange-online.md) -- Before you run the integration on your instance, install the Microsoft Exchange Online application for the integration from the ServiceNow Store.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/msx_configure.md) -- After you’ve installed the application from the ServiceNow Store, configure it to connect to your ServiceNow AI Platform instance. This activation activates the search and delete workflows.\n          - [Define search criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-expected-results-ms-exchange-online.md) -- As a user with the sn_si.analyst role, set up search criteria and submit an email search request based on incident details on a security incident record.\n          - [Request delete email approval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-delete-email.md) -- After an email search is successfully completed and matching messages are identified, you can permanently delete all the suspicious emails from the Microsoft exchange online service that are related to the security incident and phishing campaign.\n          - [Approve delete email requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-approve-delete.md) -- If the approval option is enabled in your ServiceNow AI Platform instance, requests to delete emails are sent to each member of the approval group via email. You select the approval group during the configuration step. Approvals provide your organization with an additional level of control over the deletion of emails.\n          - [Recover deleted emails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-recover-deleted-emails.md) -- (Optional) As a Microsoft Exchange Administrator, you can recover deleted emails if your incident remediation requires that you to recover the emails deleted by the workflow of this integration.\n          - [Edit security tags](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-edit-tags.md) -- You can edit the names and colors of the security tags in your ServiceNow AI Platform instance for the Microsoft Exchange Online integration. These security tags help you quickly identify when email search either completes or fails. They also identify when requests to delete emails are initiated and when the email items are successfully deleted.\n        - [Microsoft Exchange On-Premises integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-exch-on-prem-landing-page.md) -- The Microsoft Exchange On-Premises integration provides tools for security analysts to contain and eradicate phishing and spear phishing email threats in on-premises instances.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-configure-ms-exch-on-prem-integ.md) -- The Microsoft Exchange On-Premises integration provides tools for security analysts to contain and remediate phishing and spear phishing email threats in on-premises instances. Before you can use the Microsoft Exchange On-Premises integration, you must download it from the ServiceNow Store and identify the appropriate Exchange and MID servers.\n          - [Email Search and Deletion flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-exch-perform-email-search-deletion-wf.md) -- When the Microsoft Exchange - Perform Email Search and Deletion flow is executed, it searches the Exchange server using the search query provided, and returns the details to the on-premises instance.\n            - [Create Compliance Search Preview Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-exch-perform-email-search-deletion-wf.md) -- When the Microsoft Exchange - Perform Email Search and Deletion flow is executed, it searches the Exchange server using the search query provided, and returns the details to the on-premises instance.\n            - [Check Preview Action Status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-exch-perform-email-search-deletion-wf.md) -- When the Microsoft Exchange - Perform Email Search and Deletion flow is executed, it searches the Exchange server using the search query provided, and returns the details to the on-premises instance.\n            - [Create Compliance Search Delete Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-exch-perform-email-search-deletion-wf.md) -- When the Microsoft Exchange - Perform Email Search and Deletion flow is executed, it searches the Exchange server using the search query provided, and returns the details to the on-premises instance.\n            - [Check Delete Action Status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-exch-perform-email-search-deletion-wf.md) -- When the Microsoft Exchange - Perform Email Search and Deletion flow is executed, it searches the Exchange server using the search query provided, and returns the details to the on-premises instance.\n            - [Remove Compliance Search Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-exch-perform-email-search-deletion-wf.md) -- When the Microsoft Exchange - Perform Email Search and Deletion flow is executed, it searches the Exchange server using the search query provided, and returns the details to the on-premises instance.\n        - [Microsoft Graph Security API alert ingestion integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-about.md) -- Use the Microsoft Graph Security API integration to ingest alerts from Microsoft Graph security providers and automatically create security incidents.\n          - [Set up instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-setup-sn.md) -- The following section lists the setup tasks that you are required to complete in your ServiceNow AI Platform instance prior to installing the application from the ServiceNow Store.\n            - [Configure the Microsoft Azure portal](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-configure-azure.md) -- To retrieve security alerts for an application available in the Microsoft Azure tenant using the Microsoft Graph Security API, you must register the application in the Microsoft Azure portal and grant security event read and write access to the application.\n            - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-install.md) -- Before you run the integration on your ServiceNow AI Platform instance, complete these installation and configuration steps so the application properly integrates with the Security Incident Response and Security Operations products on your ServiceNow AI Platform instance.\n          - [Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-create-profile.md) -- As a user with the sn_si.admin role, you create an alert profile in your ServiceNow AI Platform instance and determine which alerts create security incidents. Before security incidents are created from ingested alerts, the field values from alerts are displayed on a layout of a ServiceNow AI Platform security incident so that you can preview how the actual security incident will be displayed.\n            - [Identify source for the profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-create-profile-name.md) -- Specify the name and source for the profile.\n            - [Map alert fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-mapping-about.md) -- After you identify the sources for scheduled alert ingestion, the next step is to map individual alert fields to the fields on a ServiceNow AI Platform SIR security incident.\n              - [Ingest sample Microsoft Graph Security API alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-create-profile-ingestion.md) -- Ingest sample alerts from your Microsoft Azure tenant.\n              - [Mapping alerts to security incident response fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-create-profile-map.md) -- Map individual alert fields from triggered alerts to fields on a ServiceNow AI Platform security incident.\n            - [Preview incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-create-profile-preview.md) -- After you complete the mapping step, preview the values that you mapped in a ServiceNow AI Platform SIR security incident. This preview step permits you to verify that you have mapped all the alert fields that you want displayed on the security incident.\n            - [Define schedule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-create-profile-schedule.md) -- Verify the default settings for alert retrieval or modify the scheduling as needed. This step permits you to filter your alert retrieval based on a date range.\n            - [Automate alert updates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-create-profile-automate.md) -- The Microsoft Graph Security API alert ingestion integration has a bi-directional interface that allows for both alerts to create security incidents, as well as an ability to update the alerts once the security incident is created and/or closed with relevant incident details such as SIR incident number, assignment group, SIR incident URL, and so on. T\n          - [Modify system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-intg-settings.md) -- Use this option to modify the Microsoft Graph Security API ingestion integration default system properties.\n          - [Worknotes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-sir-changes.md) -- After a Microsoft Graph Security API alert has been ingested, a security incident is created and the corresponding updates are made to the security incident record.\n          - [Copy profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-copy-profile.md) -- Copy an existing profile and its associated settings instead of creating new profiles. If you are creating multiple profiles, and you want to reuse the settings of an existing profile, you may prefer to copy profiles to save time.\n          - [Domain separation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-domain-sep.md) -- Domain separation is supported for this application. The Microsoft Graph Security API integration ingests alerts from Microsoft Graph security providers and automatically creates security incidents. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n          - [Troubleshoot](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/ms-graph-trouble.md) -- This section covers important troubleshooting tips and frequently asked questions related to the Microsoft Graph Security API alert ingestion integration.\n        - [Palo Alto Networks - AutoFocus integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/palo-alto-autofocus-landing-page.md) -- The Palo Alto Networks - AutoFocus integration base system includes a workflow and a series of workflow activities you can use to integrate Palo Alto Networks - AutoFocus with your instance.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/set-up-autofocus.md) -- The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including Palo Alto Networks - AutoFocus. Before you can use the Palo Alto Networks - AutoFocus, you must download it from the ServiceNow Store.\n          - [Get AutoFocus Session Info Enrichment Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/search-for-malicious-content.md) -- When the Security Operations Palo Alto Networks- Get AutoFocus Session Info Enrichment flow is executed, it queues a search query with AutoFocus for gathering information about a specified source IP. If AutoFocus has knowledge about previous sessions originating from that IP address, a JSON-formatted report is returned.\n            - [AutoFocus Search Session action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/search-for-malicious-content.md) -- When the Security Operations Palo Alto Networks- Get AutoFocus Session Info Enrichment flow is executed, it queues a search query with AutoFocus for gathering information about a specified source IP. If AutoFocus has knowledge about previous sessions originating from that IP address, a JSON-formatted report is returned.\n            - [Fetch Search Results action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/search-for-malicious-content.md) -- When the Security Operations Palo Alto Networks- Get AutoFocus Session Info Enrichment flow is executed, it queues a search query with AutoFocus for gathering information about a specified source IP. If AutoFocus has knowledge about previous sessions originating from that IP address, a JSON-formatted report is returned.\n        - [Palo Alto Networks - Firewall integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/palo-alto-firewall-landing-page.md) -- To perform Palo Alto Networks - Firewall integration, ensure that you have a MID Server set up with SSH credentials. If a firewall is not already set up, add one.\n          - [Set up SSH credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/set-up-and-config-MID-server.md) -- Palo Alto Networks Firewall sends API calls to the MID Server. As such, ensure that SSH credentials have been created for the MID Server.\n          - [Activate and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-config-firewall.md) -- The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including Palo Alto Networks - Firewall. Before you can use the Palo Alto Networks - Firewall, you must download it from the ServiceNow Store.\n          - [Palo Alto Networks Firewall Launcher Workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secops-integration-paloalto-firewall-launcher-workflow.md) -- Security Operations Integration Palo Alto Networks Firewall Launcher workflow is the Palo Alto Networks Firewall implementation launched by the Security Operations Integration - Block Request capability workflow.\n          - [Get Log Data Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-threat-log-data.md) -- If Security Incident Response, Threat Intelligence, and Palo Alto Networks - Firewall are activated, the Security Operations Palo Alto Networks - Get Log Data flow automatically executes when the Source IP for observables in a security incident is changed.\n            - [Palo Alto Firewall- Get Log Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-threat-log-data.md) -- If Security Incident Response, Threat Intelligence, and Palo Alto Networks - Firewall are activated, the Security Operations Palo Alto Networks - Get Log Data flow automatically executes when the Source IP for observables in a security incident is changed.\n            - [Palo Alto Firewall- Job Data Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-threat-log-data.md) -- If Security Incident Response, Threat Intelligence, and Palo Alto Networks - Firewall are activated, the Security Operations Palo Alto Networks - Get Log Data flow automatically executes when the Source IP for observables in a security incident is changed.\n        - [Palo Alto Networks - WildFire integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/palo-alto-wildfire-landing-page.md) -- Palo Alto Networks - WildFire is a cloud-based application that interacts with your system firewall.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-secops-palo-alto-network.md) -- Before you can use the Security Operations Palo Alto Networks - WildFire integration, you must download the integration from the ServiceNow Store.\n          - [Get WildFire Data Enrichment Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/enrich-wildfire-data.md) -- When the Security Operations Palo Alto Networks - Get WildFire Data Enrichment flow is executed, a hash file is uploaded to WildFire. The data is enriched, and reports are downloaded to the instance to aid in processing potential malware attacks.\n            - [WildFire- get PCAP action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/enrich-wildfire-data.md) -- When the Security Operations Palo Alto Networks - Get WildFire Data Enrichment flow is executed, a hash file is uploaded to WildFire. The data is enriched, and reports are downloaded to the instance to aid in processing potential malware attacks.\n            - [WildFire- get PDF report action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/enrich-wildfire-data.md) -- When the Security Operations Palo Alto Networks - Get WildFire Data Enrichment flow is executed, a hash file is uploaded to WildFire. The data is enriched, and reports are downloaded to the instance to aid in processing potential malware attacks.\n            - [WildFire- get XML report action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/enrich-wildfire-data.md) -- When the Security Operations Palo Alto Networks - Get WildFire Data Enrichment flow is executed, a hash file is uploaded to WildFire. The data is enriched, and reports are downloaded to the instance to aid in processing potential malware attacks.\n        - [Palo Alto Networks Next-Generation Firewall integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto_integration.md) -- Once installed and configured, the security incident analyst uses this integration to block malicious IP addresses, URLs, and domains using External Dynamic List (EDL) capabilities with the ServiceNow Security Incident Response (SIR) products. The security incident analyst creates entries for an EDL from observables determined to be malicious on ServiceNow SIR security incidents.\n          - [Create a certificate profile for the Palo Alto Networks Next-Generation Firewall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto-create-cert-profile.md) -- The integration requires a certificate profile to validate and authenticate the secure connection between the ServiceNow AI Platform server and the Palo Alto Networks Next-Generation Firewall server.\n          - [Set up and install Palo Alto Networks Next-Generation Firewall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto_install.md) -- Complete the following setup checklist prior to installation. These setup tasks are required for a smooth installation.\n          - [Create the API account role for Palo Alto Networks Next-Generation Firewall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto-create-snrole.md) -- An API account role is required in your ServiceNow AI Platform instance for this integration. The Username and Password associated with this account are created in the ServiceNow AI Platform and entered in Palo Alto Networks so the Palo Alto Networks Next-Generation Firewall authenticates with the ServiceNow AI Platform when retrieving EDL entries.\n          - [Supported External Dynamic Lists for Palo Alto Networks Next-Generation Firewall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto_supported_edls.md) -- The ServiceNow Palo Alto Networks Next-Generation Firewall integration supports External Dynamic Lists (EDLs) that accept IP, URL, and domain observables.\n          - [Create an EDL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/palo_alto_config_edl.md) -- Create an External Dynamic List (EDL) in your ServiceNow AI Platform instance. Once approved and activated, you can create entries for EDLs from observables determined to be malicious on ServiceNow AI Platform Security Incident Response (SIR) incidents and request approval to block them.\n          - [Activate an EDL for Palo Alto Networks Next-Generation Firewall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto-activate-edl.md) -- After the External Dynamic List (EDL) has been created in your ServiceNow AI Platform and the URL is available, the Palo Alto Networks firewall administrator configures the EDL in the Palo Alto Networks Next-Generation Firewall. The retrieval URL is used by the Palo Alto Networks firewall administrator to configure the EDL in the Palo Alto Networks Next-Generation Firewall server. Before it can accept EDL entries, the EDL must be configured in Palo Alto Networks and activated in the ServiceNow AI Platform.\n            - [Activate an EDL manually](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto_activate_edl_manually.md) -- If the Palo Alto Networks firewall administrator is not using the ServiceNow AI Platform, and you are directly notified that the Palo Alto Networks Next-Generation Firewall is configured, you can activate the External Dynamic List (EDL) manually.\n              - [Configure an EDL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto-config_firewall_pa.md) -- The Palo Alto Networks firewall administrator configures an EDL to the Palo Alto Networks Next-Generation Firewall once notified the Retrieval URL is available from the ServiceNow AI Platform. Before the EDL can accept EDL entries, it must be configured in Palo Alto Networks, and activated in the ServiceNow AI Platform.\n            - [Activate EDL with a change request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto_sncr_edl.md) -- If configured, the ServiceNow change request form is used to activate the External Dynamic List (EDL). This option is recommended if your firewall administrator is also using the ServiceNow AI Platform for firewall policy or rule changes. The EDL is activated automatically and ready to receive EDL entries upon closure of the ServiceNow AI Platform change request.\n          - [Submit EDL entries from a security incident record for Palo Alto Networks Next-Generation Firewall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto-submit-edl-snsi.md) -- Observables attached to a security incident record are submitted for approval as External Dynamic List (EDL) entries to EDLs. An approval process for EDL entries is part of the preconfigured workflow. The firewall imports EDL entries — IP addresses, URLs, domains — that are included in EDL lists and enforces policy.\n          - [Submit EDL entries from the blocklist for Palo Alto Networks Next-Generation Firewall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto-submit-entry-fm-blklist.md) -- For observables determined to be malicious, and not associated with a specific ServiceNow AI Platform security incident, you submit External Dynamic List (EDL) entries from the blocklist.\n          - [Approve EDL entries for Palo Alto Networks Next-Generation Firewall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto-apprv-edl-entries-sncr.md) -- An approval process for External Dynamic List (EDL) entries is part of the preconfigured workflow. You approve EDL entries before the entries are activated on EDLs. One you approve the EDL entry, the firewall retrieves the entry, and your observable is blocked from that point forward.\n          - [EDL entry exceptions for Palo Alto Networks Next-Generation Firewall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto-edl-execptions.md) -- There are restrictions for adding External Dynamic List (EDL) entries to EDLs. If duplicate, compatibility, or CIDR (Classless Inter-Domain Routing) conflicts exist when you try to add EDL entries to EDLs, error messages are displayed that help you resolve these errors.\n          - [(Optional) Edit the security tag name for Palo Alto Networks Next-Generation Firewall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto_edit_sectag_name.md) -- If the Display tag check box is selected when you create the External Dynamic List (EDL) record, you can edit the tag names and colors of the security tags. Security tags help you track observables that are already blocked.\n          - [Uninstall](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/paloalto-unistall.md) -- If you want to uninstall Palo Alto Networks Next-Generation Firewall from your ServiceNow AI Platform instance and remove all remnants from the integration, refer to the ServiceNow documentation site for instructions on uninstalling applications.\n        - [PhishTank integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/phishtank-lookups.md) -- PhishTank is a community-based phishing verification system into which users submit suspected threats, and other users in the system vote to determine whether the phishing threats are legitimate. When integrated with the ServiceNow AI Platform Security Operations product, the threat intelligence results provide analysts with additional insight into phishing-related security incidents or investigations.\n          - [Install and configure PhishTank](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-configure-phishtank.md) -- Before you run the integration on your instance, complete the installation and configuration steps so the PhishTank application properly integrates with ServiceNow AI Platform Security Operations.\n          - [Verify expected results for PhishTank](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-expected-results-phishtank.md) -- Observables are generated automatically by a security incident and scanned by the application. Lookup results are displayed on the Threat Lookup Results tab at the bottom of the security incident record.\n          - [(Optional) Manually attach an observable for PhishTank](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/attach-an-observable-manually-phishtank.md) -- You can manually attach observables to a security incident. You manually attach observables when you want to perform threat lookups on observables that are not attached to a security incident on the initial event trigger. Also, you might perform this task when you want more information about a related observable.\n        - [Proofpoint Integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/proofpoint-integration-secops-landing.md) -- The Proofpoint SIR integration supports the ingestion of events from Proofpoint. SIR creates an incident for each ingested event which analysts can review or work on.\n          - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/proofpoint-integration-secops-exploring.md) -- You can configure event profiles in SIR to ingest events from Proofpoint. SIR creates an incident for each ingested event which analysts can review or work on.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/proofpoint-integration-secops-configuring.md) -- Configure your implementation of the Proofpoint Integration for Security Operations.\n            - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/proofppoint-integration-secops-install.md) -- Install and configure the  Proofpoint Integration for Security Operations application from the  ServiceNow Store on your  ServiceNow AI Platform instance.\n            - [Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/proofpoint-integration-secops-create-profile.md) -- Create an event profile to identify the events you want to import from the Proofpoint product.\n            - [Review Proofpoint integration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/review-proofpoint-integration-setting-sir.md) -- Review the Proofpoint integration settings so that you can modify the system properties for your environment.\n            - [View the Proofpoint Analytics Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-proofpoint-dashboard.md) -- The Proofpoint Analytics Dashboard provides details about VAP users and top clickers.\n        - [Reverse Whois integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/reversewhois-lookups.md) -- Reverse Whois is a service that performs searches on domain names registered by individuals or organizations.\n          - [Install and configure Reverse Whois](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-config-reversewhois.md) -- Before you run the integration on your instance, complete the installation and configuration steps so the Reverse Whois application properly integrates with the Security Operations product.\n          - [(Optional) Install and configure Whois](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/whois-install-and-config.md) -- Install the Whois plugin to provide additional enrichment information on your domain lookups from the Reverse Whois API. This lookup provides additional enrichment data on the domain, such as the registration date, name of registrar, and country of origin.\n          - [Initiate the lookup for Reverse Whois](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manually-attch-an-obsvrble-reversewhois.md) -- Initiate domain lookups using search terms in observables that you manually attach to a security incident record.\n          - [Verify expected results for Reverse Whois](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-expected-rslts-rvrsewhois.md) -- Enrichment results are displayed on the ReverseWhois Domains tab at the bottom of the security incident record. Locate the lookup results to verify that the lookup ran successfully.\n          - [Enrichment lookup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-expected-results-for-whois.md) -- Run the Whois integration to perform enrichment lookups on the domains returned from the Reverse Whois integration.\n        - [RISKIQ and WHOISIQ integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/riskiq-lookups.md) -- With the integration of RISKIQ and WHOISIQ APIs with the ServiceNow AI Platform Security Operations product, security analysts are provided with additional enrichment data and insight into the validity of websites.\n          - [Supported observables for RISKIQ and RISKIQ WHOISIQ](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/riskiq_supported_obsv.md) -- The RISKIQ API supports automatic SSL certificate lookups on IP address, file hash, Certificate Serial Number, domain, and URL observables. URL and domain observables are enriched automatically with the WHOISIQ API. For observable enrichment on other types of observables with the WHOISIQ API, create observables and run lookups manually from the Observables table.\n          - [Install and configure RISKIQ and WHOISIQ](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-config-riskiq.md) -- Before you run the integration on your instance, complete the installation and configuration steps so the RISKIQ and WHOISIQ applications properly integrate with ServiceNow AI Platform Security Operations.\n          - [Verify expected results for RISKIQ SSL certificate lookups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-expected-rslts-for-riskiq.md) -- When a security incident generates observables for URLs, domains, IP addresses, certificate file hashes (SHA-1 fingerprint), and certificate serial numbers, security incident analysts use the SSL certificate lookup results to verify sites have certificates that have been issued by a trusted public Certificate Authority (CA).\n            - [SSL Certificate Lookup: Exact Match found](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/riskiq_ssl_exact_match.md) -- RISKIQ SSL certificate lookup results for an exact match are displayed on the SSL Certificates tab on the security incident record. An exact match provides a valid certificate authority name, which helps a security incident analyst determine the validity of a website.\n            - [SSL Certificate Lookup: Multiple/None found](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/riskiq_ssl_no_match.md) -- A security incident analyst can use multiple SSL certificate results to determine whether a site is part of a common, recognizable entity. No SSL certificate results may indicate sites with obscure or suspicious names have no trusted certificates. Lookup results for observables that don't return SSL certificates, or that return multiple SSL certificates, are displayed on the Observable Enrichment Results tab on the security incident record.\n          - [Verify expected results for WHOISIQ URL lookups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-expctd-rslts-url-lookups-riskiq.md) -- When a security incident generates observables for URLs or domains, the WHOISIQ API performs the observable enrichment automatically upon security incident creation. The lookup results are displayed on the Observable Enrichment Results and SSL Certificates tabs on the security incident record.\n          - [Create an observable for manual WHOISIQ lookups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manually-attch-obsv-whoisiq.md) -- Security incident analysts use information from observable enrichment with the WHOISIQ API to learn more about the email addresses, names, and phone numbers of organizations.\n          - [Verify expected results for manual WHOISIQ lookups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/verify-expected-rslts-whoisiq.md) -- Run a manual lookup on an observable when it does not automatically generate a security incident. For observable enrichment lookups using the WHOISIQ API for email addresses, organization names, phone numbers, or mailing addresses, initiate the lookup manually from the Observables table.\n        - [Shodan integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/shodan-lookups.md) -- Shodan is a search engine that analyzes service banner information from connected devices all around the globe. Service banners include information about a computer system, such as host name, device type, operating system, geographic location, and connected ISP. When integrated with the ServiceNow AI Platform Security Operations product, this service banner information provides analysts with additional enrichment data and insight for security incidents or investigations.\n          - [Install and configure Shodan](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-and-configure-shodan.md) -- Before you run the integration on your instance, complete the installation and configuration steps so the Shodan application properly integrates with ServiceNow AI Platform Security Operations.\n          - [Verify expected results for Shodan](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/shodan-verify-expected-results.md) -- Observables are generated automatically by a security incident and scanned by the application. Enrichment results are displayed on the Observable Enrichment Results and Network Banners tabs.\n          - [(Optional) Manually attach an observable for Shodan](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manually-attach-an-observable-shodan.md) -- You can manually attach observables to a security incident. You manually attach observables when you want to perform threat lookups on observables that are not attached to a security incident on the initial event trigger. Also, you might perform this task when you want more information about a related observable.\n        - [Secureworks CTP Ticket Ingestion Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-about.md) -- The Secureworks Counter Threat Platform ticket ingestion integration enables you to automatically fetch Secureworks CTP tickets, convert them into security incidents and perform automated response actions.\n          - [Setup instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-setup.md) -- The following section lists the setup tasks that you are required to complete in your ServiceNow AI Platform instance prior to installing the application from the ServiceNow Store.\n            - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-install-configure.md) -- Before you run the integration on your ServiceNow AI Platform instance, complete these installation and configuration steps so the application properly integrates with the Security Incident Response and Security Operations products on your ServiceNow AI Platform instance.\n          - [Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-create-profile.md) -- Create a profile in your ServiceNow AI Platform instance and determine which tickets need to be ingested and which tickets will be used to create security incidents. Before security incidents are created from ingested tickets, the field values from tickets are displayed on a layout of a ServiceNow AI Platform security incident so that you can preview how the actual security incident will be displayed.\n            - [Identify the source of the profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-create-profile-name.md) -- Specify the name and source of the profile.\n            - [Mapping of ticket fields for the SecureWorks CTP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-create-profile-about-mapping.md) -- Map the ticket and event fields to the fields in the security incident form.\n              - [Ingesting the sample Secureworks tickets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-create-profile-ingestion.md) -- Select the sample tickets that are to be ingested.\n              - [Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-create-profile-mapping.md) -- Map individual ticket or event fields to fields on a ServiceNow AI Platform SIR security incident.\n            - [Preview the mapped values in the security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-create-profile-preview.md) -- After you complete the mapping step, preview the values that you mapped in a SIR security incident. This preview step permits you to verify that you have mapped all the ticket fields that you want displayed on the security incident.\n            - [Define schedule for the Secureworks CTP Ticket ingestion](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-create-profile-schedule.md) -- Verify the default settings for ticket retrieval or modify the scheduling as needed. This step permits you to filter your ticket retrieval based on a date range and a polling interval.\n            - [Automate ticket updates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-create-profile-additional.md) -- The Secureworks CTP ticket ingestion integration has a bi-directional interface that allows for both tickets to create security incidents, as well as an ability to update the tickets once the security incident is created and/or closed with relevant incident details such as security incident number, assignment group, security incident URL, and so on.\n          - [Optional: Copy a Secureworks CTP profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-copy-profile.md) -- Copy an existing profile and its associated settings instead of creating new profiles. If you are creating multiple profiles, and you want to reuse the settings of an existing profile, you may prefer to copy profiles to save time.\n          - [Post ingestion form updates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-sir-changes.md) -- After a Secureworks CTP ticket has been ingested, a security incident is created and the corresponding updates are made to the security incident record.\n          - [View Secureworks ticket](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-view-tickets.md) -- The imported Secureworks CTP tickets are initially stored in the Ticket Import table. View all the Secureworks CTP tickets that have been imported before any filter conditions are applied.\n            - [Secureworks CTP Master Ticket Closure Notice](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-master-ticket-closure.md) -- Before you close a security incident created by a Secureworks CTP master ticket, you must verify that all child tickets associated with the master ticket are closed.\n          - [Configuration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secureworks-ctp-integration-settings.md) -- Use this option to modify the Secureworks CTP ticket ingestion integration default system properties.\n        - [Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/cortex-xsiam-siem.md) -- Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks ingests Alerts and Incidents from Cortex XSIAM into ServiceNow's Security Incident Response platform, enabling seamless post-incident management while maintaining bi-directional status and work note synchronization.\n          - [Install and Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-cortex-xsiam-siem.md) -- Install and configure Palo Alto Networks XSIAM integration for Security Operations application from the ServiceNow Store on your ServiceNow AI Platform instance.\n          - [Create an incident profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/pan-cortex-xsiam-profile.md) -- Determine the Cortex XSIAM incidents that are suitable for creating security incidents by creating an incident profile in your ServiceNow AI Platform instance.\n          - [Set Alert Sources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/pan-cortex-xsiam-rules.md) -- Select Alert Sources to map corresponding incidents to a security incident. Alert Sources are refreshed every time a profile is opened and new rules are available for selection. The Cortex XSIAM integration supports multiple profiles.\n          - [Map incident fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/pan-cortex-xsiam-mapping.md) -- Map Cortex XSIAM Incident, Alert, and Event Fields to SIR Incident Target Fields.\n          - [Define filter and aggregation criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/xsiam-filtering-and-aggregation.md) -- Define and set filter conditions to specify which incoming Cortex XSIAM Incidents should create security incidents. You can also define additional Incident field criteria that allows an incoming Incident to be appended to an open security incident instead of creating an incident.\n            - [Set filtering conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/xsiam-filtering-and-aggregation.md) -- Define and set filter conditions to specify which incoming Cortex XSIAM Incidents should create security incidents. You can also define additional Incident field criteria that allows an incoming Incident to be appended to an open security incident instead of creating an incident.\n            - [Define aggregation conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/xsiam-filtering-and-aggregation.md) -- Define and set filter conditions to specify which incoming Cortex XSIAM Incidents should create security incidents. You can also define additional Incident field criteria that allows an incoming Incident to be appended to an open security incident instead of creating an incident.\n          - [Schedule incident retrieval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/pan-xsiam-schedule-inc-retrieval.md) -- Configure a schedule to define how and when you pull incidents from Cortex XSIAM tenant.\n          - [Automate incident updates and closures](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/pan-xsiam-automate-inc-updates.md) -- Automate incident updates and closures based on the incident status. The Cortex XSIAM integration enables incidents to create security incidents and also to update the incidents after they are created or closed.\n        - [Security Incident Response integration with Zscaler](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/zscaler-integration-for-security-operations.md) -- You can use the Security Incident Response integration with Zscaler product to connect your Zscaler Internet Access server (ZIA) logs with the ServiceNow AI Platform. This integration enables you to view dashboards, create custom alerts, and help you investigate security incidents.\n          - [Get started](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-started-with-zscaler.md) -- Activate and set up the Zscaler Internet Access product to interface with your ServiceNow AI Platform instance and Security Incident Response product.\n          - [Configure access to APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-zscaler-api-access.md) -- Configure access to the Zscaler Internet Access server to authenticate the secure connection between the ServiceNow AI Platform instance and the Zscaler server.\n          - [Configure integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/install-zscaler-integration-for-security-operations.md) -- Install and configure the Security Incident Response integration with Zscaler internet Access product from the ServiceNow Store to start using the integration on your ServiceNow AI Platform instance.\n          - [Add Zscaler Internet Access URL category lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-zscaler-internet-access-url-category-manually.md) -- Add the URL categories that are available in the Zscaler Internet Access product to the ServiceNow AI Platform instance to specify an action for each URL so that you have easy access for granular filtering and policy creation.\n          - [Submit observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/submit-entries-from-a-security-incident-record-for-url-category-list.md) -- Submit observables that are attached to a security incident record to a configured URL category list by using the allow or block request. Adding observables to the allow or block list for security scans allows users to review content from these URLs and gain access to trusted content.\n          - [Approve observables to URL category lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/approve-url-category-list.md) -- Approve observables that are added to a URL Category List so that observable entries are in the appropriate allow or deny lists.\n          - [Submit the security incident to the Zscaler URL category list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manually-submit-the-security-incident-to-the-zscaler-url-category-list.md) -- Submit entries directly for observables that are not associated with a specific ServiceNow AI Platform security incident record so that observable entries are in the appropriate allow or deny lists.\n          - [Run threat lookup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/run-threat-lookup-using-zscaler-global-threat-library.md) -- Run a threat lookup on an observable by using the Zscaler Internet Access product’s global threat library. Zscaler supports lookups against observables type IPs, URLs, and domains.\n          - [Submit to Zscaler Sandbox analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/submit-to-zscaler-sandbox-analysis.md) -- Use the Zscaler Internet Access products sandbox service to analyzes files in a virtual environment to detect malicious behavior.\n          - [Set up email alerts for Patient 0 events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-up-email-for-patient-zero-alerts.md) -- Configure Zscaler Internet Access product to identify and scan for unknown, potentially malicious files, such as Patient 0 events so that you can protect your network from malicious files.\n        - [ServiceNow Security Operations add-on for Splunk overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/secops-integration-with-splunk.md) -- The ServiceNow Security Operations add-on for Splunk allows a Splunk software administrator to collect data and create incidents and events in the ServiceNow AI Platform.\n          - [Setup Splunk environment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/setup-chg-instance.md) -- ServiceNow Security Operations Integration enables seamless integration between Splunk and ServiceNow Security Operations. To set up or change the ServiceNow instance where new security incidents and security events are created, use the setup action in the application list.\n            - [Configure Application Registry](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-application-registry-splunk.md) -- Register the application with the instance to use OAuth authorization.\n            - [Using Splunk add-on](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/using-sn-secops-int-addon.md) -- Create security events and incidents directly from Splunk alerts after setting up ServiceNow Security Operations Integration add-on.\n          - [Manual search commands](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manual-search-commands.md) -- Manual search commands are entered from any Search window. You can create a security incident or event. After the command, there are pairs of field names and values used to create the desired record.\n            - [Security event](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manual-search-commands.md) -- Manual search commands are entered from any Search window. You can create a security incident or event. After the command, there are pairs of field names and values used to create the desired record.\n            - [Security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/manual-search-commands.md) -- Manual search commands are entered from any Search window. You can create a security incident or event. After the command, there are pairs of field names and values used to create the desired record.\n          - [Splunk event actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/event-actions.md) -- When reviewing Splunk logs, you can rapidly create security events and security incidents from any item in the log using the Event Actions.\n          - [Single-record Splunk alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/alerts.md) -- Within any alert, you can specify security events or security incidents to be created when the alert is fired.\n          - [Multiple-record, custom field Splunk alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/multiple-record-splunk-alerts.md) -- Multi-record alerts (defined using the Create Multiple ServiceNow Security Incidents and Create Multiple ServiceNow Security Events trigger actions) can automatically create records with any set of fields supported.\n            - [Create a multi-record, custom field Splunk alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/create-multi-record-alert.md) -- To create a multiple record Splunk alert with custom fields, you must build a search that is designed to match the ServiceNow columns you want to populate.\n            - [Multi-record, custom field Splunk alert examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/multi-record-examples.md) -- When you are creating multiple record Splunk alerts with custom fields, you need to define search criteria for generating alert data. Examples of search criteria for security incidents and security events are shown.\n          - [Splunk error reporting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-error-rpting.md) -- Whenever a connectivity issue with your ServiceNow instance occurs, an error is logged in Splunk with information describing the problem.\n        - [Splunk Enterprise Event Ingestion integration for Security Operations by ServiceNow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-overview.md) -- The Splunk Enterprise event and alert data integration with the Security Incident Response (SIR) product allows security incident analysts to collect and process security logs and related event data.\n          - [Set up](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-setup-sn.md) -- The following section lists the setup tasks that you are required to complete in your ServiceNow AI Platform instance prior to installing the application from the ServiceNow Store.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-install-and-configure.md) -- Install and configure Splunk Enterprise security- Event Ingestion integration from the ServiceNow Store on your ServiceNow AI Platform instance.\n            - [Configure settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-splunk-enterprise-event-ingestion-settings.md) -- Use the Splunk Enterprise Event Ingestion settings to modify the preset configurations and their values as per your requirements.\n          - [Create an event profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-create-profile.md) -- Create an event profile in your ServiceNow AI Platform instance and determine which Splunk alerts create security incidents.\n            - [Select scheduled alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-alert-selection.md) -- After you have created a profile for a scheduled alert, select a Splunk alert for this profile that you want to map to a ServiceNow AI Platform Security Incident Response security incident.\n            - [Map event fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-mapping.md) -- After you identify the sources for scheduled alert ingestion or manual event forwarding, the next step is to map individual event fields to the fields on a ServiceNow AI Platform Security Incident Response (SIR) security incident.\n            - [Map alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-map-alerts.md) -- During the event field-mapping step, you map individual event fields from triggered alerts or imported event data to fields on a ServiceNow AI Platform Security Incident Response (SIR) security incident.\n            - [Preview security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-preview.md) -- After you complete the mapping step, preview the values that you mapped in a ServiceNow AI Platform Security Incident Response (SIR) security incident. This preview step permits you to verify that you have mapped all the alert fields that you want displayed on the security incident.\n            - [Schedule and retrieve alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-schedule.md) -- For automated alert ingestion profiles, this step is final step of the event profile configuration. During this step, you can verify the default settings for alert retrieval or modify the scheduling as needed. This step permits you to filter your alert retrieval based on a date range.\n          - [Integration architecture and external systems connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-integration-architecture.md) -- The following topic outlines the integration architecture developed to support the ingestion of triggered alerts from the Splunk Enterprise console. This information clarifies, at a high level, the conceptual operation of the integration. It also explains why there are setup steps that are required prior to installing the application from the ServiceNow Store.\n            - [Copy Splunk profiles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/export-and-import-splunk-event-profile-data.md) -- You can export and import Splunk Enterprise Event Ingestion profiles settings from one ServiceNow AI Platform instance to a different ServiceNow AI Platform instance.\n            - [Copy an event profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-copy-a-profile.md) -- Copy an existing profile and its associated settings instead of creating new profiles. If you're creating multiple profiles, and you want to reuse the settings of an existing profile, you might prefer to copy alarm profiles to save time.\n            - [Set up Splunk environment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-setup-prereqs.md) -- Install and set up the ServiceNow Event Ingestion Integration add-on in your Splunk enterprise console or Splunk Cloud instance.\n            - [Use Splunk add-on](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/use-v2-addon.md) -- Map alerts from Splunk console to create a Security Incident Response (SIR) on the ServiceNow instance.\n            - [Save search in console](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest_save_search.md) -- The following steps for saving searches in your Splunk Enterprise console are provided for a user with the Splunk Enterprise administrator role.\n            - [Format alert values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest_script_editor.md) -- Use the script editor to format field values on the security incident during the mapping step.\n            - [Checklist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest_checklist.md) -- Use this checklist to guide you through all the tasks of the integration. The following checklist includes setup and installation tasks and examples of use cases that include expected results for the integration.\n        - [Splunk Enterprise Security event ingestion integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-overview-security.md) -- The Splunk Enterprise Security notable event ingestion integration with the Security Incident Response (SIR) product allows security incident analysts to collect and process notable event data (referred to as notables).\n          - [Glossary](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-integration-architecture-security.md) -- This section describes some of the key terms used in this integration.\n          - [Set up instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-setup-sn-security.md) -- The following section lists the setup tasks that you are required to complete in your ServiceNow AI Platform instance prior to installing the application from the ServiceNow Store.\n          - [Install and configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-install-and-configure-security.md) -- Install and configure Splunk Enterprise Security Notable Event Ingestion integration for Security Operations application from the ServiceNow Store on your ServiceNow AI Platform instance.\n            - [Security settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/configure-splunk-enterprise-security-settings.md) -- Use the Splunk Enterprise Security (ES) settings to modify the preset configurations and their values as per your requirements.\n            - [Authentication errors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunkes-auth-errors-security.md) -- This section describes some common authentication errors and how they can be resolved.\n          - [Create an event profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-create-profile-security.md) -- You create an event profile in your ServiceNow AI Platform instance and determine which Splunk notable events create security incidents.\n            - [Set up a profile for scheduled notable event ingestion](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-scheduled-security.md) -- Depending on the profile defined, Splunk ES notable events are automatically ingested into the Security Operations environment of your ServiceNow AI Platform instance.\n              - [Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-create-profile-sched-security.md) -- You can set up a profile so that notable events are automatically ingested.\n              - [Set Correlation rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-alert-selection-security.md) -- After you have created a profile for a scheduled notable event type ingestion, select a Splunk Enterprise Security correlation rule name for this profile for which you want to map corresponding notable events to a ServiceNow AI Platform Security Incident Response security incident.\n              - [Explore Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest_mapping-security.md) -- After you identify the specific correlation rule and notable event type for the profile, the next step is to map individual notable event fields to the fields on a ServiceNow AI Platform Security Incident Response (SIR) security incident.\n              - [Map notable events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-map-alerts-security.md) -- During the notable event field-mapping step, you map individual event fields from notable events to fields on a ServiceNow AI Platform Security Incident Response (SIR) security incident.\n              - [Preview security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-preview-security.md) -- After you complete the mapping step, preview the values that you mapped in a ServiceNow AI Platform Security Incident Response (SIR) security incident. This preview step permits you to verify that you have mapped all the notable fields that you want displayed on the security incident.\n              - [Schedule and retrieve notable events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-schedule-security.md) -- For automated notable event ingestion profiles, this step is required in the event profile configuration. During this step, you can verify the default settings for notable event retrieval or modify the scheduling as needed. This step also permits you to retrieve historical notable events using a date range.\n              - [Automate notable event updates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-additional-security.md) -- Security incidents can be created and updated after they are created with a bi-directional interface with the Splunk Enterprise Security integration.\n            - [Set up a profile for manual event forwarding](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-manual-security.md) -- Depending on the profile defined, Splunk ES notable events are forwarded manually as discrete notable events into the Security Operations environment of your ServiceNow AI Platform instance.\n              - [Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-create-profile-manual-security.md) -- You can set up a profile for manual forwarded events.\n              - [Map notable event fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-map-manual-security.md) -- During the notable event field mapping step, you map individual event fields from notable events to fields on a ServiceNow AI Platform Security Incident Response (SIR) security incident.\n          - [Set up Splunk environment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-es-addon.md) -- The ServiceNow Security Operations Event Ingestion Add-on for Splunk ES enables seamless integration between Splunk and ServiceNow Security Operations, allowing you to send security-related events from Splunk to ServiceNow security incident. For detailed instructions on downloading and installing the Addon, follow the steps outlined in this guide.\n          - [Forward events on-demand](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/use-event-ingestion-addon.md) -- Forward events on-demand from your Splunk Enterprise Security console to create a Security Incident Response (SIR) on the ServiceNow instance.\n          - [Copy an event profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-copy-a-profile-security.md) -- Copy an existing profile and its associated settings instead of creating new profiles. If you are creating multiple profiles, and you want to reuse the settings of an existing profile, you may prefer to copy alarm profiles to save time.\n          - [Format alert values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest_script_editor-security.md) -- In addition to the directly mapped fields from the ingested notable event values, and the values you enter manually, use the script editor to format field values on the security incident during the mapping step.\n          - [Copy a Splunk ES profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/import-and-export-splunk-profile-data.md) -- You can export and import Splunk Enterprise Security profiles settings from one ServiceNow AI Platform instance to a different ServiceNow AI Platform instance.\n          - [Checklist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-event-ingest-checklist-security.md) -- Use this checklist to guide you through all the tasks of the integration. The following checklist includes setup and installation tasks and examples of use cases that include expected results for the integration.\n        - [Splunk - Incident Enrichment integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/splunk-in-enrich-landing-page.md) -- The Splunk - Incident Enrichment integration searches your logs and adds relevant sighting information to your security incidents.\n          - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-configure-splunk-inc-enric.md) -- Splunk software searches, monitors, and analyzes machine-generated big data and integrates easily with Security Operations. Before you can use the Splunk - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate API Base URL and login credentials.\n        - [SIR Integration References](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-integration-references.md) -- This section outlines the reference details for SIR integrations including the integration components and configuration settings.\n          - [Allow and Block Request List Entries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/allow-and-block-list-properties.md) -- Field descriptions for Allow and Block List properties outline how each field controls the behavior of observables when they are added to Allow or Block lists within the CrowdStrike Falcon Insight integration.\n          - [CrowdStrike Block Request Category List](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/block-req-category-list.md) -- Field descriptions for CrowdStrike Block Request Category List form.\n      - [Mobile Experience for Security Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir.md) -- Use your Android or iOS mobile device to manage your security operations center (SOC) tasks.\n        - [Set up checklist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir-setupinstll-mobile-app.md) -- The following checklist includes the set up tasks that you are required to complete in your ServiceNow AI Platform instance and on your mobile device prior to using the Security Incident Response Mobile app.\n        - [Log in to the Security Incident Response Mobile app](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir-get-started.md) -- Open the Security Incident Response Mobile app and add a ServiceNow AI Platform instance with Security Incident Response to your mobile device.\n        - [View, edit, and assign open security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir-open-incidents.md) -- As a security incident analyst, view, edit, and assign open Security Incident Response (SIR) security incidents from your mobile device. View related lists and the audit trail of work notes for more details about incidents.\n        - [View, edit, and reassign security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir-my-incidents.md) -- As a security incident analyst, view, edit, and reassign Security Incident Response (SIR) incidents that are assigned to you. View related lists and the audit trail of work notes for more details about incidents.\n        - [Update and assign unassigned security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir-unassigned-incdts.md) -- From your mobile device, view, edit, and assign unassigned Security Incident Response (SIR) incidents. View related lists and the audit trail of work notes for more details about incidents.\n        - [View, edit, and assign high priority incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir-high-priority-incndts.md) -- From your mobile device, view, edit, and assign high priority Security Incident Response (SIR) incidents. View related lists and the audit trail of work notes for more details about incidents.\n        - [Update high-risk security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir-risk-score.md) -- From your mobile device, view and edit Security Incident Response (SIR) incidents with a value in the risk score field that is greater than 60. View related lists and the audit trail of work notes for more details about incidents.\n        - [Search security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir-search.md) -- Search for Security Incident Response (SIR) security incidents on a ServiceNow AI Platform instance. Only incidents that match the specific search criteria that you enter are displayed.\n        - [View, edit, and assign open response tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir-response-tsks.md) -- View, edit, and assign open response tasks. Your changes are saved on the Security Incident Response Task of the parent security incident.\n        - [View, edit, and reassign response tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sir-my-response-tsks.md) -- View, edit, and reassign response tasks that are assigned to you. Your changes are saved on the Security Incident Response Task of the parent security incident.\n        - [Filter records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/mobile-sire-filters.md) -- Set additional filters to limit the number of records that are displayed on a screen. Filtering records in the mobile app works like filtering with a condition builder on the ServiceNow AI Platform.\n      - [Security Incident Response Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/c_SecIncRespOrchestration.md) -- Security Incident Response Orchestration activities allow users to interact with and retrieve data from Windows or UNIX-based systems and environments using workflow orchestration.\n        - [Set up Security Incident Response Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_SecInRespOrchSetup.md) -- Prior to using Security Incident Response Orchestration, perform steps to set up various parts of the system, including populating the CMDB, configuring the mid-server, and configuring credentials.\n        - [Understand Security Incident Response Orchestration workflows and workflow templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/view-wf-templates.md) -- The Security Incident Response base system includes a series of workflows and workflow templates designed to work with security incident records.\n          - [Security Incident Response Orchestration workflows and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sec-inc-resp-orchestration-workflows.md) -- Several workflows and activities are included with Security Incident Response Orchestration.\n            - [Create Lookup Request for IoC Changes workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/t_CreateScanRequestforIoCChanges.md) -- The Security Incident Response - Create Lookup Request for IoC Changes flow is triggered by the Lookup Security Incident Observables scheduled job to automatically look up IoCs that are added or changed. Malware scans are triggered only when new data is entered and only the new data is scanned.\n              - [Create IoC Lookup Request activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/r_CreateMalwareScanRequest.md) -- The Create IoC Lookup Request activity can be used with any workflow to create a malware lookup request for added or modified IoC fields.\n            - [Get Network Statistics flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/obtain-network-statistics-workflow.md) -- The Security Incident Response Get Network Statistics flow retrieves the network statistics for an affected Windows-based resource when added to a security incident in the Analysis state.\n            - [Get Running Services workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-running-services-workflow.md) -- The Security Incident Response - Get Running Services workflow retrieves a list of running services from Windows-based, ServiceNow, configuration items (CIs). This workflow is used for incident enrichment during investigations.\n              - [Determine Shell Script by OS activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/determine-shell-script-by-os-activity.md) -- The Determine Shell Script by OS workflow activity determines which operating system to use in the workflow\n              - [Get Running Services - WMI Enrichment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/get-running-services-via-pwrshell-activity.md) -- The Security Incident Response - Get Running Services workflow gathers running services on a configuration item added to a security incident.\n            - [Run procdump flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/invoke_procdump.md) -- The Run procdump flow runs a process dump on a specified process and saves it to a file that can be targeted by security analysts.\n              - [Execute procdump action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/execute_procdump.md) -- Execute procdump is a powershell action that runs the procdump on the selected processes, dumps the data into a file, and posts it to a shared site on an internal network. An analyst can then view a deny listed process, highlighted in red in a security incident, and perform additional analysis on the file.\n            - [Security Incident - Evaluate response task outcome workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-evaluate-response-task-outcome-workflow.md) -- Security Incident - Evaluate Response task outcome workflow determines the task to use, invokes a chosen workflow and evaluation script based on the outcome evaluator record provided as input to the chosen workflow.\n          - [Security Incident Response workflow templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/sir-orch-workflow-templates.md) -- Workflow templates are provided with Security Incident Response Orchestration to allow you to perform basic security operation-related analysis procedures. The templates can be used as is or you can customize them to create workflows to better suit your specific needs. The workflow templates are deactivated by default.\n            - [Security Incident Confidential Data Exposure workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-confidential-data-exposure-template.md) -- The Security Incident - Confidential Data Exposure - Template allows you to perform a series of tasks designed to handle the exposure of sensitive data.\n            - [Security Incident Denial of Service workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-denial-of-service-template.md) -- The Security Incident - Denial of Service - Template allows you to perform a series of tasks designed to handle Denial of Service (DOS) attacks.\n            - [Security Incident Lost Equipment workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-lost-equip-template.md) -- The Security Incident - Lost Equipment - Template allows you to perform a series of tasks designed to handle lost equipment.\n            - [Security Incident Malicious Software workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-malic-sftwr-template.md) -- The Security Incident - Malicious Software - Template allows you to perform a series of tasks designed to handle malicious software on your network.\n            - [Security Incident Phishing workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-phishing-template.md) -- The Security Incident - Phishing - Template allows you to perform a series of tasks designed to handle spear phishing emails on your network.\n            - [Security Incident Policy Violation workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-policy-violation-template.md) -- The Security Incident - Policy Violation - Template allows you to perform a series of tasks designed to handle security policy violations.\n            - [Security Incident Reconnaissance workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-recon-wf-template.md) -- Reconnaissance is usually a preliminary step toward a further attack seeking to exploit a device or system. The Security Incident - Reconnaissance - Template allows you to perform a series of tasks designed to handle reconnaissance on your network.\n            - [Security Incident Rogue Server or Service workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-rogue-wf-template.md) -- The Security Incident - Rogue Server or Service - Template allows you to perform a series of tasks designed to handle activity from rogue servers or services affecting your network.\n            - [Security Incident Spam workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-spam-template.md) -- The Security Incident - Spam - Template allows you to perform a series of tasks designed to handle email spam on your network.\n            - [Security Incident Unauthorized Access workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-unauth-access-wf-template.md) -- The Security Incident - Unauthorized Access - Template allows you to perform a series of tasks designed to handle unauthorized access to your network.\n            - [Security Incident Web/BBS Defacement workflow template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/si-web-defacement-template.md) -- The Security Incident - Web/BBS Defacement - Template allows you to perform a series of tasks designed to handle vandalism directed against one of your organization's BBS or web sites.\n    - [Threat Intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intel-landing-page.md) -- The ServiceNow Threat Intelligence application enables you to find indicators of compromise (IoC) and enrich security incidents with threat intelligence data.\n      - [Understanding Threat Intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/understanding-threat-intel.md) -- The Threat Intelligence application allows you to access and provide a point of reference for your company's Structured Threat Information Expression (STIX) data. Included in Threat Intelligence is the Security Case Management application, which provides a means for analyzing threats to your organization posed by targeted campaigns or state actors.\n        - [Domain separation and Threat Intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/domain-separation-threat-intelligence.md) -- Domain separation is supported in the Threat Intelligence module that is available as part of Security Incident Response. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n      - [Set up Threat Intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_GetStartedWithThreatIntel.md) -- Before you run Threat Intelligence in your instance, you must download it from the ServiceNow Store. You can also set up properties and define a threat source.\n        - [Install Threat Intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_GetStartedWithThreatIntel.md) -- Before you run Threat Intelligence in your instance, you must download it from the ServiceNow Store. You can also set up properties and define a threat source.\n          - [Components installed with Threat Intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_GetStartedWithThreatIntel.md) -- Before you run Threat Intelligence in your instance, you must download it from the ServiceNow Store. You can also set up properties and define a threat source.\n        - [Set Threat Intelligence properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_GetStartedWithThreatIntel.md) -- Before you run Threat Intelligence in your instance, you must download it from the ServiceNow Store. You can also set up properties and define a threat source.\n        - [Define a threat source](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_GetStartedWithThreatIntel.md) -- Before you run Threat Intelligence in your instance, you must download it from the ServiceNow Store. You can also set up properties and define a threat source.\n        - [Create a TAXII profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_GetStartedWithThreatIntel.md) -- Before you run Threat Intelligence in your instance, you must download it from the ServiceNow Store. You can also set up properties and define a threat source.\n      - [IoC Repository](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/ioc-repository.md) -- IoC repository contains STIX objects, each of these objects contain a specific piece of information.\n        - [Attack modes and methods](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_AttackModeMethod.md) -- Attack modes and methods, sometimes referred to as Tactics, Techniques, and Procedures (TTPs), are representations of how cyber adversaries behave. They characterize what these adversaries do and how they do it, in increasing levels of detail. Attack modes and methods apply for STIX 1.1.\n          - [Define an attack mode/method](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddAttackModeMethod.md) -- Attack modes and methods are imported with STIX data, but you can add new modes/methods, as needed.\n          - [Add an IoC to an attack mode/method](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddIoCToAttackMode.md) -- In addition to importing indicators as STIX data, you can add IoCs to an attack mode/method manually.\n          - [Add a related attack mode method](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddRelatedAttackMode.md) -- In addition to importing attack modes/methods as STIX data, you can add related attack modes/methods manually.\n          - [Add associated task to an attack mode/method](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddAssociatedTaskToAttackMode.md) -- In addition to importing associated tasks (such as changes and incidents) as STIX data, you can add them to an attack mode/method manually.\n        - [Indicators of compromise](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_IoCs.md) -- Indicators of Compromise (IoC) are artifacts observed on a network or operating system that are likely to indicate an intrusion. Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or domain names. IoC applies for STIX 1.1 and 2.x.\n          - [View an IoC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddIoCs.md) -- IoCs, sometimes referred to as indicators, are most typically retrieved from a threat data source as STIX data. If needed, you can also create IoCs.\n          - [Add a related observable to an IoC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddObservToIoC.md) -- In addition to importing observables as STIX data, you can add related observables to an IoC manually.\n          - [Add a related attack mode/method to an IoC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddRelatedAttackModeToIoc.md) -- In addition to importing related attack modes/methods as STIX data, you can add related attack modes/methods to an IoC manually.\n          - [Identify associated indicator types](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_IdentifyAssociatedIndicatorTypes.md) -- If an IoC has no associated indicator types defined, it tracks all types of observables. However, if you associate one or more types of indicators to an IoC, it limits the types of observables that can be associated with the IoC.\n          - [Identify indicator sources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_IdentifyIndicatorSources.md) -- Indicator sources are normally tracked automatically as part of the threat import process, but more sources can be manually added.\n          - [Add associated tasks to an IoC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddAssociatedTasksToIoC.md) -- In addition to importing associated tasks (such as changes and incidents) as STIX data, you can add them to an IoC manually.\n        - [Observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_Observables.md) -- Observables represent stateful properties (such as the MD5 hash of a file or the value of a registry key) or measurable events (such as the creation of a registry key or the deletion of a file) that are pertinent to the operation of computers and networks. Observables apply for STIX 1.1 and 2.x.\n          - [Define an observable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddObservable.md) -- Observables are retrieved from the vendor server as STIX data. However, you can create observables, as needed.\n          - [Add a related IoC to an observable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddIoCToObserv.md) -- In addition to importing observables as STIX data, you can add related observables to an IoC manually.\n          - [Add associated tasks to an observable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddAssociatedTasksToObservable.md) -- In addition to importing associated tasks (such as changes and incidents) as STIX data, you can add them to an observable manually.\n          - [Add a related observable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_AddRelatedObservable.md) -- In addition to importing observables as STIX data, you can add related observables manually.\n          - [Load more IoC data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_LoadAdditionalIoCData.md) -- Depending on settings in two properties and a script include definition, you can load geolocation information for IP addresses and websites in the Observables form. With further customization, you can also add other information, such as country codes, city names.\n          - [Identify observable sources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_IdentifyObservbleSources.md) -- If an observable has no sources defined, it uses all types of sources. However, if you add one or more threat sources to an observable, it limits the sources used.\n          - [Perform lookups on observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/perform-lookups-on-observables.md) -- You can perform threat intelligence lookups on one or more observables to determine whether they’re associated with known security threats. The scanning implementations that run depend on the ones you’ve activated.\n          - [Perform threat enrichment on observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/perform-enrich-on-observs.md) -- You can perform threat intelligence enrichment on one or more observables to determine whether they’re associated with known security threats. The implementations that run depend on the ones you’ve activated.\n        - [Attack patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/attack-patterns.md) -- Attack patterns are a type of Tactics, Techniques, and Procedures (TTPs) that describe the methods that adversaries attempt to compromise targets. Attack Patterns apply for STIX 2.x.\n          - [Define an attack pattern](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-attack-pattern.md) -- Define an attack pattern to help categorize attacks.\n        - [Campaigns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-campaigns.md) -- A Campaign is a grouping of adversarial behaviors. These behaviors describe a set of malicious activities or attacks that occur over time against a specific set of targets. Campaigns apply for STIX 2.x.\n          - [Define a campaign](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-campaign.md) -- Define a campaign to group adversarial behaviors.\n        - [Course of actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-course-actions.md) -- A course of action is an action taken either to prevent an attack or to respond to an attack that is in progress. Course of actions apply for STIX 2.x.\n          - [Define a course of action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-course-action.md) -- Define a course of action to prevent an attack or to respond to an attack that is in progress.\n        - [Identities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-identities.md) -- Identities represent actual individuals, organizations, or groups (ACME, Inc.) and classes of individuals, systems, or groups (the finance sector). Identities apply for STIX 2.x.\n          - [Define identities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-identities.md) -- Define identities who represent actual individuals, organizations, or groups.\n        - [Infrastructure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-infrastructure.md) -- The Infrastructure SDO represents a type of Tactics, Techniques, and Procedures (TTPs). They describe any systems, software services, and any associated physical or virtual resources intended to support some purpose of an attack. Infrastructure applies for STIX 2.x.\n          - [Define infrastructure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-infrastructure.md) -- Define an Infrastructure that is any systems, software services, and any associated physical or virtual resources intended to support some purpose of an attack.\n        - [Intrusion set](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-intrusion-sets.md) -- An Intrusion Set is a grouped set of adversarial behaviors and resources with common properties. An Intrusion Set usually involves a single organization. Intrusion set applies for STIX 2.x.\n          - [Define an intrusion set](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-intrusion-set.md) -- Define an intrusion set that is a grouped set of adversarial behaviors and resources with common properties.\n        - [Locations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-locations.md) -- A Location represents a geographic location. Locations are primarily used to give context to other SDOs. Locations apply for STIX 2.x.\n          - [Define Location](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-location.md) -- Define a geographic location to provide more context to other SDOs.\n        - [Malware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-malware.md) -- Malware is a type of TTP that represents malicious code. It refers to a program that is covertly inserted into a system. Malware applies for STIX 2.x.\n          - [Define a Malware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-malware.md) -- Define a malware that represents malicious code.\n        - [Malware analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-malware-analysis.md) -- Malware Analysis captures the metadata and results of a malware. Malware analysis applies for STIX 2.x.\n          - [Define malware analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-malware-analysis.md) -- Define malware analysis that captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.\n        - [Observed data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-observed-data.md) -- Observed Data conveys information about cyber security-related entities such as files, systems, and networks using the STIX Cyber-observable Objects (SCOs). Observed data applies for STIX 2.x.\n          - [Define observed data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/observed-data.md) -- Define observed data that conveys information about cyber security-related entities such as files, systems, and networks using the STIX Cyber-observable Objects (SCOs).\n        - [Threat actors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-actors.md) -- Threat Actors are individuals, groups, or organizations who act with malicious intent. Threat actors applies for STIX 2.x.\n          - [Define threat actors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-threat-actors.md) -- Define threat actors who are individuals, groups, or organizations who act with malicious intent.\n        - [Threat groupings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-groupings.md) -- A Threat Groupings object explicitly asserts that the referenced STIX Objects have a shared context. Threat groupings applies for STIX 2.x.\n          - [Define threat groupings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-threat-groupings.md) -- Define threat groupings as objects that have a shared context.\n        - [Marking definitions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/marking-definitions.md) -- The marking definitions object represents a specific marking.\n          - [Define marking definitions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-marking-definitions.md) -- Define marking definitions that represent a specific data marking.\n        - [Threat notes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-threat-notes.md) -- A Threat Note conveys informative text to provide additional analysis not contained in the STIX Objects, Marking Definition objects, or Language Content objects which the Note relates to. Threat notes applies for STIX 2.x.\n          - [Define threat notes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-threat-notes.md) -- Define threat notes that convey information to provide further context or analysis that is not available in existing objects.\n        - [Threat opinions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-opinions.md) -- An Opinion is an assessment of the accuracy of the information in a STIX Object produced by a different entity. Threat opinions apply for STIX 2.x.\n          - [Define threat opinions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-threat-opinions.md) -- Define threat opinions as an assessment of the accuracy of the information in a STIX object.\n        - [Threat reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-reports.md) -- Threat Reports are collections of threat intelligence focused on one or more topics. Threat reports apply for STIX 2.x.\n          - [Define threat reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-threat-reports.md) -- Define threat reports that describe a threat actor, malware, attack technique, including context and related details.\n        - [Sightings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/indicator-sightings.md) -- Sightings denote that an indicator or object was seen. Objects may be a malware, tool, threat actor, and so on.\n          - [Define indicator sightings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-indicator-sightings.md) -- Define sightings that denote that an indicator was seen.\n          - [Define object sightings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-object-sightings.md) -- Define object sighting that describes that an object (malware, tool, threat actor, and so on) was seen.\n        - [Tools](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/tools.md) -- Tools are legitimate software that are used by threat actors to perform attacks. Tools apply for STIX 2.x.\n          - [Define tools](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-tools.md) -- Define tools as legitimate software that is used to perform attacks.\n        - [Vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vulnerabilities.md) -- A Vulnerability is a weakness or defect in a software or hardware component that attackers exploit. Vulnerabilities apply for STIX 2.x.\n          - [Define vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-vulnerabilities.md) -- Define vulnerability as a weakness or defect in a software or hardware component that attackers exploit.\n        - [Relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/stix-relationships.md) -- Use the relationship objects to link together two SDOs or STIX Cyber-observable Objects (SCOs) to describe how they relate to each other.\n          - [Define object-object relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-object-object.md) -- Define relationships between SDOs, except the indicator object.\n          - [Define object-indicator relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-object-indicator.md) -- Define relationships between the indicator object and other SDOs.\n          - [Define object-observable relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-object-observable.md) -- Define relationships between SDOs and the observable object (SCO).\n        - [STIX Visualizer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/stix-visualizer.md) -- The STIX Visualizer visually represents the structure of the STIX object and its relationship.\n      - [MITRE-ATT&CK framework overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/about-mitre-attack.md) -- The MITRE-ATT&CK framework is a knowledge base of common tactics, techniques, and procedures (TTP) that your organization can access to develop specific threat models and methodologies against cyberattacks.\n        - [MITRE-ATT&CK administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-att-ck-administration.md) -- You can set up, map data sources, map overall technique detection coverage, and maintain the MITRE-ATT&CK repository in the ServiceNow AI Platform.\n          - [Get started with MITRE-ATT&CK framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-started-with-mitre.md) -- Review the following information before you start setting up your MITRE-ATT&CK framework.\n          - [Understand the MITRE to STIX data model](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/understand-the-mitre-to-stix-data-model-mapping.md) -- Review the terminology used by MITRE and STIX to efficiently use and understand the MITRE-ATT&CK framework in the ServiceNow AI Platform.\n          - [Domain separation and MITRE-ATT&CK](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/domain-separation-and-mitre-att-ck.md) -- This domain separation overview pertains to MITRE-ATT&CK. Domain separation allows you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.\n          - [Set up the MITRE-ATT&CK framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/setup-mitre-profile.md) -- Activate the MITRE-ATT&CK profile, and set up a scheduled job so that you can set up MITRE-ATT&CK collections for threat detection in your organization.\n          - [Manage matrices](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-mitre-collection.md) -- Manage the matrices that have been imported from the MITRE TAXII collections. Matrices are a collection of tactics and techniques. You can view the matrices to review if your collections are available in the MITRE-ATT&CK repository.\n          - [Manage techniques](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-techniques.md) -- Manage the techniques that have been imported from the MITRE TAXII collections. The techniques contain various ways attackers have developed to employ a given tactic. You can review and deactivate techniques that aren't relevant to your organization. In STIX, techniques are known as attack patterns.\n          - [Manage mitigations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/manage-mitigations.md) -- Manage the mitigations that have been imported from the MITRE TAXII collections. Mitigations enable you to prevent an adversary from successfully executing techniques or sub-techniques against your organization. In STIX, mitigations are known as course of actions.\n          - [Manage groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/manage-groups-threat-intel.md) -- Manage the groups that have been imported from the MITRE TAXII collections. Groups are sets of related intrusion activity that are tracked by a common name in the security community. Analysts track clusters of activities using various terms such as threat groups, activity groups, threat actors, intrusion sets, and campaigns. In STIX, groups are known as intrusion sets.\n          - [Manage malware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/manage-malware.md) -- Manage the malware information that you imported from the MITRE TAXII collections. Malware is a type of TTP that represents malicious code. It refers to a program that is covertly inserted into a system. The intent of a malware is to compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS).\n          - [Manage tools](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/manage-tools.md) -- Manage the tools information that you imported from the MITRE TAXII collections. Tools are legitimate software that are used by threat actors to perform attacks.\n          - [Manage MITRE relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/manage-mitre-relationships.md) -- Manage the MITRE relationships information that you imported from the MITRE TAXII collections.\n          - [Manage CVE and technique mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/manage-cve-and-technique-mapping.md) -- Manage the CVE and technique information that is mapped after you import the MITRE TAXII collections.\n          - [Extend the MITRE-ATT&CK data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-and-extend-information.md) -- Extend the MITRE-ATT&CK repository data in the ServiceNow AI Platform by enriching it.\n          - [Define the data source and detection tool mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/manage-mitre-att-ck-data-sources.md) -- Define the data source and detection tool mapping for MITRE-ATT&CK tactics and techniques. This mapping provides the insight into the relevance and availability of the data sources and the detection tools for monitoring the data sources in your environment.\n          - [Define the data source and data component mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/map-the-data-source-and-data-components.md) -- Use the Data Component Mapping if you are using the latest TAXII collections, and you want to maintain a relationship between the data sources, data components, and the various techniques. Map the data sources with the additional context of data components that provides an extra sublayer of context to data sources that enable you to understand adversary behaviors in MITRE-ATT&CK better.\n          - [Define the technique detection coverage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-technique-coverage.md) -- Define the technique detection coverage that your organization must measure and detect specific adversary techniques.\n            - [MITRE-ATT&CK Scoring definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/scoring-definition.md) -- Define your organization's MITRE-ATT&CK scoring system so that you can measure how effectively your organization can detect specific adversary techniques.\n          - [Map your technique detection coverage to a technique](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/map-technique-coverage.md) -- Map your overall technique detection coverage with the technique that enables your organization to detect specific adversary techniques.\n          - [Define the mitigation coverage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/define-the-mitigation-coverage.md) -- Define mitigation coverage per technique to gain visibility into how well your organization can prevent related attacks.\n            - [Technique mitigation coverage definitions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/technique-mitigation-coverage-definitions.md) -- Define your organization's mitigation coverage so that you can effectively measure and detect specific adversary techniques.\n          - [Map your mitigation coverage to a technique](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/map-your-mitigation-coverage-to-a-technique.md) -- Map your mitigation coverage with the technique that enables you to detect your organization's overall mitigation strategy.\n            - [Overall technique mitigation coverage calculator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitigation-coverage-calculator.md) -- The overall technique mitigation coverage is determined based on the formula defined in the mitigation coverage calculator.\n          - [Create and map detection rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-detection-rules.md) -- Create detection rules and map them against the tactics and techniques. With this mapping, you can see the coverage for the detection rules in your organization.\n          - [Auto-extract technique rules for importing MITRE-ATT&CK information](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/auto-extract-technique-rules.md) -- Use the base system auto-extraction rules to import the MITRE-ATT&CK information from any existing third-party integrations.\n            - [Use threat-lookup auto-extraction rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/auto-extract-technique-rules.md) -- Use the base system auto-extraction rules to import the MITRE-ATT&CK information from any existing third-party integrations.\n            - [Use SIEM auto-extraction rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/auto-extract-technique-rules.md) -- Use the base system auto-extraction rules to import the MITRE-ATT&CK information from any existing third-party integrations.\n          - [Review threat group and MITRE-ATT&CK techniques mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/review-threat-group-and-techniques-mapping.md) -- Review the threat group and techniques object to object relationship mapping information that is imported from the MITRE TAXII collections. This mapping enables you to view the technique group and the corresponding technique mapping.\n          - [Threat group to technique heatmap definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-group-to-technique-heatmap-definition.md) -- Define the threat group to technique heatmap definition so that on the heatmap you can measure and detect the attack patterns that threat groups are using to attack your organization. The probability of an attack using a particular technique increases when you have a high number of attackers.\n          - [Review the MITRE-ATT&CK system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-mitre-att-ck-properties.md) -- Review the MITRE-ATT&CK system property values.\n        - [Using MITRE-ATT&CK to detect and analyze threats](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-att-ck-features.md) -- Use the MITRE-ATT&CK framework across the Threat Intelligence and the SIR module to detect and analyze threats to your organization.\n          - [Associate MITRE-ATT&CK information with security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/associate-mitre-with-sir.md) -- Associate the MITRE-ATT&CK tactics and techniques to the security incident for better security incident and threat analysis.\n            - [Associate MITRE-ATT&CK information with closed security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/associate-mitre-with-sir.md) -- Associate the MITRE-ATT&CK tactics and techniques to the security incident for better security incident and threat analysis.\n            - [View related information using MITRE-ATT&CK Card](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/associate-mitre-with-sir.md) -- Associate the MITRE-ATT&CK tactics and techniques to the security incident for better security incident and threat analysis.\n          - [Associate MITRE-ATT&CK information with observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/associate-mitre-observables.md) -- Associate MITRE-ATT&CK tactics and techniques to an observable for better security incident and threat analysis at a granular level.\n          - [Associate MITRE-ATT&CK information with security case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/associate-mitre-att-ck-information-with-security-case-management.md) -- Associate MITRE-ATT&CK tactics and techniques to a security case for better security case management and threat analysis at a granular level.\n          - [Rollup MITRE-ATT&CK information using Threat Lookup results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/rollup-threat-lookup-results.md) -- If you have not enabled automatic rollup of MITRE-ATT&CK information, you can do this manually.\n          - [Rollup MITRE-ATT&CK information from detection rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/rollup-mitre-attack-information-detection-rules.md) -- Enable rollup of MITRE-ATT&CK information from the detection rules to the security incidents for better security incident and threat analysis.\n          - [Rollup MITRE-ATT&CK information from child security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/rollup-mitre-att-ck-information-from-child-security-incidents.md) -- If you have not enabled automatic rollup of MITRE-ATT&CK information or MITRE ATLAS information, you can do this manually.\n          - [Perform link analysis and threat hunting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/link-analysis-threat-hunt-mitre.md) -- Correlate and perform link analysis of observables, security incidents, and MITRE-ATT&CK related information so that your organization can start hunting for threats.\n          - [MITRE-ATT&CK heat map and navigator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-att-ck-heatmap-and-navigator.md) -- You can use the MITRE-ATT&CK heat map and navigator for basic navigation and to visualize your overall technique detection coverage.\n            - [Access the MITRE-ATT&CK heat map and navigator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-att-ck-heatmap-and-navigator.md) -- You can use the MITRE-ATT&CK heat map and navigator for basic navigation and to visualize your overall technique detection coverage.\n            - [Using the custom views](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-att-ck-heatmap-and-navigator.md) -- You can use the MITRE-ATT&CK heat map and navigator for basic navigation and to visualize your overall technique detection coverage.\n            - [Navigator with primary filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-att-ck-heatmap-and-navigator.md) -- You can use the MITRE-ATT&CK heat map and navigator for basic navigation and to visualize your overall technique detection coverage.\n            - [Using a heat map with primary and advanced features](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-att-ck-heatmap-and-navigator.md) -- You can use the MITRE-ATT&CK heat map and navigator for basic navigation and to visualize your overall technique detection coverage.\n          - [Using the MITRE-ATT&CK dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-dashboards.md) -- The MITRE-ATT&CK dashboard provides an executive view of the data source coverage, tactics, and techniques that are used in your organization.\n            - [Use the MITRE-ATT&CK dashboard to see your security-related data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-dashboards.md) -- The MITRE-ATT&CK dashboard provides an executive view of the data source coverage, tactics, and techniques that are used in your organization.\n            - [MITRE-ATT&CK widgets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-dashboards.md) -- The MITRE-ATT&CK dashboard provides an executive view of the data source coverage, tactics, and techniques that are used in your organization.\n      - [MITRE D3FEND framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-d3fend-framework.md) -- MITRE D3FEND is a knowledge graph of cybersecurity countermeasure techniques that complements the MITRE-ATT&CK framework by providing defensive techniques.\n        - [Ingest MITRE D3FEND data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/ingest-mitre-defend-data.md) -- Ingest MITRE D3FEND data (tactics, techniques, and artifacts) from the MITRE website to integrate with the Security Incident Response application.\n        - [MITRE D3FEND tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-defend-tables.md) -- MITRE D3FEND integration uses various tables to capture data.\n      - [MITRE ATLAS framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/about-mitre-atlas.md) -- The MITRE ATLAS framework documents adversarial tactics and techniques targeting AI (artificial intelligence) and ML (machine learning) systems, complementing traditional IT security frameworks.\n        - [Activate the MITRE ATLAS framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/setup-mitre-atlas-profile.md) -- Activate the MITRE ATLAS profile to ingest MITRE ATLAS data for threat detection in AI and machine learning systems.\n        - [Review the MITRE ATLAS system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-mitre-atlas-properties.md) -- Review the MITRE ATLAS system property values to configure how ATLAS information is handled in security incidents.\n        - [View MITRE ATLAS information in the MITRE Card](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/mitre-atlas-card.md) -- The MITRE Card displays MITRE ATLAS technique information that has been aggregated from threat lookups, observables, or SIEM integrations associated with a security incident.\n        - [Associate MITRE ATLAS information with security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/associate-mitre-atlas-with-sir.md) -- Associate MITRE ATLAS tactics and techniques with a security incident for better security incident and threat analysis.\n        - [Map data sources and detection tools for MITRE ATLAS](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/manage-mitre-atlas-data-sources.md) -- Map detection tools to MITRE ATLAS techniques and tactics to identify monitoring capabilities for your organization.\n        - [View and activate a MITRE ATLAS matrix](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/manage-mitre-atlas-matrices.md) -- View the tactics and techniques in an imported MITRE ATLAS matrix to understand available threat intelligence data. You can activate the matrix to make it available for use in threat analysis.\n      - [Threat Intelligence administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/r_ThreatRespAdmin.md) -- The Threat Intelligence base system is ready to use on activation. You can add records to certain modules in the Administration application menu, but most are already populated with industry-standard information.\n        - [Threat Lookup Finding Calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-lookup-finding-calculators.md) -- Threat Lookup Finding Calculator helps you calculate the observable findings based on the responses received.\n          - [Using Threat Lookup Finding Calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/using-threat-calculators.md) -- Use the Threat Lookup Finding Calculator to calculate the observable findings for your integration.\n      - [Threat Intelligence integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-integrations.md) -- The Threat Intelligence base system includes integrations to third-party malware-detection software packages. This section provides instructions for activating the plugins and configuring both ServiceNow and third-party integrations. Also included are some basic guidelines for developing your own integrations, as well as details on specific integrations included in the base system.\n        - [CrowdStrike Falcon Intelligence integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/crowdstrike-intell-landing-page.md) -- CrowdStrike Falcon Intelligence enriches Threat Intelligence with data for security incidents and associated observables.\n          - [CrowdStrike Falcon Intelligence integration overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/crowdstrike-intell-integration.md) -- CrowdStrike Falcon Intelligence provides cyber security intelligence that easily integrating with Security Operations.\n            - [Threat Lookup - CrowdStrike Falcon Intelligence flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/crowdstrike-intell-integration.md) -- CrowdStrike Falcon Intelligence provides cyber security intelligence that easily integrating with Security Operations.\n            - [Activate and configure the CrowdStrike Falcon Intelligence integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/crowdstrike-intell-integration.md) -- CrowdStrike Falcon Intelligence provides cyber security intelligence that easily integrating with Security Operations.\n        - [Have I been pwned? integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/haveibeenpwned-landing-page.md) -- The Security Operations Have I been pwned? integration enables you to submit lookups on domain names and email addresses to determine whether user personal data has been compromised by data breaches.\n          - [Have I been pwned? integration setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/haveibeenpwned-setup.md) -- Have I been pwned? is a free resource used to assess if someone may have been put at risk due to their online account being compromised or \"pwned\" in a data breach. It easily integrates with Security Operations.\n            - [Threat Lookup - Have I been pwned? flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/threat-lookup-haveibeenpwned-wf.md) -- The Threat Lookup - Have I been pwned? flow performs a lookup on selected observables. If the observables are of a type recognized by Have I been pwned?, the observables are scanned for malware, and the results are returned.\n            - [Activate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/activate-haveibeenpwned.md) -- The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including the Security Operations Have I been pwned? integration. Before you can use the Have I been pwned? integration, you must download it from the ServiceNow Store.\n            - [Update X.509 certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/update-cert-pawnd.md) -- If you require an SSL connection for the integration, there are circumstances when the certificate provided by the third-party vendor is either not yet trusted in ServiceNow or has expired. This task is optional.\n        - [MISP integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/misp-integration-for-security-operations.md) -- With MISP integration for Security Operations, you can investigate security incidents with sighting searches, observable enrichment, and create or update events in MISP. Using MISP, you can investigate targeted attacks faster, improve the detection ratio, and reduce the number of false positives in your environment.\n          - [MISP administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/misp-administration.md) -- You can set up MISP integration in the ServiceNow AI Platform to perform a sighting search, observable enrichment, and to create and update events in MISP.\n            - [Getting started with MISP integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-started-with-misp-integration-for-security-operations.md) -- Review the following information before you set up your MISP integration for Security Operations.\n              - [MISP user roles and permissions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/misp-user-roles-and-permissions.md) -- Review the user roles that are required in the MISP integration for Security Operations integration.\n            - [Install and configure the MISP integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/install-and-configure-misp.md) -- Install and configure the MISP integration for Security Operations from the ServiceNow Store on your ServiceNow AI Platform instance so that you can start investigating security incidents using the MISP data.\n            - [Review the MISP integration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/review-the-misp-integration-settings.md) -- Review the MISP integration for Security Operations settings and modify the default system properties to suit your environment.\n            - [Configure MISP sighting searches](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-sightings-search.md) -- Configure the ServiceNow AI Platform to do sighting searches for observables in the MISP instance. With this information, you can determine how often threats occur.\n            - [Configure how an automatic event is created](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-automatic-event-creation-profile.md) -- Configure the ServiceNow AI Platform to automatically create events in MISP.\n              - [Configure event trigger conditions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-automatic-event-creation-profile.md) -- Configure the ServiceNow AI Platform to automatically create events in MISP.\n              - [Map the MISP event fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-automatic-event-creation-profile.md) -- Configure the ServiceNow AI Platform to automatically create events in MISP.\n              - [Map or associate SIR observables as attributes to MISP events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-automatic-event-creation-profile.md) -- Configure the ServiceNow AI Platform to automatically create events in MISP.\n              - [Synchronize MITRE-ATT&CK information to MISP events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-automatic-event-creation-profile.md) -- Configure the ServiceNow AI Platform to automatically create events in MISP.\n              - [Add MISP tags to events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-automatic-event-creation-profile.md) -- Configure the ServiceNow AI Platform to automatically create events in MISP.\n            - [MISP event data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/misp-event-data.md) -- You can review the MISP event data so that you can see detailed information about the MISP events.\n            - [Associated MISP events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/associated-misp-events.md) -- You can use the associated MISP events list view to view the events that have been created manually or automatically in the context of a security incident.\n            - [MISP user information](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/misp-user-information.md) -- You can use the MISP user information page to view all the associated users for the ServiceNow AI Platform MISP integration for Security Operations.\n            - [Domain separation and MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/domain-separation-and-misp.md) -- Domain separation is supported in MISP. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.\n            - [Troubleshooting MISP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/troubleshooting-misp-integration.md) -- This section covers important troubleshooting tips that can help you resolve common issues you can encounter when setting up or running MISP integration.\n          - [Using MISP to investigate and analyze threats](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/using-misp-to-detect-and-analyze-threats.md) -- You can use the MISP data across the ServiceNow AI Platform Threat Intelligence module and the ServiceNow AI Platform SIR module to investigate and analyze threats to your organization.\n            - [Sighting searches in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sightings-searches-in-misp.md) -- You can perform sighting searches on observables in the MISP instance to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL, occur in your network. Each occurrence is considered a sighting.\n              - [Enable automatic sighting searches in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sightings-searches-in-misp.md) -- You can perform sighting searches on observables in the MISP instance to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL, occur in your network. Each occurrence is considered a sighting.\n              - [Perform a manual sighting search in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sightings-searches-in-misp.md) -- You can perform sighting searches on observables in the MISP instance to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL, occur in your network. Each occurrence is considered a sighting.\n              - [Report sightings to MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sightings-searches-in-misp.md) -- You can perform sighting searches on observables in the MISP instance to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL, occur in your network. Each occurrence is considered a sighting.\n            - [Observable enrichment in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/observable-enrichment-in-misp.md) -- By enriching observables with additional information from various MISP sources during incident response investigations, you can contain identified threats.\n              - [Enable automatic observable enrichment in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/observable-enrichment-in-misp.md) -- By enriching observables with additional information from various MISP sources during incident response investigations, you can contain identified threats.\n              - [Perform a manual observable enrichment in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/observable-enrichment-in-misp.md) -- By enriching observables with additional information from various MISP sources during incident response investigations, you can contain identified threats.\n              - [Add or remove tags to MISP attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/observable-enrichment-in-misp.md) -- By enriching observables with additional information from various MISP sources during incident response investigations, you can contain identified threats.\n              - [Add or remove galaxies to a MISP event or attribute](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/observable-enrichment-in-misp.md) -- By enriching observables with additional information from various MISP sources during incident response investigations, you can contain identified threats.\n              - [Add comments to MISP attribute](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/observable-enrichment-in-misp.md) -- By enriching observables with additional information from various MISP sources during incident response investigations, you can contain identified threats.\n            - [Managing events in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/events-in-misp.md) -- You can create events in MISP automatically or manually from the ServiceNow AI Platform. You can also edit the event data in MISP from the ServiceNow AI Platform.\n              - [Verifying automatically created events in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/events-in-misp.md) -- You can create events in MISP automatically or manually from the ServiceNow AI Platform. You can also edit the event data in MISP from the ServiceNow AI Platform.\n              - [Manually create an event in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/events-in-misp.md) -- You can create events in MISP automatically or manually from the ServiceNow AI Platform. You can also edit the event data in MISP from the ServiceNow AI Platform.\n              - [Add attributes to a MISP event](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/events-in-misp.md) -- You can create events in MISP automatically or manually from the ServiceNow AI Platform. You can also edit the event data in MISP from the ServiceNow AI Platform.\n              - [Add tags to a MISP event](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/events-in-misp.md) -- You can create events in MISP automatically or manually from the ServiceNow AI Platform. You can also edit the event data in MISP from the ServiceNow AI Platform.\n              - [Update galaxies to a MISP event or attribute](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/events-in-misp.md) -- You can create events in MISP automatically or manually from the ServiceNow AI Platform. You can also edit the event data in MISP from the ServiceNow AI Platform.\n            - [Roll up MITRE-ATT&CK information using MISP enrichment results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/rollup-mitre-information-using-misp-enrichment-results.md) -- Roll up the MISP enrichment results manually if you haven't enabled the automatic rollup of MISP information.\n        - [OPSWAT Metadefender Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/metadefender-landing-page.md) -- OPSWAT Metadefender allows threat data, detected by the third-party Metadefender scanner, to be downloaded to the Threat Intelligence application for tracking, prioritization, and resolution.\n          - [OPSWAT Metadefender integration overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_Metadefenderintegration.md) -- OPSWAT Metadefender is a security solution that provides access to multiple anti-malware machines and easily integrates with Security Operations.\n            - [Threat Lookup - OPSWAT Metadefender flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_Metadefenderintegration.md) -- OPSWAT Metadefender is a security solution that provides access to multiple anti-malware machines and easily integrates with Security Operations.\n            - [Activate and configure the OPSWAT Metadefender integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_Metadefenderintegration.md) -- OPSWAT Metadefender is a security solution that provides access to multiple anti-malware machines and easily integrates with Security Operations.\n            - [Update your X.509 certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_Metadefenderintegration.md) -- OPSWAT Metadefender is a security solution that provides access to multiple anti-malware machines and easily integrates with Security Operations.\n        - [VirusTotal integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/virustotal-landing-page.md) -- The VirusTotal integration enables you to request the analysis of suspicious IP addresses, files, file hashes, and URL addresses to aid in your investigation to determine if they are malicious.\n          - [VirusTotal integration setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/virustotal-setup.md) -- VirusTotal is a free service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware. It integrates easily with Security Operations.\n            - [Activate and configure the VirusTotal integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/activate-configure-virustotal.md) -- Before you can use the VirusTotal integration, you must download it from the ServiceNow Store.\n          - [Threat Lookup - VirusTotal workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-lookup-virustotal-wf.md) -- The Threat Lookup - VirusTotal workflow performs a lookup on selected observables. If the observables are of a type recognized by VirusTotal, the observables are scanned for malware, and the results are returned.\n        - [WhoisXML API integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/whois-landing-page.md) -- The WhoisXML API integration enables you to submit Whois lookups on domain names and URLs to obtain context on URL observables, and to make better determination on threats.\n          - [WhoisXML API integration setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/whois-integration-setup.md) -- Before you can use the Whois integration, you must activate the plugin and add the credentials. If necessary, you can also update your X509 SSL certification.\n            - [Activate and configure the Security Operations Whois integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/activate-whois.md) -- The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including the Security Operations Whois integration. Before you can use the Security Operations Whois integration, you must download it from the ServiceNow Store, and you must have a valid account from WhoisXML API.\n            - [Update your X.509 certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/update-cert-whois.md) -- If you require an SSL connection for the integration, there are circumstances when the certificate provided by the third-party vendor is either not yet trusted in ServiceNow or has expired. This task is optional.\n          - [Enrich Observable WhoIs workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/enrich-observable-whois-wf.md) -- The Enrich Observable WhoIs workflow performs enrichment on selected observables. If the observables are of a type recognized by the WhoisXML API Integration, the observables are enriched.\n            - [Observable Enrichment Lookup activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/enrich-observable-whois-wf.md) -- The Enrich Observable WhoIs workflow performs enrichment on selected observables. If the observables are of a type recognized by the WhoisXML API Integration, the observables are enriched.\n      - [Threat Intelligence Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_ThreatIntelligenceOrchestration.md) -- Threat Intelligence Orchestration activities allow users to determine whether a threat has been seen before in other security incidents or on other systems using workflow orchestration.\n        - [Set up Threat Intelligence Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_ThreatIntelligenceOrchestrationSetup.md) -- Prior to using Threat Intelligence Orchestration, perform steps to set up various parts of the system, including populating the CMDB, configuring the MID Server, and configuring credentials.\n        - [Threat Intelligence Orchestration workflows and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-orch-wfs-and-activities.md) -- The base system includes workflows and workflow activities you can use to automate actions on your instance.\n          - [Threat Intelligence - Run IoC Lookup workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-orch-wfs-and-activities.md) -- The base system includes workflows and workflow activities you can use to automate actions on your instance.\n            - [Populate lookup with observable activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-orch-wfs-and-activities.md) -- The base system includes workflows and workflow activities you can use to automate actions on your instance.\n            - [Perform IoC Lookup activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-orch-wfs-and-activities.md) -- The base system includes workflows and workflow activities you can use to automate actions on your instance.\n            - [Update observable with lookup result activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-orch-wfs-and-activities.md) -- The base system includes workflows and workflow activities you can use to automate actions on your instance.\n            - [Run Default IoC Lookup Sources activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-orch-wfs-and-activities.md) -- The base system includes workflows and workflow activities you can use to automate actions on your instance.\n      - [Security Case Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/case-mgmt.md) -- Security Case Management provides a means for security analysts who are engaged in threat hunting to gather information on suspicious activity in their environment. Case-related records, such as security incidents, observables, CIs, and affected users can be added to cases to accommodate broad and specific analysis.\n        - [Create cases in Security Case Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-cases-in-case-mgmt.md) -- Cases are used to track information about a campaign or state actor threatening your organization. After a case is created, you can add artifacts that allow you to review and analyze all related information within a single case record.\n          - [Add artifacts to a case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/add-records-to-cases.md) -- After you have created a case, you can add artifacts, such as security incidents, CIs, and indicators of compromise, to the case. These artifacts act as clues in solving the case.\n          - [Associate MITRE-ATT&CK information with security case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/associate-mitre-att-ck-information-with-security-case-management.md) -- Associate MITRE-ATT&CK tactics and techniques to a security case for better security case management and threat analysis at a granular level.\n        - [Case creation from security artifacts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/case-creation-from-security-artifacts.md) -- In addition to creating cases manually from Security Case Management, you can also create cases from security artifacts, such as security incidents, indicators of compromise, affected users, and configuration items.\n          - [IoCs and observables in cases](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/cases-in-threat.md) -- In Threat Intelligence, you can create cases from IoCs and observables, as well as add IoCs and observables to existing cases. You can also create observables directly from a case.\n            - [Create a case from IoCs or observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-cases-threat.md) -- In Threat Intelligence, you can create a case from artifacts (IoCs or observables). After the IoCs or observables have been used to create a case, you can use Security Case Management to analyze the data.\n            - [Add IoCs and observables to an existing case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/add-records-to-cases-threat.md) -- You can add IoCs and observables to existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.\n            - [Create an observable from a case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-an-observable-from-a-case.md) -- New observables can be created from cases in Security Case Management.\n            - [Run a sightings search on observables in a case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/run-local-sighted-srch.md) -- You can search for observables using the Sighting Search feature to determine how often they occur. Each occurrence is considered a sighting. You can limit the search to the number of sightings within a selected number of days or within a date range.\n          - [Security incidents in cases](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/case-in-sir.md) -- In Security Incident Response, you can create cases from security incidents, CIs, and affected users, as well as add those artifacts to existing cases.\n            - [Create a case from security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-cases-from-security-incidents.md) -- In Security Incident Response, you can create cases from security incidents. After the security incidents have been used to create a new case, you can use Security Case Management to analyze the data.\n            - [Add security incidents to an existing case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/add-sec-inc-to-cases.md) -- You can add security incidents to one or more existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.\n          - [Configuration items in cases](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/cases-from-cis.md) -- You can create a new case from one or more configuration items (CI) in the Configuration Item [cmdb_ci] table. You can also add CIs to existing cases.\n            - [Create a case from CIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-cases-from-CIs.md) -- You can create a security case from configuration items in the Configuration Item [cmdb_ci] table. After the CIs have been used to create a new case, you can use Security Case Management to analyze the data.\n            - [Add CIs to existing cases](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/add-cis-to-cases-sir.md) -- You can add configuration items to one or more existing cases. After the CIs have been added to cases, you can use Security Case Management to analyze the data.\n          - [Affected users in cases](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/cases-from-affected-users.md) -- You can create a new case from one or more affected users in the User [sys_user] table. You can also add users to existing cases.\n            - [Create a case from affected users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-cases-from-affected-users.md) -- You can create a security case from affected users in the User [sys_user] table. After the affected users have been used to create a new case, you can use Security Case Management to analyze the data.\n            - [Add affected users to existing cases](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/add-users-to-cases-sir.md) -- You can add affected users to one or more existing cases. After the user records have been added to cases, you can use Security Case Management to analyze the data.\n        - [Security artifact analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sec-artifact-analysis.md) -- After you have created cases, either using Security Case Management, or from artifacts such as IoCs, observables, security incidents, and so forth, you can continue to add artifacts to aid in anaysis of the threats identified.\n          - [Related details for case artifacts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/related-details-for-case-artifacts.md) -- As you add artifacts to a case, additional related details for each artifact may also be automatically added. For example, if you add a security incident, it may contain affected CIs and user records. You can quickly view the related details for a selected artifact without leaving the list of artifacts.\n            - [View related details for a security incident artifact](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-related-details-for-sec-inc-artifact.md) -- If your case includes security incident artifacts, you can view any related details contained in each security incident referenced by the case.\n            - [View related details for a configuration item artifact](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-related-details-for-ci-artifact.md) -- If your case includes configuration item artifacts, you can view any related details contained in each CI referenced by the case.\n            - [View related details for an IoC artifact](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-related-details-for-ioc-artifact.md) -- If your case includes indicators of compromise (IoC) artifacts, you can view any related details contained in each IoC referenced by the case.\n            - [View related details for an affected user artifact](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-related-details-for-user-artifact.md) -- If your case includes affected user artifacts, you can view any related details contained in each affected user referenced by the case.\n            - [View related details for an observable artifact](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-related-details-for-observ-artifact.md) -- If your case includes observable artifacts, you can view any related details contained in each observable referenced by the case.\n          - [Security artifact exclusion and inclusion](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/artifact-inclusion-exclusion.md) -- The lists of supporting artifacts assigned to a case can sometimes get long and there may be instances where you want to remove particular artifacts from a list. Rather than permanently remove the artifacts, you can exclude them from the list and, as needed, return them to the list at a later time.\n            - [Exclude security artifacts from a case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/exclude-records.md) -- You can remove artifacts from the lists of supporting artifacts. They are not permanently removed and can be returned to the case as needed.\n            - [Return excluded security artifacts to a case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/include-artifacts.md) -- After you have excluded artifacts from a list in a case, you can return them to the case you can continue to work on them.\n          - [Annotate security artifacts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/annotate-artifacts.md) -- As you are analyzing a case, you can add annotations to any artifact.\n          - [Search for security artifacts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/search-for-artifacts.md) -- You can perform a keyword search on any security artifact list.\n  - [Security Posture Control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-landing.md) -- Gain visibility into your enterprise asset inventory and security tool coverage. Use policies provided with the product or create your own to identify assets missing key security tools, such as endpoint protection, configuration management, and vulnerability scanning. Monitor assets for security tool configurations specific to your environment and automate the remediation workflow for security gaps in the Configuration Compliance application.\n    - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-overview.md) -- Security Posture Control enables cybersecurity teams to get visibility into their complete enterprise asset inventory and determine their overall security posture.\n      - [Install supported applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-install.md) -- The applications required for this integration are available on the ServiceNow Store. Some applications have dependencies that you must download and install separately.\n      - [Supported Service Graph Connectors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-use-connectors-policies.md) -- Security Posture Control relies on API integrations or Service Graph Connectors as a key source for the asset data used to identify security gaps.\n      - [Policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-policies-overview.md) -- Policies audit your assets based on data imported from your service graph connectors to help you find potential violations.\n        - [Included policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-polices-included.md) -- There are a few policies that are included with the Security Posture Control application that are tied to important use cases and are ultimately shown as key insights on the dashboard on the landing page (Home module) in the SPC Workspace.\n        - [Creating your own policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-creating-policies.md) -- You can create your own custom policies to monitor data that is specific to the assets in your environment. You base these policies on data you will import from the various Service Graph Connectors you have installed and activated.\n      - [Insights](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-custom-insight-overview.md) -- Key and configured (custom) insights provide you with visual reports that are created and updated by the assessment criteria that match your assets. Insights help you monitor security controls metrics on a dashboard.\n    - [Use the workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-workspace.md) -- The Security Posture Control workspace contains the modules you use for configuring, using, and monitoring the imported data about your assets.\n      - [Activate a policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-activate-a-policy.md) -- Policies that are included with the application must be activated before Security Posture Control can monitor the assets that match that policy. By default, none of the policies included with the application are activated.\n      - [Create and activate custom policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-create-policy.md) -- Create your own custom policies to monitor assets for tool coverage and other high-risk combinations.\n      - [Edit an activated policy in Security Posture Control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-edit-policy.md) -- You can edit activated policies to help you customize their conditions to better match your assets.\n      - [Clone and create child policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-clone-policy.md) -- Clone an existing policy and add conditions to it to create your own custom policy. You can also create child policies from existing policies.\n      - [Create and activate a configured insight](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-create-custom-insight.md) -- You can create your own insights. Configured insights are insights that you can create either using existing policies or your own custom policies.\n      - [Create an asset profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/asset-profile.md) -- Create an asset profile with conditions to group assets. You can use these asset profiles in your policies.\n        - [Delete a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-delele-asset-profile.md) -- You can delete asset profiles. You delete asset profiles if they are associated to policies so the asset profile's conditions are not included in the next policy audit.\n      - [Configuring and viewing findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-view-findings.md) -- You can view the findings generated by the evaluation of policies in Security Posture Control in the Security Posture Control Workspace.\n        - [Test result and remediation task state transitions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-findings-state-transition.md) -- The states on findings (configuration test records) and their associated remediation tasks are impacted if you modify your policies in the Security Posture Control application.\n      - [Creating your own API connector](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-creating-sgc-template.md) -- Create your own Security Posture Control (SPC) API connectors using the connector framework that is included with the application.\n        - [Enter connector metadata](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-sgc-template-stepper1.md) -- Fill in the metadata for your service graph connector.\n        - [Enter credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-sgc-template-stepper2.md) -- Enter the connection URL and credential alias details for your API connector.\n        - [Select a template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-sgc-template-stepper-3.md) -- Select a template to support your API's structure.\n        - [Provide input values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-sgc-template-stepper-4.md) -- Provide input parameters to make a valid API call, test the connection, and receive a sample response.\n        - [Map API response to SPC attributes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-sgc-stepper-5.md) -- Map API response properties to SPC attributes. After you have mapped the attributes, you publish your connector so it imports data.\n        - [Validate connector](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-sgc-validate-api-connector.md) -- Test the connection for your API connector. You must pass both checks before you can publish your connector. You must review your input and mapping to be sure that it is accurate before publishing your connector.\n        - [Create an instance and set the import schedule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-sgc-stepper-6.md) -- Create an instance and determine when and how often you want your connector to import data.\n      - [Create an asset search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-asset-search.md) -- Set your conditions and search for assets by specific service graph connector products or for assets that have specific data reported by a connector.\n      - [Resolving duplicate configuration items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-using-dedup-template.md) -- Resolving duplicate entries for configuration items (CIs) in your Configuration Management Database ensures that you get accurate audits with your SPC policies.\n        - [Resolve duplicate configuration items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-resolve-duplicate-cis.md) -- Use this process to remove duplicate configuration items in the SPC Cached Assets [sn_sec_spc_core_asset_cache] table. This process removes duplicate records and preserves the master, or canonical, asset record that has the most related items.\n    - [Use mitigation controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-mitigation-exploring.md) -- From within in the Security Posture Control (SPC) Workspace, gain insight into which threats to your assets are mitigated by available mitigation controls based on how various security tools are configured.\n      - [Mitigation controls policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-mitigation-policies.md) -- The Security Posture Control and the Mitigation Controls applications are required to view the mitigation controls and mitigation controls policies in the SPC. Both applications are available from the ServiceNow Store.\n      - [Policies for Exploit Protection (EDR)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-controls-policies-for-edr.md) -- This category of mitigation controls covers mitigations available on your assets in the form of endpoint protection agent configuration. This applies to endpoint protection agents such as CrowdStrike and SentinelOne.\n        - [Install CrowdStrike integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-install-config-controls.md) -- The CrowdStrike Service Graph Connector and API integrations require separate configuration steps. You configure the CrowdStrike Service Graph Connector to import asset details. You configure the CrowdStrike API Integration to gather mitigation data about the assets that are monitored by CrowdStrike.\n        - [Install Microsoft integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-install-config-sccm-defender.md) -- The Service Graph Connector for SCCM and the Microsoft Defender Mitigation Control Integration require separate configuration steps.\n          - [Create multiple instances](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-new-instance-sccm-defender.md) -- You can configure multiple instances for the Microsoft Defender Mitigation Control Integration.\n        - [Install SentinelOne integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-install-config-sentinelone-mc.md) -- The Service Graph Connector for SentinelOne and the SentinelOne Integration for Mitigation Control Integration require separate configuration steps. You install and configure the Service Graph Connector for SentinelOne to import asset details. You configure the SentinelOne Integration for Mitigation Control Integration to gather mitigation data about the assets that are monitored by the Service Graph Connector for SentinelOne.\n      - [Exploit protection (WAF)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-controls-policies-for-exploit-waf.md) -- This category of mitigation controls covers mitigations available in the form of Web Application Firewall.\n        - [Configure F5 BIG-IP integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-install-config-f5-controls.md) -- The ITOM IP-based Discovery application and the F5 BIG-IP API integrations require separate configuration steps. You configure the ITOM IP-based Discovery application to import asset details. You configure the F5 BIG-IP API Integration to gather mitigation data about the assets that are monitored by ITOM IP-based Discovery.\n        - [Configure the AWS WAF integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-install-config-aws-waf.md) -- Determine if your virtual machines are protected with the AWS WAF integration for mitigation controls monitoring.\n        - [Create a policy for AWS WAF](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-create-AWS-WAF-policy.md) -- Create a policy so you can audit your assets based on data imported from the integration.\n      - [View detected mitigations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-activate-controls-monitoring.md) -- You must activate policies before you can view which threats to your assets are mitigated by available mitigation controls.\n      - [Mapping mitigations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-mitigation-vit-mapping.md) -- Mitigation controls data is mapped to vulnerable items. You can view a list of mitigation controls that are used to mitigate the vulnerabilities and underlying Common Vulnerabilities and Exposures (CVEs) associated with the vulnerable items.\n    - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-policies.md) -- Use cases are different scenarios that you configure to help you identify specific types of tool coverage gaps. Each use case requires a policy or policies to audit your assets for potential violations. You can also define your own policies to help you fulfill requirements for your specific internal security standards.\n      - [Assets without endpoint protection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-use-case-1.md) -- To detect assets missing an endpoint protection agent, the following prerequisites are required. \n      - [Assets missed by vulnerability assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-use-case-2.md) -- To detect assets missed by vulnerability assessment tools, the following pre-requisites are required.\n      - [Unmanaged assets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-use-case-3.md) -- This use case includes two parts, detecting assets that are missing configuration and patch management agents.\n      - [Assets missing endpoint management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-use-case-4.md) -- To detect assets missing an endpoint management solution, the following pre-requisites are required.\n      - [Assets with vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-use-case-5.md) -- You can identify assets with critical vulnerabilities and missing critical security tools such as endpoint protection to prioritize those assets for remediation. Security Posture Control ships a few policies included with the product to support this use case.\n      - [Cloud assets and high-risk combinations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-use-case-6.md) -- It is critical to monitor potential internet exposure of Cloud assets (virtual machines) on various ports to ensure that vulnerabilities on these assets are not exploited remotely. This use case helps you identify these assets.\n      - [Hardware Service Graph Connectors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/scp-hw-connectors-ci-classes.md) -- Supported Hardware service graph connectors with CI class, source (product), and tool categories. This list is not complete and is subject to change with the addition of more products.\n      - [Software Service Graph Connectors](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-connector-types-ci-classes.md) -- Supported Software service graph connectors with CI class, source (product), and tool categories. This list is not complete and is subject to change with the addition of more products.\n      - [Policy examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-policy-examples.md) -- You can create your own base policies that have broad sets of conditions that you can use as starting points for more complex policies.\n        - [Create a base policy for Security Posture Control (example)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-create-base-policy-example.md) -- An example of how to create a base policy that you can use to create other policies.\n        - [Create a child policy from a base policy for Security Posture Control (example)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/spc-create-child-policy-example.md) -- An example of how to create a child policy using the conditions of a base policy.\n  - [Cybersecurity Executive Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vr-unified-CISO-dashboard.md) -- The Cybersecurity Executive Dashboard is a comprehensive solution that provides high-level executive officers visibility into an organization's security posture, policies, and initiatives.\n    - [Opt-in for benchmark scores](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/vr-retrieve-benchmark-results.md) -- Get benchmark scores by registering your instance to the ServiceNow central instance. The latter maintains information of multiple industries to provide the benchmark score.\n    - [Set targets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/set-targets-cybersecurity-dashboard.md) -- Set targets in days to remediate the vulnerabilities, security incidents, and misconfigurations.\n    - [Security Simulation and Training Integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/integrate-phishing-integrations.md) -- Strengthen your organization's defense against prominent cybersecurity threats by incorporating phishing integrations with the Cybersecurity Executive Dashboard. The Phishing Integrations enhance the Cybersecurity Executive Dashboard by seamlessly incorporating data from third-party phishing simulation tools such as KnowBe4 and Microsoft Defender for Office 365.\n      - [Configure Knowbe4 integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-knowbe4-integration-vr.md) -- Gain immediate insights into your staff's vulnerability to phishing attacks by integrating with KnowBe4, a leading cybersecurity awareness training platform. Through KnowBe4 integration, identify trends and areas of improvement in your cybersecurity training programs, monitor overall phishing resilience and proactively strengthen your organization's security measures.\n      - [Configure Microsoft Defender for Office 365 integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/configure-microsoft365-defender-integration-vr.md) -- Gain valuable insights into phishing simulation metrics directly within the Cybersecurity Executive Dashboard through seamless integration with Microsoft Defender for Office 365.\n    - [Risk and compliance dashboard for GRC: Metrics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/grc-cybersecurity-risk-compl-dashboard.md) -- The Risk and compliance dashboard gives the compliance and risk users a comprehensive overview of risk and compliance information in a single dashboard that aids in their key decisions.\n      - [Risk and Compliance Dashboard reports and solutions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/grc-ced-risk-compliance-db-reports.md) -- The Risk and Compliance dashboard is a unified dashboard that provides a comprehensive analytical data of reports available from the major GRC applications for the chief information security officer to understand the compliance and risk posture of the organization. The dashboard consolidates data from various products within the ServiceNow GRC suite of applications.\n  - [Threat Intelligence Security Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-landing-page.md) -- The Threat Intelligence Security Center (TISC) platform provides technology solution for aggregation, management and operationalization of threat intelligence.\n    - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-intelligence-security-center-overview.md) -- Threat Intelligence Security Center (TISC) enables you to collaborate with threat intelligence teams by collecting, processing, and analyzing threat intelligence feeds in a centralized workspace.\n      - [TISC Key terminology](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-key-terminology.md) -- Key terms and definitions used in TISC to help you understand threat intelligence concepts and navigate the interface effectively.\n      - [TISC Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-threat-intelligence-security-center-homepage.md) -- View a centralized dashboard of threat intelligence data including feeds overview, trending threats, and intelligence sharing metrics. Monitor your security posture with trending intelligence data.\n    - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-configure.md) -- Set up the features, components, and integrations that you need to provide service and support to your customers.\n      - [Download TISC application from ServiceNow Store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-download-app-first-time.md) -- Download and install the Threat Intelligence Security Center application to enable threat intelligence capabilities in your ServiceNow instance.\n      - [Set up Threat Intelligence Security Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/set-up-threat-intelligence-security-center.md) -- Before you use the Threat Intelligence Security Center, you must download it from the ServiceNow Store.\n      - [Set Threat Intelligence Security Center properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-set-properties.md) -- Review the components installed with Threat Intelligence Security Center to understand the roles, properties, and other elements added to your instance.\n    - [Integrate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/integrating-threat-intelligence-security-center.md) -- Use this section to understand the Threat Intelligence Security Center integrations.\n      - [Threat Intelligence Security Center Catalog](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-intelligence-security-center-catalogue.md) -- The Threat Intelligence Security Center Catalog is a curated list of Threat Intelligence feeds and enrichment integrations available in the application. You can enable them after adding the required information and schedule the feed to automatically ingest Threat Intelligence data on a set frequency.\n      - [Threat Intelligence Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-intelligence-feeds.md) -- Configure threat intelligence data sources to automatically import security indicators into your ServiceNow instance. Use feeds to keep threat data current and enhance security monitoring capabilities.\n        - [Configure a new threat intelligence feed](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-new-data-source.md) -- Configure a new threat intelligence feed.\n        - [Configure Custom Field Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-field-mapping.md) -- Field Mapping allows you to configure how each field in a data feed such as Text, CSV or JSON is interpreted and assigned to the corresponding observable.\n        - [View Threat Intel Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/base-system-threat-intel-feeds.md) -- View threat intelligence feeds that automatically imports security data into your TISC ServiceNow instance. This enables real-time threat detection and response capabilities.\n          - [View STIX TAXII Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-stix-taxii-feeds.md) -- View and manage STIX TAXII threat intelligence feeds that provide automated security data to your ServiceNow instance.\n          - [View STIX HTTPs Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-oob-stix-https-feeds.md) -- View and manage STIX threat intelligence feeds that provide security data to your ServiceNow instance. Use this to monitor feed status and troubleshoot connection issues.\n          - [View MISP Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-oob-misp-feeds.md) -- View configured MISP feeds to monitor threat intelligence sources and verify feed status in your ServiceNow instance.\n          - [View Text Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-oob-text-format-feeds.md) -- Access and review all text feeds configured in your ServiceNow instance to monitor their status and settings.\n          - [View CSV Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-oob-csv-feeds.md) -- View configured CSV feeds to monitor data import sources and their current status. Use this to verify feed configurations and troubleshoot import issues.\n          - [View JSON Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-json-feeds.md) -- Display all JSON feeds configured in your ServiceNow instance to review their settings and status. Use this to monitor data integration endpoints and troubleshoot feed issues.\n          - [View RSS Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-rss-feeds.md) -- Access and review RSS feed configurations to monitor external content sources or troubleshoot feed connectivity issues.\n          - [View Custom Feed](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-oob-custom-feeds.md) -- View the custom feed that are shipped within the base system.\n            - [Configure Premium Threat Feed for CrowdStrike](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/premium-threat-feed-for-crowdstrike.md) -- The CrowdStrike feed enables users to ingest indicators, actors, reports, malware, vulnerabilities, and their associated context from the CrowdStrike Falcon Intelligence feed into TISC.\n              - [System Properties for CrowdStrike](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/premium-threat-feed-system-properties.md) -- The following details the system properties for CrowdStrike.\n            - [Configure custom MISP API feed](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-premium-misp.md) -- The Malware Information Sharing Platform (MISP) API feed enables you to import events from the MISP server, along with their associated attributes and objects, into the TISC library.\n        - [About STIX TAXII](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-intelligence-security-center-feeds.md) -- Structured Threat Information Expression (STIX) is a language and serialization format used to exchange cyberthreat intelligence (CTI). Trusted Automated Exchange of Intelligence Information (TAXII) is a protocol used to exchange cyberthreat intelligence (CTI) over HTTPS.\n          - [Configure a new TAXII Feed](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-configure-a-new-taxii-feed.md) -- You can maintain TAXII feeds for sharing STIX-formatted information. Each TAXII feed contains one or more TAXII collections.\n        - [Duplicate threat intelligence feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-duplicate-feeds.md) -- Duplicate a threat feed to create an exact copy with all associated observables, indicators, and actors when you want to modify settings without affecting the original feed.\n      - [TISC Integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-integrations.md) -- This section provides instructions for configuring and enabling the Threat Intelligence integrations.\n        - [TISC Enrichment integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-enrichment-integrations.md) -- The Threat Intelligence Security Center base system does not include any pre-configured integrations. This section provides instructions for configuring both ServiceNow and third-party integrations.\n          - [Configure new enrichment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-config-new-enrich.md) -- Set up threat intelligence enrichment integrations to automatically gather additional context about observables, search for sightings, or perform threat lookups from external security vendors.\n          - [Configure Observable Enrichment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/configure-observable-enrichment.md) -- Enrich one or more observables to identify whether they're associated with known threats. The results are based on the enrichment integrations active in your environment.\n            - [Have I Been Pwned integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-hibp-integration.md) -- The Have I Been Pwned (HIBP) integration enables you to enrich email address and domain observables with breach data directly within the TISC.\n              - [Configure and enable Have I Been Pwned integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-config-hipw-integration.md) -- Configure API credentials and enrichment behavior through the dedicated Have I Been Pwned (HIBP) configuration tile in TISC integration settings.\n            - [Whois integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-whoisxml-integration.md) -- Submit Whois lookups on domain names and URLs to gather threat intelligence and assess potential security risks. Use this integration to obtain registration details, ownership information, and other contextual data for suspicious domains.\n              - [Configure and enable Whois integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-whoisxml-api-integration.md) -- Set up WHOIS integration with TISC to perform domain and URL lookups for threat intelligence enrichment. This integration provides context on observables to help determine potential threats.\n            - [Shodan integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-shodan.md) -- Configure Shodan integration to enable automated discovery and analysis of internet-connected devices in your network infrastructure.\n              - [Configure and enable Shodan integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/shodan-integration.md) -- Before you use Shodan integration, you must download it from the ServiceNow Store.\n          - [Configure Sighting Search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/configure-sighting-search.md) -- Configure sighting search integration to search your organization logs for one or more observables to determine how many times each observable appears, within a specified date range or number of days.\n            - [Create Sighting Search queries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/manage-sighting-search-configurations.md) -- Sighting search configurations define queries that search for observables across your security environment during investigations. Configure these queries to determine how often specific indicators appear in your data sources.\n            - [Using Sighting Search parameters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/manage-sighting-search-parameters.md) -- Configure advanced search parameters to create complex queries with logic operators and other features supported by your log store. Use these parameters when basic search criteria are insufficient for your investigation needs.\n            - [Get started with Sighting Search Configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-get-sighting-configs.md) -- Sighting Search Configurations define how threat intelligence data is searched and matched against your environment. Configure these settings to customize threat detection and improve security monitoring accuracy.\n              - [Configure and enable Elasticsearch integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-elasticsearch-integration.md) -- Elasticsearch is a distributed, RESTful search and analytics engine that easily integrates with Security Operations.\n              - [Configure and enable Splunk integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-splunk-integration.md) -- Configure the Splunk Enrichment integration to automatically search your logs and add relevant sighting information to threat intelligence data.\n              - [Configure CrowdStrike NextGen SIEM sighting search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-crowdstrike-ngsiem-integration.md) -- Configure the CrowdStrike NextGen SIEM integration with your Falcon API credentials so that analysts can search CrowdStrike log data for activity that matches an observable.\n          - [Configure Threat Lookup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/configure-threat-lookup.md) -- Scan selected observables for malware using Threat Intelligence to determine if they are malicious. Use this lookup to assess security threats from IP addresses, URLs, file hashes, and other observable types.\n            - [View Threat Lookup Reputation Calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-threat-lookup-reputation-calculators.md) -- You can view the Threat Lookup Finding Calculator to calculate the observable findings for your integration.\n          - [Threat Lookup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-threat-lookup.md) -- Scan selected observables for malware using VirusTotal and CrowdStrike Falcon Intelligence. This workflow checks observables against both threat intelligence sources and returns detailed security analysis results.\n            - [TISC VirusTotal integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-virustotal-integration_0.md) -- Request analysis of suspicious IP addresses, file hashes, and URLs through VirusTotal integration to determine if they are malicious during security investigations.\n              - [Configure and enable VirusTotal Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-virustotal-integration.md) -- Set up VirusTotal integration with Threat Intelligence Security Center to perform threat lookups on observables.\n            - [TISC CrowdStrike Falcon Intelligence integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-crowdstrike-falcon-intelligence-integration.md) -- Integrate CrowdStrike Falcon Intelligence with Security Operations to enhance threat detection and response capabilities with real-time cyber security intelligence.\n              - [Configure and enable CrowdStrike Falcon Intelligence integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/crowdstrike-intelligence.md) -- Set up CrowdStrike Falcon Intelligence integration to perform threat lookups on observables in Threat Intelligence Security Center.\n        - [TISC Security Tools integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-edr-integrations.md) -- TISC Endpoint Detection and Response (EDR) integrations focuses on identifying and addressing security threats at an endpoint level.\n          - [CrowdStrike Falcon EDR integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/crowdstrike-edr-integration.md) -- Configure CrowdStrike Falcon EDR integration to enable continuous endpoint monitoring and receive real-time security alerts based on Threat Intelligence data from TISC.\n            - [Configure Crowdstrike Falcon EDR integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/config-cs-edr-integration.md) -- Download and configure the CrowdStrike Falcon EDR integration to enable endpoint detection and response capabilities in your ServiceNow instance.\n            - [Send observables to EDR](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/send-to-edr.md) -- Send observables to the EDR security tool.\n          - [Microsoft Defender for EDR integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-ms-defender-integration.md) -- Integration with the Microsoft Defender for EDR allows Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs to Microsoft Defender for continuous monitoring and real-time alerting.\n            - [Register and configure the Microsoft Defender in the Microsoft Azure portal](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/register-and-configure-the-microsoft-defender-in-the-microsoft-azure-portal.md) -- Register the Microsoft Defender EDR in the Microsoft Azure portal and grant the read and write access to the application.\n            - [Install and configure Microsoft Defender for EDR Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-ms-defender-configure.md) -- Install and configure the Microsoft Defender for EDR integration from the ServiceNow Store.\n            - [System properties for Microsoft Defender EDR](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-defender-sys-props.md) -- The following details the system properties for Microsoft Defender EDR.\n            - [Send observables to EDR](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-ms-defend-edr.md) -- Send observables to the EDR security tool.\n          - [Firewall integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-security-tools.md) -- TISC Security Firewall prevents unauthorized access to the network. Palo Alto Networks integration with TISC helps blocking malicious IP addresses, URLs, and domains using External Dynamic List (EDL) capabilities with ServiceNow Threat Intelligence data.\n            - [Palo Alto Networks integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/palo-alto-networks-integration.md) -- Palo Alto Networks integration after configuration enables the threat analysts to add malicious IP addresses, URLs, and domains to External Dynamic List (EDL) or remove these entries from EDL after confirmation as non-malicious or clean.\n              - [Create EDL for Palo Alto Networks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/create-new-edl.md) -- Create External Dynamic List (EDLs) for Palo Alto Networks. After you create EDLs, you can start creating entries for those EDLs.\n              - [Define Palo Alto Networks Approval Rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-edl-approval-rules.md) -- Activate approval workflows to require approval or rejection of EDL entries before they take effect.\n              - [Add Observables to EDLs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/add-obsesrvables-edl.md) -- Add observables such as IP addresses, domains, and hashes to External Dynamic Lists (EDLs) to automatically update threat intelligence feeds in your security infrastructure.\n              - [Remove Observables from EDL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/remove-observables-edl.md) -- Remove observables from an External Dynamic List (EDL) to stop blocking or monitoring specific observables. Use this when observables are no longer relevant or incorrectly categorized.\n              - [Approve EDL entries for Palo Alto Networks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-approve-edl-entries.md) -- Approving External Dynamic List (EDL) entries is part of the pre configuration. You must approve the EDL entries before the entries are activated on EDLs for the firewall to retrieve the entry and apply the security policy.\n          - [TISC add-on for Splunk overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-addon-splunk.md) -- Configure the Threat Intelligence Security Center (TISC) integration with Splunk to import threat intelligence data, set up indicator collections, and analyze search matches using dashboards.\n            - [TISC integration with Splunk](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/splunk-observables-enrichment-integration.md) -- The integration between the Threat Intelligence Security Center (TISC) and Splunk lets you filter and pull relevant threat intelligence observables data into Splunk.In Splunk, you can use this data to generate security alerts.\n            - [Create users in TISC instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-users.md) -- Users can be created in the ServiceNow TISC instance with any valid user role [sn_sec_tisc.api_obs_read_access].\n            - [Configure TISC add-on in Splunk](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-configure-splunk.md) -- Configure the TISC add-on in Splunk to connect your account, define data inputs, and pull observable records into the KV store for search and analysis.\n            - [Data storage in Splunk](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-storage-splunk.md) -- Configure and retrieve Key-Value store lookups used by TISC during its integration with Splunk.\n            - [Troubleshoot the TISC add-on in Splunk](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-splunk-troubleshooting.md) -- Enable debug logging on the add-on, view the resulting log entries in Splunk, and check input execution status from the Input Metadata Lookup KV store.\n          - [Microsoft Sentinel integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-sentinel-integration.md) -- Threat Intelligence Security Center for Microsoft Sentinel offers several capabilities, including importing observables from TISC to Sentinel, enriching Sentinel incidents with details of related observables, and also allow exporting observables from Sentinel to TISC.\n            - [TISC playbook templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-playbook-templates.md) -- This section describes the playbook templates that are shipped with TISC Sentinel solution.\n    - [Administer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-data-administration.md) -- Use the left navigation to navigate to the Administration module within Threat Intelligence Security Center. View the following modules of TISC data administration to set filtering rules, approval rules, define threat score, and manage notifications.\n      - [About Rules Engine in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-admin-rules-eng.md) -- The Administration section provides access to Rules Engine module that allow the administrators to configure rule-driven processing of data within TISC.\n        - [Defining Data Imports Approval Rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/defining-data-imports-approval-rules.md) -- Use this section to define the approval rules and integrate the approval flow within the Import Intelligence section after submitting the data import.\n        - [Defining Expiration Rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-expiration-rules.md) -- Define expiration rules for various observables or a combination of various source objects or indicators source that are created in TISC.\n          - [Expiration rules for source records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-expiration-source.md) -- Expiration rules are basically helpful to set the expiration time for the source records. The aggregate record inherits the highest expiration time from its corresponding sources records.\n        - [Create Inbound Data Exclusion Rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-filtering-rules.md) -- Create inbound data exclusion rules in order to filter any type of data or any kind of incoming source records data.\n        - [Custom Threat Score Calculator in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/using-custom-threat-score-calculator.md) -- Custom Threat Score Calculator allows you to define and calculate a threat severity score of an observable based on the user defined criteria which provides a transparent intelligence scoring of observables. The threat score is auto calculated for observable records.\n          - [Define Threat Score Calculator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-score-calculator.md) -- Define threat score for the observable(s) records that are generated based on the user defined parameters. The base system is provisioned with one threat scoring rule, which can be customized and enabled accordingly.\n        - [MITRE ATT&CK Technique Extraction Rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/mitre-extraction-rules.md) -- Extract MITRE techniques automatically from observables or objects ingested from various data sources and from threat lookup results on observable records.\n          - [View extracted MITRE ATT&CK Techniques](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/mitre-extraction-method.md) -- MITRE ATT&CK Technique Extraction method describes how the extraction methods are performed and associated techniques are verified for observables, objects, and RSS feeds.\n        - [Configure Tagging Rules in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-tag-rules.md) -- Use tagging rules to automatically assign tags and taxonomies to RSS feeds. Tagging rules evaluate incoming feed data based on defined criteria and apply the appropriate tags and taxonomies when a match is found.\n          - [Automated creation of zero day vulnerability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-zero-day-vuln-scenario.md) -- A zero day vulnerability scenario demonstrates how TISC detects and manages vulnerabilities that have not yet received CVE assignments.\n      - [About Security Control Lists in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-admin-security-lists.md) -- Security Control Lists (SCLs) are predefined classification list that helps the Threat Intelligence Analysts determine how observables should be treated within the application and across security tools.\n        - [Defining Security Control Lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-security-control-lists.md) -- Use this feature to add or remove observables in bulk.\n      - [Creating Taxonomies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/create-taxonomies.md) -- Create taxonomies for the data source records.\n        - [Bulk import Taxonomies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-import-taxonomy.md) -- Import the taxonomy records.\n      - [Customize a skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/cust-now-assist-tisc-skill.md) -- Customize the ServiceNow Otto for Threat Intelligence Security Center (TISC) skills to suit your requirements.\n        - [Inputs and triggers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/input-triggers-now-assist-tisc.md) -- You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.\n      - [Customize extraction use cases](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/cust-intel-extraction-tisc.md) -- Edit the prompts in the threat intelligence extraction use cases to change how AI extracts threat entities from the documents that your analysts upload.\n      - [Managing the Threat Lookup Reputation Calculator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/manage-threat-lookup-reputation-calculator.md) -- You can use the Threat Lookup Finding Calculator to calculate the observable findings based on the responses received from threat lookup vendor.\n      - [Manage email Notifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-notifications.md) -- Use ServiceNow Notifications to create and manage system email notifications, and view email logs.\n        - [Email Notifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-email-notifications.md) -- Use email notifications to send selected users email notifications about specific tasks within the application, such as updates to observables/indicators/various other objects.\n        - [Email logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-email-logs.md) -- This section provides a clear visibility to the TISC administrators on the emails that are sent out using the configured email notification rules.\n      - [Configure report styling](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/configure-report-styling-tisc.md) -- Configure the appearance of AI-generated threat intelligence case reports by setting colors, fonts, and organizational details in the report styling record.\n        - [Report styling fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/ai-report-styling-fields-tisc.md) -- Field descriptions for the AI Report Styling Configuration form. Use these settings to configure the theme of the AI-generated threat intelligence reports.\n      - [Configure report templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-report-templates.md) -- Report templates in TISC help you generate standardized reports for cases and threat intelligence investigations. Use these templates to track ongoing security investigations and communicate threat information to different audiences.\n        - [Create Report Template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-new-report-template.md) -- Create a customized case report template to standardize how case information is documented and presented in your organization.\n        - [Edit a Published Report Template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/edit-report-templates.md) -- Customize published report templates by modifying their content fields and related lists to better meet your reporting requirements.\n        - [Duplicate a Report Template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-duplicate-template.md) -- Create a copy of a report template to make incremental updates.\n        - [System properties for TISC Reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/reports-system-properties.md) -- The following section describes the system properties applicable to TISC reports.\n      - [Working with Webhooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-webhooks.md) -- A webhook is an HTTP request, triggered by an event in the source system (TISC) and sent to a destination system (where the endpoint URL is present), with a payload of event data.\n        - [System properties for Webhooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-sysprops-retry.md) -- The system properties for webhooks are explained below.\n        - [Configure webhooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/setup-webhooks.md) -- Configure a webhook to subscribe to events in Threat Intelligence Security Center.\n          - [Subscribe Triggers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/subscribe-triggers.md) -- View the list of all the subscribed webhook triggers for the current webhook.\n          - [View webhook error logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-error-logs.md) -- Use this error logs section to view all the audit entries which are marked as error in the status for a particular webhook.\n          - [View webhook batches](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-webhook-batch.md) -- A webhook batch record is created for each webhook execution.\n        - [Webhook Triggers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-triggers.md) -- Webhook triggers are used to filter the threat intelligence entities that needs to be tracked for any event changes such as Create, Update, and Delete.\n      - [Working with automated flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-automated-flows.md) -- Use these defined steps to learn how you can use the automated flows in TISC and its capabilities.\n        - [Automated IOC Enrichment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-ioc-enrichment.md) -- Learn how to automate enrichment of IOC’s using flows when they match a certain criterion.\n        - [Automated sharing of high-risk IOC's with trusted partners](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-automated-sharing-flow.md) -- Learn how to automate sharing of high-risk IOC's with trusted partners.\n        - [Automatically add threat intelligence to a TAXII collection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-taxii-automated-flow.md) -- Learn how to automatically add threat intelligence to a TAXII server collection.\n        - [Create vulnerability assessment for zero day](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-vul-assess.md) -- Create a vulnerability assessment to evaluate and document security risks from zero day vulnerabilities in your environment. Use this when you want to assess the potential impact of newly discovered vulnerabilities that lack available patches.\n        - [Analyze, assess, and disseminate observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-disseminate-observables.md) -- Learn how to analyze and disseminate observables which are related to threat.\n        - [Analyze and assess threat IoC’s](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-analyze-ioc.md) -- Learn how to analyze an IOC’s which are a threat and notifying the security incident team.\n        - [Vulnerability Management Support](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-vul-mgmt.md) -- Learn how a new vulnerability is created in TISC with a related vulnerability in VR.\n        - [Zero-day vulnerability tracking](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-zero-vul.md) -- Learn how to analyze RSS Feeds coming into the system.\n        - [Automatic Threat Actor priority tagging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-threat-actor-priority-tagging.md) -- Learn how to enable automatic tagging of Threat Actors based on their origin locations.\n        - [Automated flows tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-flows-tables.md) -- The following tables helps you to understand the relationship tables between entities and enrichment tables that are used in automated flows.\n      - [Playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-playbooks-admin.md) -- Playbooks in Threat Intelligence Security Center are structured, automated workflows that guide threat response from detection to resolution. Administrators configure, activate, and manage playbooks to standardize how analysts handle threat cases.\n        - [Activate the Threat Hunting Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-activate-threat-hunt-playbook.md) -- By default, the Threat Hunting playbook is deactivated. Activate it in Workflow Studio to initiate the playbook automatically for the applicable Case records.\n      - [Configure tooltips for nodemaps](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-config-tooltip-nodemaps.md) -- Use this section to configure tooltips for node map relationships on the investigation canvas.\n        - [Configure Custom Event Types for Timeline](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-config-timeline.md) -- The Timeline component in the investigation canvas provides a chronological overview of all events related to a selected entity. This feature enables analysts to track actions, updates, and changes over time, offering a comprehensive historical perspective of the entity’s activity. As a result, it supports effective temporal threat analysis.\n        - [Configure tooltips for nodemaps](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-config-tooltip-nodemaps.md) -- Use this section to configure tooltips for node map relationships on the investigation canvas.\n      - [Configuring Threat Intelligence External Sharing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-intel-sharing.md) -- Threat Intelligence external sharing in TISC outlines the guidelines and functionalities for both automated and sharing from GUI of threat intelligence within and across organizations. This feature focuses on key areas such as sharing exclusion rules, approvals, data retention, and auditing to confirm secure, compliant, and efficient intelligence sharing.\n        - [Exploring Outbound Intel Sharing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-outbound-intel-sharing.md) -- Using Outbound Sharing intelligence, you can define and share what threat intelligence entities and attributes, exclusion rules, profiles and groups, and approval rules that can be shared externally and internally.\n          - [Configuring Outbound Intel Sharing Controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-outbound-sharing.md) -- Use this section to configure outbound sharing controls, which determine the entities enabled for intelligence sharing from TISC to external systems.\n          - [Configuring Outbound Intel Data Exclusion Rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-outbound-data-exclusion.md) -- Use this section to create exclusion rules, which can be configured by TISC admin to restrict sharing of records that match the defined criteria.\n          - [Configuring Outbound Intel Sharing Profiles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-outbound-sharing-profiles.md) -- Use this section to create new Outbound Intelligence Profiles. The outbound intelligence profiles specify the endpoint details to which threat intelligence data is sent.\n          - [Configuring Outbound Intel Sharing Groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-config-inbound-sharing-groups.md) -- Outbound Intel Sharing Groups allow you to combine multiple profiles and use them collectively when sharing data.\n          - [Defining Approval Rule for Outbound Intel](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-approval-outbound-intel.md) -- Define approval rules to control whether certain users require approval before sharing the shared intelligence.\n          - [Configuring Outbound Intel Sharing Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-intel-sharing-templates.md) -- Outbound Intel Sharing Templates enable you to define and control the data shared externally from the Threat Intelligence Security Center (TISC).\n          - [Working on the Redaction Library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-redaction-library.md) -- Redaction is the process of replacing sensitive information from shared data to protect confidentiality during intelligence sharing.\n            - [Bulk Import of Redaction Categories and Values](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-bulk-import-redaction.md) -- Import redaction categories. Bulk importing of redaction categories and their associated values.\n        - [Exploring Inbound Intel Sharing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-inbound-intel-sharing.md) -- Inbound intelligence sharing in TISC allows you to create profiles of external systems or devices that can submit intelligence to it.\n          - [Configuring Inbound Intel Sharing Profiles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-config-inbound-profile.md) -- This section describes the inbound intelligence sharing profiles used to receive intelligence from external organizations into TISC.\n          - [Configuring Inbound Intel Sharing Groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-config-inbound-groups.md) -- Inbound Intel Sharing Groups enable administrators to group similar inbound intelligence sharing profiles together. These groups can be used to define approval rules that apply to all profiles within the group.\n          - [Defining Approval Rule for Inbound Intel](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-approval-inbound-intel.md) -- Define approval rules to control whether certain profiles or groups require approval before processing the inbound intelligence.\n        - [Exploring TAXII Outbound Server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-taxii-outbound-server.md) -- TAXII collections are logical groupings of threat intelligence data.\n          - [Create TAXII Collection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-taxii-collection.md) -- Use this section to learn how to configure and define TAXII collections for sharing intelligence.\n          - [Automated Sharing of TAXII Collections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-automated-share-taxii.md) -- Automated TAXII Collections automatically add intelligence records to TAXII Server Collections for seamless distribution to trusted external partners.\n          - [Viewing TAXII Collection Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-view-taxii-collection.md) -- View the records that are added to the TAXII collections.\n      - [Viewing Threat Intelligence External Sharing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-intel-sharing-module.md) -- Threat intelligence sharing provide a centralized view of various threat data sharing sources. The feature allows you to monitor the threat records that are being processed for intelligence sharing and manage the approval workflows for different types of intelligence data.\n        - [Viewing Outbound Intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-view-outbound-intel.md) -- Use this section to view all outbound intelligence sharing records. Review the intelligence data and take necessary actions to approve or reject them.\n        - [Viewing Inbound Intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-view-inbound-intel.md) -- Use this section to view all inbound intelligence sharing records. Review the intelligence data and take necessary actions to approve or reject them.\n        - [Viewing TAXII Collections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-view-taxii-collections.md) -- Use this section to view the TAXII collections that are configured as part of TAXII Outbound Server.\n      - [Share Threat Intelligence data between TISC instances](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-config-sharing-instances.md) -- You can share threat intelligence data between TISC instances using one of the following methods.\n        - [Manual and Automated Sharing using flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-manual-automated-sharing.md) -- This section describes how to configure manual sharing via GUI and automated intelligence sharing between TISC instances. It outlines the setup of inbound and outbound intelligence profiles, required roles, authentication configuration, and exclusion rules in both the source and target instances.\n          - [Template Configuration for Intelligence Sharing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-template-config-sharing.md) -- Create and publish an outbound intelligence sharing template to define how threat intelligence is shared from the source TISC instance to the target instance.\n        - [Sharing intelligence using TAXII Server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-sharing-intel-taxii-server.md) -- You can retrieve threat intelligence from a source TISC instance into a target TISC instance using TAXII collections. This process requires configuration in both the source and target instances.\n      - [Sharing of Outbound Intelligence Records from GUI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-intel-records-lib.md) -- This section outlines the functionality that enables users to share intelligence records directly from the Threat Intelligence (TI) Library within the TISC application.\n      - [Add to TAXII Collections from Library List View](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-obs-add-taxii-collects.md) -- Add to TAXII Collections feature enables analysts to add the selected threat intelligence including observables, indicators, and objects such as attack patterns, threat actors and so on directly to TAXII collections.\n      - [Threat Intelligence Sharing Approval Workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-sharing-approval-flow.md) -- This section outlines the various approval levels required when sharing intelligence data with external organizations.\n      - [Automated Sharing of Outbound Intelligence Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-automated-outbound-intel-share.md) -- Automated Outbound Intelligence Sharing enables the seamless and automatic distribution of intelligence records to external systems.\n      - [Viewing Redaction Imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-radaction-imports.md) -- Redaction Imports allow you to view all records currently being processed in import jobs, as well as any import jobs that are pending approval.\n        - [View all Redaction Imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-view-redaction-imports.md) -- Use this section to view all redaction-imported records.\n        - [View my Redaction Imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-my-redaction-imports.md) -- Use this section to view import records created by the currently logged-in user.\n    - [Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-reference.md) -- Reference topics provide additional information about the Threat Intelligence Security Center.\n      - [Domain separation and Threat Intelligence Security Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-domain-separation.md) -- If any conkeyrefs are broken, re-add them from the doc/source/reuse/domain-separation/domain-separation-overview.dita file.Domain separation is supported for Threat Intelligence Security Center. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.\n      - [Threat Intelligence Security Center Knowledge Base articles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-kb-articles.md) -- This section provides a curated list of key Knowledge Base (KB) articles related to Threat Intelligence Security Center (TISC). These resources include best practices, configuration guidance, compatibility information, and operational workflows to help you effectively manage threat intelligence and security within TISC.\n      - [TISC API References](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-api-references.md) -- The following table lists all the available API endpoints provided as part of TISC.\n      - [Components installed with Threat Intelligence Security Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-components-installed.md) -- Several types of components are installed when you download and activate the Threat Intelligence Security Center application, including user roles and properties.\n    - [Use](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/using-tisc.md) -- Use Threat Intelligence Security Center to manage Threat Intelligence library records, import external threat data, and streamline case management. It helps security teams centralize intelligence data, enhance analysis, and respond more effectively to threats by integrating the relevant information into ongoing investigations.\n      - [TISC integration with SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-integration-with-sir-workspace.md) -- TISC integration with SIR Workspace provides threat intelligence context for observables and threat entities in the security incident workspace.\n      - [Working with Data Imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/working-with-data-imports.md) -- Data imports allows you to view the all the records that are being processed for import job and also lists the import jobs that are awaiting approvals.\n        - [Viewing all imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/viewing-all-imports.md) -- Use this section to view all the imported records that are displayed in the list view for all the users.\n        - [Viewing my imports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/viewing-my-imports.md) -- Use this section to view the import records that are created by the logged in user.\n        - [Viewing my approvals](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/viewing-my-approvals.md) -- Use this section to review and approve the import job records.\n      - [Import Intelligence in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/importing-threat-intelligence.md) -- Use this feature to manually import threat intelligence data into the repository, enabling analysts to ingest the relevant information from external sources as needed.\n        - [Import data using structured file](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/import-data-using-structured-file.md) -- Upload the structured data in the supported file formats such as CSV, XLSX or XLS.\n        - [Import data using standard format](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/import-data-using-standard-format.md) -- Upload the standard data in the supported file formats such as STIX 2.x JSON, MISP JSON.\n        - [Import data using raw text](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/import-data-using-pasted-text.md) -- Import the observables data by copying and pasting raw text or entering the free text.\n        - [Import data using unstructured file format](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/import-data-using-unstructured-file.md) -- Upload the data in an unstructured format supported using the file formats such as TXT, CSV, JSON, XLS, XLSX.\n        - [Import data using AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/import-data-using-ai.md) -- Upload an unstructured document and let AI extract the threat observables and objects from its content. Review and correct the extracted entities before you submit the import.\n          - [AI extraction reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-ai-extraction-fields.md) -- Threat entity types that AI extraction identifies in an uploaded document, and the AI-generated fields that it adds to the extracted records.\n      - [Threat Analyst Workbench](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-analyst-workbench.md) -- The Threat Analyst Workbench page consists of cases and case tasks that are under Threat Analysts and their team.\n        - [Workbench Overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/workbench-overview.md) -- The Workbench Overview page consists of the Case Tasks and Cases that are under Threat Analysts and their team.\n        - [Creating cases using Threat Analyst Workbench](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/create-cases-using-threat-analyst-workbench.md) -- Cases are used to track information about a campaign or threat actor threatening your organization. After a case is created, you can add artifacts that allow you to review and analyze all related information from a single case or case task.\n          - [Enforced Restrictions for case(s)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-enforced-restrictions.md) -- Use this feature to restrict a case and provide list of groups and users who can access it.\n            - [Access controls for a case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-access-controls.md) -- Allow access controls specific to a case.\n            - [External user access for case tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-external-users-access.md) -- This section describes the external user access for case tasks.\n          - [Associate MITRE Techniques to a Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-associate-mitre-technique.md) -- Associate one or more MITRE technique to a case.\n          - [Roll up of MITRE technique associations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-mitre-roll-up.md) -- Roll up of MITRE technique associations from observables, indicators, objects, and security incidents which are linked or unlinked from a case record.\n        - [Summarize a case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/now-assist-tisc-case-summarization.md) -- Use to generate a concise summary of a case, including its key findings and recommended next steps.\n        - [Creating case task using Threat Analyst Workbench](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-case-task.md) -- Create case tasks to associate with case(s).\n        - [Working with Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-investigation-canvases.md) -- The Investigation Canvas is a key significant feature, which provides more valuable information for the Threat Intelligence (TI) analysts. It provides a structured framework by mapping one to one or one to many relationships and visualizing information related to observables, indicators of compromise (IOCs), or entities.\n          - [Working with Actions on the Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-canvas-actions.md) -- This section describes the various actions that you can perform on the investigation canvas.\n          - [Linking an existing case from Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-link-existing-case-canvas.md) -- Use this section to link an existing case from the investigation canvas.\n          - [Creating a Case and Linking from Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-link-case.md) -- Use this section to create and link a case(s) from an investigation canvas.\n          - [Linking Canvas from a Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-link-canvas-from-case.md) -- Use this section to link a canvas from a case.\n          - [Creating an investigation canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-canvas.md) -- Create canvas to add observables from threat intelligence library.\n          - [Adding a new node to the canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-add-node-canvas.md) -- Use this section to create and add new entities, including observables or objects, directly from the investigation canvas.\n          - [Using Timeline in Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-timeline-events.md) -- The Timeline feature of the Investigation Canvas within the Threat Intelligence Security Center (TISC) empowers analysts to visualize, create, and edit timeline events associated to entities during investigations. This capability significantly enhances the effectiveness of temporal analysis.\n            - [Adding Timeline Events to the Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-add-timeline-events.md) -- Add timeline events to the investigation canvas by adding the related entities to the canvas.\n          - [Investigation canvas and MITRE ATT&CK](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/investigation-and-mitre.md) -- In the Investigation Canvas, you can view the MITRE ATT&CK techniques and sub-techniques associated with all nodes currently present on the canvas.\n            - [Investigation Canvas MITRE Filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-mitre-filters.md) -- MITRE filters enables you to create and save filters for Tactics, Techniques, and Procedures (TTPs) associated with specific adversaries and other MITRE technique attributes.\n        - [Add artifacts to cases or case tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/add-artifacts-to-a-case-s.md) -- After you have created a case, you can view or add artifacts, such as security incidents, CIs, and indicators of compromise, to the case. These artifacts act as clues in solving the case.\n          - [Roll up of MITRE Techniques from Artifacts to Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/roll-up-mitre-case.md) -- When intelligence records are added to a case, all associated MITRE Techniques are automatically rolled up to the case level.\n          - [Show MITRE ATT&CK Framework for a Case(s)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-show-mitre-fw.md) -- Displays all the associated techniques of a case on the MITRE ATT&CK framework.\n        - [Run Enrichment Actions within a case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/run-enrichment-results.md) -- Use this section to understand how enrichments actions are performed on case(s).\n        - [Generate a Case Report using generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/na-tisc-generate-ai-reports.md) -- Generate an AI-based, structured, threat intelligence case report from the data in a case and export it for stakeholder distribution.\n        - [Generate a Case Report using a template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-case-reports.md) -- Use a predefined report template to generate case reports. These reports include post investigation report or an executive summary report.\n        - [Create a security incident from a TISC case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-si-case.md) -- Create security incidents and associate observables to the security incidents from a TISC case.\n        - [Upload Secure File Attachments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/secure-file-attachments.md) -- Use this section to understand on how to upload the secure file attachments to the case(s).\n        - [Using playbooks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-playbooks-analyst.md) -- Playbooks in Threat Intelligence Security Center guide analysts through structured threat investigation stages. Each stage defines the actions to complete before the case advances to the next phase of the response process.\n          - [Threat Hunting Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-threat-hunt-playbook.md) -- The Threat Hunting playbook is a guided workflow for a TISC Case record that helps analysts move a threat hunt from an initial hypothesis to a final outcome.\n            - [Use the Threat Hunting Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-use-threat-hunt-playbook.md) -- Run threat hunt on a Case record — from capturing the hunt hypothesis through to creating a Security incident or reporting.\n            - [Add the Threat Hunting Playbook to a Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-add-playbook-manually.md) -- If a Case does not meet the auto-trigger conditions for the Threat Hunting playbook, you can attach the playbook to the Case manually.\n      - [Threat Intel Library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-intelligence-security-center-library.md) -- A threat library is defined as a group of organized objects and entities that serve the organizations with structured and unstructured security threat information.\n        - [TISC Data Model](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/understanding-the-data-model.md) -- The data model and architecture of threat intelligence security center module is designed to support threat intelligence platform capabilities and different security views that provides detailed data for threat analysts.\n        - [TISC Library Objects form view](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-library-home-page-view.md) -- The Threat Intelligence Security Center objects home page consists of the following features.\n        - [TISC Library Repository](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-ioc.md) -- IoC repository contains STIX objects, each of these objects contain a specific piece of information.\n          - [Observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/observables.md) -- Observables represent stateful properties (such as the MD5 hash of a file or the value of a registry key) or measurable events (such as the creation of a registry key or the deletion of a file) that are pertinent to the operation of computers and networks.\n            - [Define an Observable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-an-observable.md) -- Observables can be retrieved from scheduled feed ingestion or from the import assistant. However, you can create observables, as needed.\n            - [Observables source records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-observables-source-records.md) -- The source records contribute to an aggregated record as displayed in the form view. These source records are auto created from feeds, extracted from indicator patterns, or manually created by the user.\n            - [Link Threat Intel Related Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/link-threat-intel-releated-records.md) -- Link the records that are related to the corresponding threat intelligence objects.\n            - [Create a related record to link](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-new-related-record.md) -- Create a threat intelligence record directly from a related records list and link it to the record that you're viewing, without leaving your investigation.\n            - [Fetch Observables Data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/fetch-observables-data.md) -- Fetch the observables related records data.\n            - [View details in Visualizer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/objects-visualizer.md) -- Using the Visualizer, you can view the relationships between objects, observables and indicators which provides context for you to further investigate. The Visualizer uses colors and icons to illustrate various information about the objects.\n              - [Link nodes in the Relationship Graph](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-link-nodes.md) -- Use Relationship Graph to link the nodes. Use filters to select specific nodes to investigate.\n            - [Working with Internal Intelligence Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/working-with-ti-internal-intelligence-records.md) -- Use this feature to work with the internal intelligence data that is collected from Configuration Database Management System (CMDB) into Threat Intelligence Security Center.\n              - [View Internal Intelligence Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/view-internal-intelligence-records.md) -- View the internal intelligence records collected from CMDB, Security Incident Response (SIR), Vulnerability Response (VR) these records.\n            - [Run Enrichment Actions from Observable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/run-enrichment-actions-from-observable.md) -- Use this section to understand how enrichments actions are performed on observables and other objects.\n            - [Add to Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/add-to-case.md) -- Add observables, indicators, or other objects to the case.\n            - [Run Enrichment operations in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-unified-experience-capabilities-and-modal-screens.md) -- The following table below describes the interactions involved in running different enrichment operations from TISC.\n              - [Observable Enrichment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-observable-enrichment.md) -- The Enrich Observable WhoIs workflow performs enrichment on selected observables. If the observables are of a type recognized by the WhoisXML API Integration, the observables are enriched.\n                - [Run Have I Been Pwned enrichment integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-hibp-enrichment-integration.md) -- Run the Have I Been Pwned (HIBP) enrichment on an email address or domain name observable to determine whether it has been involved in a known data breach.\n                - [Whois integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-whoisxml-integration.md) -- Submit Whois lookups on domain names and URLs to gather threat intelligence and assess potential security risks. Use this integration to obtain registration details, ownership information, and other contextual data for suspicious domains.\n                  - [Configure and enable Whois integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-whoisxml-api-integration.md) -- Set up WHOIS integration with TISC to perform domain and URL lookups for threat intelligence enrichment. This integration provides context on observables to help determine potential threats.\n                - [Shodan integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-shodan.md) -- Configure Shodan integration to enable automated discovery and analysis of internet-connected devices in your network infrastructure.\n                  - [Configure and enable Shodan integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/shodan-integration.md) -- Before you use Shodan integration, you must download it from the ServiceNow Store.\n              - [Run Threat Lookup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-run-threat-lookup.md) -- Select one or more implementations as applicable to run threat lookup on observables.\n              - [Run Sighting Search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-run-sighting-search.md) -- Perform Run Sighting Search related integration.\n              - [Run Observable Enrichment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-run-observable-enrichment.md) -- Select one or more implementations as applicable to run threat lookup on observables.\n            - [View Enrichment Results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-view-enrichment-results.md) -- View observables, indicators, and various objects enrichment results.\n          - [Indicators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/indicator.md) -- Indicators are artifacts observed on a network or operating system that are likely to indicate an intrusion. Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or domain names.\n            - [Define an Indicator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-an-indicator.md) -- Define an Indicator.\n            - [Observable extraction from indicator patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-extract-observables-from-indicators.md) -- Threat Intelligence Security Center extracts observables from indicators that use the STIX pattern type and links the extracted observables back to the source indicator.\n          - [Threat Entities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-threat-entities.md) -- The Threat Entities module provides structured records used to manage threat intelligence objects in the TISC. These records align with STIX domain object concepts and help standardize how threat activity is documented and analyzed.\n            - [Attack Patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-attack-patterns.md) -- Attack patterns are a type of Tactics, Techniques, and Procedures (TTPs) that describe the methods that adversaries attempt to compromise targets.\n              - [Define an attack pattern](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-define-an-attack-pattern.md) -- Define an attack pattern to help threat analysts categorize the attacks.\n            - [Campaign](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/campaign.md) -- Campaign is defined as grouping of adversarial behaviors that describes a set of malicious activities or attacks, sometimes called waves that occur over a period of time against a specific set of targets.\n              - [Define Campaign](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-define-campaign.md) -- Define a campaign to group adversarial behaviors.\n            - [Courses of Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/course-of-action.md) -- Courses of action is an action taken either to prevent an attack or to respond to an attack that is in progress.\n              - [Define Courses of Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-course-of-action.md) -- Define courses of action to prevent an attack or to respond to an attack that is in progress.\n            - [Identity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/identity.md) -- Identities represent actual individuals, organizations or groups, and classes of individuals, systems, or groups. Identities apply for STIX 2.x.\n              - [Define identities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-identity.md) -- Define identities who represent actual individuals, organizations, or groups.\n            - [Infrastructure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/infrastructure.md) -- The Infrastructure SDO represents a type of Tactics, Techniques, and Procedures (TTPs). They describe any systems, software services, and any associated physical or virtual resources intended to support some purpose of an attack. Infrastructure applies for STIX 2.x.\n              - [Define infrastructure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-define-infrastructure.md) -- Define an Infrastructure that is any systems, software services, and any associated physical or virtual resources intended to support some purpose of an attack.\n            - [Intrusion Set](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/intrusion-set.md) -- An Intrusion Set is a grouped set of adversarial behaviors and resources with common properties. An Intrusion Set usually involves a single organization. Intrusion set applies for STIX 2.x.\n              - [Define Intrusion Set](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-define-intrusion-set.md) -- Define an intrusion set that is a grouped set of adversarial behaviors and resources with common properties.\n            - [Location](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/location.md) -- A Location represents a geographic location. Locations are primarily used to give context to other SDOs. Locations apply for STIX 2.x.\n              - [Define Location](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-define-location.md) -- Define a geographic location to provide more context to other STIX Domain Objects (SDOs).\n            - [Malware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/malware.md) -- Malware is a type of TTP that represents malicious code. It refers to a program that is covertly inserted into a system. Malware applies for STIX 2.x.\n              - [Define Malware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-define-malware.md) -- Define a malware that represents malicious code.\n            - [Malware Analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/malware-analysis.md) -- Malware Analysis captures the metadata and results of a malware. Malware analysis applies for STIX 2.x.\n              - [Define Malware Analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-define-malware-analysis.md) -- Define malware analysis that captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.\n            - [Marking Definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/marking-definition.md) -- The marking-definition object represents a specific marking. Data markings typically represent handling or sharing requirements for data.\n              - [Define Marking Definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-market-definition.md) -- Define marking definitions to handle and share the requirements for the data.\n            - [Object Sighting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/object-sighting.md) -- Sightings denote that an object was seen. Objects may be a malware, tool, threat actor, and so on.\n              - [Define Object Sighting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-object-sighting.md) -- Define object sighting that describes that an object (malware, tool, threat actor, and so on) was seen.\n            - [Observed Data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-observed-data.md) -- Observed Data conveys information about cyber security-related entities such as files, systems, and networks using the STIX Cyber-observable Objects (SCOs). Observed data applies for STIX 2.x.\n              - [Define Observed Data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-observed-data.md) -- Conveys information about cyber security related entities such as files, systems, and networks using the STIX Cyber-observable Objects (SCOs).\n            - [Threat Actor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-actor.md) -- Threat Actors are individuals, groups, or organizations who act with malicious intent. Threat actors applies for STIX 2.x.\n              - [Define Threat Actor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-threat-actor.md) -- Define threat actors who are individuals, groups, or organizations who act with malicious intent.\n            - [Threat Event](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-event.md) -- An event or situation that has the potential for causing undesirable consequences or impact.\n              - [Define Threat Event](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-threat-event.md) -- Define a threat event when an event that results in unauthorized access to and acquisition of nonpublic information or the disruption or misuse of any information system.\n            - [Threat Grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-grouping.md) -- A Threat Groupings object explicitly asserts that the referenced STIX Objects have a shared context. Threat groupings applies for STIX 2.x.\n              - [Define Threat Grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-threat-grouping.md) -- Define threat groupings as objects that have a shared context.\n            - [Threat Note](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-note.md) -- A Threat Note conveys informative text to provide additional analysis not contained in the STIX Objects, Marking Definition objects, or Language Content objects which the Note relates to. Threat notes applies for STIX 2.x.\n              - [Define Threat Note](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-threat-note.md) -- Define threat notes that convey information to provide further context or analysis that is not available in existing objects.\n            - [Threat Opinion](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-opinion.md) -- An Opinion is an assessment of the accuracy of the information in a STIX Object produced by a different entity. Threat opinions apply for STIX 2.x.\n              - [Define Threat Opinion](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-threat-opinion.md) -- Define threat opinions as an assessment of the accuracy of the information in a STIX object.\n            - [Threat Report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/threat-report.md) -- Threat Reports are collections of threat intelligence focused on one or more topics. Threat reports apply for STIX 2.x.\n              - [Define Threat Report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-threat-report.md) -- Define threat reports that describe a threat actor, malware, attack technique, including context and related details.\n            - [Tools](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tool.md) -- Tools are legitimate software that are used by threat actors to perform attacks. Tools apply for STIX 2.x.\n              - [Define Tools](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-tool.md) -- Define tools as legitimate software that is used to perform attacks.\n          - [Other Objects](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-other-objects.md) -- Define and manage data classifications within TISC.\n            - [Data Component](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/data-component.md) -- Data components are used to identify specific properties or values of a data source.\n              - [Define Data Component](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-data-component.md) -- Define a data component to identify the properties or values of a data source\n            - [Data Sources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/data-sources.md) -- Data sources represent the various subjects/topics of information that can be collected by sensors/logs. Data sources also include data components, which identify specific properties/values of a data source.\n              - [Define Data Sources](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-data-sources.md) -- Define a data source to represent the various subjects or topics of information.\n          - [Vulnerability Artifacts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/vulnerability.md) -- A Vulnerability is a weakness or defect in a software or hardware component that attackers exploit. Vulnerabilities apply for STIX 2.x.\n            - [Define Vulnerability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-vulnerability.md) -- A vulnerability is a weakness or flaw in a software or hardware component that can be exploited by attackers to compromise confidentiality, integrity, or availability.\n            - [Create a CWE record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-cwe-record.md) -- Create a Common Weakness Enumeration (CWE) record to represent a weakness identified in a system or product, and link it to relevant vulnerabilities.\n            - [Create a Product](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-product.md) -- Create New Product feature allows you to record the product’s version, vendor, and classification details, to ensure products are accurately linked to vulnerabilities and related records.\n            - [Create a Vendor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-add-vendor-to-vul.md) -- Create a vendor record to track organizations that supply products affected by vulnerabilities. Associate vendors with products or add vendor comments to document their responses and remediation guidance.\n            - [Create Remediations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-remediation-record.md) -- Create a remediation record to document a fix or workaround for a vulnerability affecting a specific product.\n            - [Access the Vulnerability Entities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/access-the-vulnerability-entities.md) -- The TISC uses the following entities to store and organize vulnerability, product, and vendor intelligence data.\n            - [Fetch Vulnerability Data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/fetch-vulnerability-data.md) -- Fetch vulnerability related data such as configuration items, vulnerable entries, and business context.\n          - [View RSS Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-rss-feeds.md) -- A threat intelligence feed is a real-time, continuous data stream that gathers information related to cyber risks or threats. RSS Feeds provides an easy way to stay up to date with your favorite security blogs or latest cyber security news.\n          - [Working with Reports in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-reports-lib-view.md) -- The Reports module in the Threat Intelligence Library section enables you to create, manage, and publish reports that use any intelligence available in the Threat Intelligence Library.\n            - [View All Reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-reports.md) -- Use this section to view all the list of reports.\n            - [View Case Reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-case-reports.md) -- View Case Reports.\n            - [Create Case Reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-case-report.md) -- Create a case report from the Reports module in Threat Intel Library.\n              - [Create a Case Report using generative AI](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-case-report-ai.md) -- Use generative AI to draft a structured case report from the data in the selected case, then review and publish it.\n              - [Create a Case Report using a template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-case-report-template.md) -- Generate a case report from a published report template, such as a post-investigation report or an executive summary, and then preview, publish, and share it.\n            - [View Intelligence Reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-view-intel-reports.md) -- View intelligence reports.\n            - [Create an intelligence report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-intelligence-report.md) -- Create an intelligence report from the Reports module in the Threat Intelligence Library by using a published intelligence template and populating it with intelligence from library lists and slash commands, independent of a case.\n            - [View my reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-view-my-reports.md) -- View the reports that you created.\n          - [MITRE-ATT&CK repository](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-mitre-att-ck-framework-overview.md) -- The MITRE-ATT&CK repository stores MITRE data separately from Threat Intel Library data in the Intelligence Library.\n            - [Manage Matrices](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-manage-matrices.md) -- Manage the matrices that are imported from the MITRE TAXII collections. Matrices are a collection of tactics and techniques. You can view the matrices to review if your collections are available in the MITRE-ATT&CK repository.\n            - [Manage Techniques](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-manage-techniques.md) -- Manage the techniques that are imported from the MITRE TAXII collections. The techniques contain various ways attackers have developed to employ a given tactic. You can review and deactivate techniques that are not relevant to your organization. In STIX, techniques are known as attack patterns.\n            - [Review revoked pairs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-review-revoked-mitre-associations.md) -- Review the tactic and technique pairs that MITRE no longer maps, then delete or remap the entity and case associations that were created from them.\n              - [Revoked MITRE tactic-technique field reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-mitre-revoked-review-fields.md) -- Fields on the review record that MITRE ingestion creates for a revoked tactic and technique pair, and the values that each field can hold.\n            - [Manage Mitigations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-manage-mitigations.md) -- Manage the mitigations that are imported from the MITRE TAXII collections. Mitigations enable you to prevent an adversary from successfully executing techniques or sub-techniques against your organization. In STIX, mitigations are known as course of actions.\n            - [Manage Groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-manage-groups.md) -- Manage the groups that are imported from the MITRE TAXII collections. Groups are sets of related intrusion activity that are tracked by a common name in the security community. Analysts track clusters of activities using various terms such as threat groups, activity groups, threat actors, intrusion sets, and campaigns. In STIX, groups are known as intrusion sets.\n            - [Manage Malware](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-manage-malware.md) -- Manage the malware information that you imported from the MITRE TAXII collections. It is a type of TTP that represents malicious code.\n            - [Manage Tools](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-mitre-manage-tools.md) -- Manage the tools information that you imported from the MITRE TAXII collections. Tools are legitimate software that are used by threat actors to perform attacks.\n            - [Manage MITRE Relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-mitre-manage-relationships.md) -- Manage the MITRE relationships information that you imported from the MITRE TAXII collections.\n          - [Relationships Objects](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/relationship-objects.md) -- Use the relationships objects to link together two observables or an observable and SDO to explain how they relate to each other.\n            - [Define observable-observable relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-observable-observable.md) -- Define relationships between observables.\n            - [Define object-object relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-object-object-relationships.md) -- Define relationships between SDOs, except the indicator object.\n            - [Define object-observable relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-object-observable-relationships.md) -- Define relationships between SDOs and the observable object (SCO).\n            - [Define object-indicator relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-object-indicator-relationships.md) -- Define relationships between the indicator object and other SDOs.\n            - [Define indicator-indicator relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-indicator-indicator-relationships.md) -- Define relationships between the indicator object and other Use the relationships objects to link together two observables or an observable and SDO to explain how they relate to each other..\n          - [Potential Relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/potential-relationships.md) -- The application uses automated correlation to establish potentially possible relationships between two SDOs, two Observables or an observable and SDO.\n            - [Confirm observable-observable potential relationship](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-observable-observable-potential-relationship.md) -- Use this section to confirm the relationships between the observables.\n            - [Confirm object-object potential relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-object-object-potential-relationships.md) -- Define the potential relationships between the objects.\n            - [Confirm indicator-indicator potential relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/define-indicator-indicator-potential-relationships.md) -- Define the potential relationships between the objects.\n          - [Vulnerability relationship mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-vul-relationship-map.md) -- Use many-to-many (M2M) relationship records to map connections between vulnerabilities and other entities.\n        - [Access Vulnerability Downstream actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/downstream-actions-from-the-vulnerability-form-view.md) -- Access all downstream actions generated from a vulnerability record to track remediation progress and understand the scope of response activities.\n          - [Create Vulnerability Assessment from a Vulnerability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-vul-assess.md) -- Use this feature to conduct a vulnerability assessment for a specific vulnerability.\n          - [Create Security Incident from a Vulnerability Record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-create-security-incident.md) -- Create a security incident to track and manage remediation efforts for identified vulnerabilities. This process helps prioritize security responses and maintain audit trails.\n        - [Deleting threat intelligence library records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-delete-lib-records.md) -- Delete threat intelligence library records such as observables, indicators, and objects.\n        - [Export intelligence data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-export-observables.md) -- Use the export feature to manually export the intelligence data in various formats.\n        - [Confirm Potential Relationships from Related Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/confirm-potential-relationships.md) -- Confirm the relationships between the two SDOs.\n        - [Automated correlation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/automated-correlation-rules.md) -- Automated correlation automatically establishes relationships between threat intelligence records based on predefined rules, helping you identify connections between observables, indicators, and threat objects.\n          - [Configure correlation rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/configure-correlation-rules.md) -- Enable or disable the Correlation rules or customize them according to your business requirements.\n          - [Configure potential relationship table limits](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-update-potential-relationship-record-limit.md) -- Configure the maximum potential relationship records that automated correlation can create. By default, each potential relationship table has a limit of 1,000,000 records for each domain.\n      - [Working with Data Exports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-data-exports.md) -- Threat Intelligence Security Center supports manual export of observables, indicators, and cases in the recommended formats.\n        - [View all exports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-all-exports.md) -- Use this section to view all the manually exported records.\n        - [View my exports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-view-my-exports.md) -- View and download the exports you are authorized to access.\n        - [Export intelligence system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-export-threat-intell.md) -- This section describes the record limitations and its properties while exporting data.\n      - [Data migration in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-data-migration.md) -- Data migration is a process when you move all your data from a classic UI to TISC.\n        - [Data migration from SIR TI to TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-data-migration-job-config.md) -- Data Migration Job Configuration in TISC enables you to move the existing Threat intelligence plugin data to TISC plugin data directly.\n      - [TISC Data Processing Functional Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-data-processing-functional-flow.md) -- Threat Intelligence Security Center (TISC) provides a solution that automates the data collection and processing which helps reduce the burden on Threat Intel Analysts by avoiding manual steps involved.\n      - [TISC Data archival and cleanup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/data-archival-process.md) -- Data grows rapidly in tables with increased adoption of the platform. Some tables come within the base system with various data management policies, but other users are needed to implemented by themselves.\n        - [TISC Data Archival](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-data-archival.md) -- The Threat Intelligence Security Center is provisioned with archival rules in the base system for the TISC table. The related records are also added in the base system to the TISC archive rule.\n          - [Archive TISC related records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-releated-records.md) -- Use the Archive Related Records related list for TISC to add the related records to the archive rule.\n          - [Destroy Rules in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/tisc-destroy-rules.md) -- View the destroy rules that are provisioned in the base system.\n        - [Delete intelligence records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/remove-intelligence-records.md) -- Delete records from Threat Intelligence library.\n        - [Automated cleanup of duplicate records from same source](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/threat-intelligence-security-center/duplicate-handling-of-records-from-the-same-source.md) -- The TISC application includes automated logic to manage records that were received repeatedly from the same source. When identical or matching records are ingested multiple times from same source, the application ensures that the most recent record remains active while previously stored instances are identified as duplicates.\n  - [Data Loss Prevention Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/dlp-landing.md) -- The Data Loss Prevention Incident Response (DLP IR) application enables you to review and manage the remediation workflow of DLP incidents from multiple sources, such as endpoint, network, email, and cloud.\n    - [Explore](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/exploring-dlp.md) -- Explore Data Loss Prevention Incident Response application to learn how to manage sensitive information for your customers, such as the financial and proprietary data, health records, or social security numbers.\n      - [DLP Incident Response overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/understanding-data-loss-prevention.md) -- Learn how you can use the ServiceNow AI Platform and the Data Loss Prevention Incident Response (DLP IR) application. Manage sensitive information for your customers, such as the financial and proprietary data, health records, or social security numbers. Automate the remediation workflows with the DLP Incident Response application.\n      - [Get started with DLP Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/get-started-with-dlp.md) -- Review the following information before you start setting up your Data Loss Prevention Incident Response (DLP IR) application.\n    - [Configure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/install-dlp.md) -- Download the Data Loss Prevention Incident Response (DLP IR) application from the ServiceNow Store and install it on your instance.\n      - [Install and configure the DLP Incident Response application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/install-data-loss-prevention.md) -- Manage sensitive information and automate the remediation workflows by using the Data Loss Prevention Incident Response (DLP IR) application in your ServiceNow AI Platform instance.\n      - [Domain separation and DLP Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/domain-separation-and-dlp.md) -- You can use domain separation with DLP Incident Response to separate the data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.\n    - [Administer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/data-loss-prevention-administration.md) -- Create rules, email templates, configure end-user response actions, and more to manage the Data Loss Prevention Incident Response (DLP IR) incidents on the ServiceNow AI Platform.\n      - [DLP default configuration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-data-loss-prevention.md) -- Define the default configuration settings for Data Loss Prevention Incident Response (DLP IR) incidents to identify and set up the incident notification and incident assignment preferences for your end users.\n      - [Create end user lookup rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-enduser-lookup-rules.md) -- You can create and configure end user lookup rules and assign the DLP incidents to the respective end users based on those rules.\n      - [Create assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-assignment-rules.md) -- Create assignment rules and assign the Data Loss Prevention Incident Response (DLP IR) incidents to user groups, end users, managers, or user from incident.\n      - [Create incident consolidation rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-incident-consolidation-rules-to-consolidate-your-dlp-incidents.md) -- Create incident consolidation rule to consolidate multiple incidents of similar nature under one parent incident.\n      - [Create response due date rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/setup-response-due-date-rules.md) -- Set up the response due date rules to determine the time you want to give your end users to respond to the assigned Data Loss Prevention Incident Response (DLP IR) incidents.\n        - [Add multiple users to access DLP incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/add-multiple-users-to-access-dlp-incidents.md) -- Use the escalation chain feature to allow all the respective users who are involved in the incident to access the DLP incidents from the list view, though the incident is assigned to a different user.\n      - [Create Approval Rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-approval-rules.md) -- Configure approval rules that require one or more approvers to authorize an advanced response option before it is applied to a DLP incident.\n      - [Create user instructions templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-and-manage-user-instructions-template-for-dlp-incidents.md) -- Create and manage user instructions template for DLP incidents to help the users understand the instructions involved incident resolution and the next steps involved in the resolution process.\n        - [Configure DLP UI user instructions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-dlp-ui-user-instructions.md) -- Configure the system UI messages to add detailed user instruction headers as required.\n      - [Create email templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-and-manage-email-templates.md) -- Create and manage the preconfigured email templates for sending notifications to your end users, user groups, or managers. With these templates, you can coach and communicate with your end users about the Data Loss Prevention Incident Response (DLP IR) incidents.\n      - [Create a Data Loss Prevention Incident Response SLA trigger](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/sla-records.md) -- Create a Data Loss Prevention Incident Response SLA trigger condition that enables a prompt and efficient response to an incident when triggered.\n      - [Create a Data Loss Prevention Incident Response SLA definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/dlp-sla-definitions.md) -- Create a Data Loss Prevention Incident Response SLA definition that outlines the conditions and duration for responding to data breaches. Establishing clear expectations and protocols helps ensure a swift response to incidents, minimizing potential damage and enhancing overall data protection strategies.\n      - [Create assessments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-and-manage-assessments-for-dlp-incidents.md) -- Create and manage assessments to enable end users to respond to DLP incidents. You can use the assessments to gather information about the sensitive data exposed or leaked from the DLP incidents.\n      - [Configure response option for your DLP incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-response-option-mapping.md) -- Use this feature to configure the type of response that an end user or analyst should perform.\n      - [Create incident response option rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-end-user-action.md) -- Create the incident response option rules that end user or analyst can use while responding to an incident.\n      - [Create age chart configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-age-chart.md) -- Configure the age chart that appears in the Data Loss Prevention Incident Response (DLP IR) Ops portal. This chart shows the count of open incidents by the number of days.\n      - [Create user delegate configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-delegation.md) -- Prevent certain executives in the organization from receiving notifications about the incidents assigned or escalated to them.\n      - [Create repeat offender identification rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/repeat-offender-identification-rules.md) -- Create repeat offender identification rules to identify users who repeat the same issue multiple times.\n      - [Create additional incident data fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-custom-fields-dlp.md) -- Create Additional Incident Data Fields for the DLP incidents. You can create different types of fields such as string, number, check box, choice, date and time, and use them in the DLP incident forms.\n      - [DLP SLA Definition form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/dlp-sla-def-properties.md) -- Field descriptions for the DLP SLA Definition form used to create an SLA record.\n      - [Configure advanced settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-advanced-settings-dlp.md) -- Configure the advanced settings to customize the incident display and behavior. For example, enable displaying the sensitive data on an incident and its clone, or specifying fields on the incident to identify the end users. In addition, activate and customize the evidence files preview properties.\n      - [Monitor DLP Integration Run process](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-microsoft-dlp-integration-run-process.md) -- Track and monitor the ongoing ingestion or the integration run process. The integration run processes contains the statistics on how much the data was processed and the integration status.\n      - [DLP Incident Access Restrictions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/dlp-incident-access-restrictions.md) -- Manage the visibility of a particular DLP incident that contains sensitive information. You can use incident access restrictions to define who can access a particular DLP incident and restrict specific users or groups from accessing that incident.\n        - [Create field level restrictions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/setup-field-level-restrictions-dlp.md) -- Set field level restrictions in DLP incidents to protect sensitive information from being exposed. You can use field level restrictions to control the users or groups who can access specific fields in the DLP incidents.\n        - [Create record level restrictions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/setup-record-level-restrictions.md) -- Set record level restrictions in DLP incidents to protect sensitive records from being exposed. You can use record level restrictions to control the users or groups who can access specific records in the DLP incidents.\n      - [DLP Incidents Archival](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/dlp-archiving-rule.md) -- The Data Loss Prevention Incident Response is provisioned with one archival rule in the base system for the DLP incident table. The related records are also added in the base system to the DLP incident archive rule.\n        - [Archive DLP related records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/archive-dlp-related-records.md) -- Use the Archive Related Records related list for DLP incidents to add the related records to the archive rule.\n    - [Manage incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/data-loss-prevention-incident-management.md) -- Use the Data Loss Prevention Incident Response Incident Management to update and manage incidents by leveraging the DLP User Workspace, DLP Analyst Workspace, and DLP Dashboard.\n      - [Data Loss Prevention Incident Response User Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-end-user-portal.md) -- The Data Loss Prevention Incident Response (DLP IR) User Workspace is a workspace where end users, managers, and approvers can respond to the assigned DLP incidents. The end users, managers, and approvers can then respond to the incidents by specifying the correct actions.\n        - [Report or respond to DLP incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/access-the-dlp-end-user-portal.md) -- Access the Data Loss Prevention Incident Response (DLP) User workspace, review the assigned DLP incidents, and report or respond to the incidents.\n        - [Working with my approvals module](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/working-with-my-approvals-module.md) -- My Approvals module will be available on DLP Users Workspace to the logged in users. Users can approve or reject the assign approval requests from here.\n      - [Data Loss Prevention Incident Response Analyst Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-ops-portal.md) -- Use the Data Loss Prevention Incident Response (DLP IR) Analyst Workspace to view the DLP incidents. Assign the incidents to end users for resolution and more.\n        - [Review and assign your DLP incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-ops-portal.md) -- Use the Data Loss Prevention Incident Response (DLP IR) Analyst Workspace to view the DLP incidents. Assign the incidents to end users for resolution and more.\n        - [Work with lists in the DLP IR Analyst Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-ops-portal.md) -- Use the Data Loss Prevention Incident Response (DLP IR) Analyst Workspace to view the DLP incidents. Assign the incidents to end users for resolution and more.\n        - [Preview evidence files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-ops-portal.md) -- Use the Data Loss Prevention Incident Response (DLP IR) Analyst Workspace to view the DLP incidents. Assign the incidents to end users for resolution and more.\n        - [Playbook for Data Loss Prevention Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-ops-portal.md) -- Use the Data Loss Prevention Incident Response (DLP IR) Analyst Workspace to view the DLP incidents. Assign the incidents to end users for resolution and more.\n          - [Add a DLP Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-ops-portal.md) -- Use the Data Loss Prevention Incident Response (DLP IR) Analyst Workspace to view the DLP incidents. Assign the incidents to end users for resolution and more.\n          - [Cancel a DLP Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-ops-portal.md) -- Use the Data Loss Prevention Incident Response (DLP IR) Analyst Workspace to view the DLP incidents. Assign the incidents to end users for resolution and more.\n        - [View archived DLP incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-ops-portal.md) -- Use the Data Loss Prevention Incident Response (DLP IR) Analyst Workspace to view the DLP incidents. Assign the incidents to end users for resolution and more.\n      - [Data Loss Prevention Incident Response Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-dashboard.md) -- The Data Loss Prevention Incident Response (DLP IR) Dashboard provides a high-level overview of your DLP incidents and daily incidents trends in your instance in the form of graphical charts. These charts help you effectively view, manage, and remediate the DLP incidents.\n        - [Analyze daily incident trends in your DLP incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/using-dlp-dashboard.md) -- The Data Loss Prevention Incident Response (DLP IR) Dashboard provides a high-level overview of your DLP incidents and daily incidents trends in your instance in the form of graphical charts. These charts help you effectively view, manage, and remediate the DLP incidents.\n    - [Inbound integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/inbound-integration-dlp.md) -- Create single or multiple DLP incidents by using the Inbound REST API.\n    - [Integrate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/dlp-integrations.md) -- The Data Loss Prevention Incident Response base system includes integrations to third-party data loss prevention software packages.\n      - [Symantec Integration for Data Loss Prevention Incident Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/symantec-dlp-integration.md) -- The Symantec DLP integration supports the ingestion of Data Loss Prevention Incident Response incidents created on the Symantec Data Loss Prevention Incident Response deployment. After ingestion, you can use the incident management functionalities to remediate the DLP incidents.\n        - [Getting started with Symantec DLP integration for Data Loss Prevention](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/getting-started-symantec-dlp-integration-dlp.md) -- Before you can use the integration, you must download it from the ServiceNow Store.\n        - [Install and configure the Symantec DLP integration for Data Loss Prevention](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/install-configure-symantec-dlp-integration.md) -- Install and configure the  Symantec DLP integration from the  ServiceNow Store on your  ServiceNow AI Platform instance. Start investigating DLP incidents using the  Symantec DLP incident data.\n        - [Create a profile for Symantec DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-profile-symantec-dlp.md) -- Create an incident profile in your  ServiceNow AI Platform instance. Determine the  Symantec DLP incidents that are suitable for creating DLP incidents.\n          - [Define filters to apply for the Incident creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/define-filters-symantec.md) -- Define and set filter conditions to drill down the incoming  Symantec DLP  incidents. Determine the incidents that should be created as DLP incidents in ServiceNow.\n          - [Configure evidence file storage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/config-evidence-file.md) -- Configure evidence file storage to securely store the evidence file for the DLP Incidents.\n          - [Download evidence files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/download-evidence-files.md) -- Download DLP incident evidence files that violate the DLP policy on Symantec.\n          - [Preview evidence files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/preview-file-symantec.md) -- Preview Data Loss Prevention Incident Response evidence files in the DLP IR Analyst workspace.\n          - [Schedule the Symantec DLP Incident Retrieval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/schedule-dlp-incident-retrieval.md) -- Set a schedule to retrieve the incident data and ingest Symantec DLP incidents that match the criteria in the profile. Configure the schedule to define how and when you pull incidents from Symantec.\n          - [Mapping Symantec DLP incident statuses with ServiceNow incident Status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/map-symantec-dlp.md) -- Synchronize the status of the DLP incidents ingested on the ServiceNow with the DLP incidents of the Symantec. Map the ServiceNow Incident Status field with the Symantec Incident Status field.\n        - [Severity mapping between Symantec DLP incidents with ServiceNow incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/severity-mapping.md) -- Use the severity mapping feature to configure and synchronize the mapping between Symantec incidents and ServiceNow AI Platform incidents.\n        - [Configure Smart Response Rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/config-smart-response-rules.md) -- Configure the Symantec smart response rule(s) to perform response actions on the ingested Symantec DLP Incidents.\n        - [Execute Smart Response Rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/execute-smart-response-rules.md) -- Use this feature to execute Smart Response Rules for the Symantec DLP incidents.\n        - [Configure the Symantec DLP  integration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/modify-symantec-dlp-system-properties.md) -- Modify the  Symantec DLP  integration default system properties.\n        - [Domain Separation in the Symantec DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/domain-seperation-symantec-dlp-integration.md) -- Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.\n      - [Data Loss Prevention Incident Response Integration with Proofpoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/dlp-incident-response-integration-proofpoint.md) -- The Proofpoint DLP integration supports the ingestion of Data Loss Prevention incidents created on the Proofpoint Data Loss Prevention deployment. After ingestion, you can use the incident management functionalities to remediate the DLP incidents.\n        - [Getting started with Proofpoint integration for Data Loss Prevention](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/getting-started-with-proofpoint-integration-dlp.md) -- The Proofpoint DLP integration supports the ingestion of Data Loss Prevention incidents created on the Proofpoint Data Loss Prevention tenant. After ingestion, the incident management functionalities that remediate the DLP incidents will be used.\n        - [Install and configure the Proofpoint integration for Data Loss Prevention](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/install-configure-proofpoint-integration-dlp.md) -- Install and configure the  Proofpoint DLP integration from the  ServiceNow Store on your  ServiceNow AI Platform instance. Start investigating DLP incidents using the  Proofpoint DLP incident data.\n          - [Configure the Webhook on the Proofpoint DLP tenant for alert notifications to ServiceNow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-webhook-proofpoint-tenant-alert-notifications.md) -- Configure a webhook on Proofpoint using the REST API endpoint to start getting the alerts from the Proofpoint DLP tenant. Your ServiceNow instance creates DLP incidents from these alerts. The Proofpoint DLP integration provides a REST API endpoint for end users to configure the webhook.\n        - [Create an Application in Proofpoint and Obtain Client Credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-application-proofpoint-dlp.md) -- Create an Application in Proofpoint and configure the required settings to obtain client credentials. These credentials enable secure access to Proofpoint's API for seamless integration and automation.\n        - [Create a Profile for Proofpoint DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-profile-proofpoint-dlp-integration.md) -- Create an incident profile in your  ServiceNow AI Platform instance. Determine the  Proofpoint DLP incidents that are suitable for creating DLP incidents.\n          - [Define filters to apply for the Incident creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/define-filters-incident-creation-proofpoint.md) -- Define and set filter conditions to filter the incoming  Proofpoint DLP  incidents. Control which DLP incidents should be created on ServiceNow.\n          - [Preview evidence files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/preview-file-proofpoint.md) -- Preview Data Loss Prevention Incident Response evidence files in the DLP IR Analyst workspace.\n        - [Map Proofpoint DLP incidents status with ServiceNow incident status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/map-proofpoint-dlp-incident-status.md) -- Synchronize the status of the DLP incidents ingested on your ServiceNow instance and DLP incidents of the Proofpoint. Map the ServiceNow Incident status with the Proofpoint Incident status.\n        - [Configure Proofpoint DLP integration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-proofpoint-dlp-integration-settings.md) -- Modify the  Proofpoint DLP  integration default system properties.\n        - [Domain Separation in Proofpoint DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/domain-separation-proofpoint-dlp-integration.md) -- Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.\n      - [Data Loss Prevention Incident Response Integration with Netskope](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/dlp-incident-response-integration-netskope.md) -- The Netskope DLP integration supports the ingestion of Data Loss Prevention incidents created on the Netskope Data Loss Prevention deployment. Netskope DLP helps companies to track the usage and movement of sensitive data on various platforms.\n        - [Getting started with Netskope DLP integration for Data Loss Prevention](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/getting-started-netskope-dlp-integration.md) -- Review the following information before you start setting up your Netskope DLP integration for Data Loss Prevention.\n        - [Install and configure the Netskope DLP integration for Data Loss Prevention](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/install-configure-netskope-dlp-integration.md) -- Install and configure the Netskope DLP integration from   ServiceNow Store   ServiceNow AI Platform instance. You can start investigating DLP incidents using the  Netskope DLP incident data.\n        - [Create a Profile for Netskope DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-profile-netskope-dlp-integration.md) -- Create an incident profile in your ServiceNow AI Platform instance.\n          - [Define Filters to apply for the Incident creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/define-filters-incident-creation-netskope.md) -- Define and set filter conditions to filter the incoming  Netskope DLP  incidents. Control which of these incidents should be created as DLP incidents on your ServiceNow instance.\n          - [Schedule the Netskope DLP incidents retrieval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/schedule-netskope-dlp-alerts-retrieval.md) -- Set a schedule to retrieve Netskope DLP incidents that match the criteria in the profile.\n        - [Mapping DLP incident status with Netskope](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/map-incident-status.md) -- The incident status mapping section enables the users to provide the mappings between the DLP Incident status in ServiceNow and Netskope Object status.\n        - [Configure Netskope DLP integration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-netskope-dlp-integration-settings.md) -- Modify the  Netskope DLP  integration default system properties.\n        - [Download evidence files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/download-files-netskope.md) -- Download files that violate the DLP policy on Netskope. Download this file onto your local machine from the DLP IR Analyst workspace and DLP IR End user workspace for approvers.\n        - [Preview evidence files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/preview-files-netskope.md) -- Preview DLP incident evidence files in the DLP IR Analyst workspace.\n        - [Notifications for users on retry mechanism](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/notifications-retry-limit.md) -- Netskope integration will retry the configured number of times in case of API failures during DLP Incident ingestion.\n        - [Email notifications on credential expiration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/notification-users-credential-expiration.md) -- When the token used in the ServiceNow instance expires, Netskope integration sends out an email notification to users with the DLP Admin (sn_dlir.admin) role.\n        - [Domain Separation in Netskope DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/domain-separation-netskope-dlp-integration.md) -- Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.\n      - [Internet Content Adaption Protocol (ICAP) integration for DLP IR](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/icap-dlp-integration.md) -- The Internet Content Adaption Protocol (ICAP) DLP integration supports the ingestion of Data Loss Prevention Incident Response alerts, allows the fetching of match content, and evidence files from Amazon S3 created on the ICAP supported Data Loss Prevention Incident Response deployment.\n        - [Getting started with ICAP DLP integration for Data Loss Prevention](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/getting-started-icap-integration.md) -- Before you can use the integration, you must download it from the ServiceNow Store\n        - [Install and configure the ICAP DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/install-icap-dlp-integration.md) -- Install and configure the  provider ICAP DLP integration from the  ServiceNow Store on your  ServiceNow AI Platform instance. Start investigating DLP incidents using the  provider ICAP DLP incident data.\n        - [Create a profile for ICAP DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-profile-for-icap.md) -- Create an incident profile in your  ServiceNow AI Platform instance. Determine the  ICAP DLP alerts that are suitable for creating DLP incidents.\n          - [Define filters to apply for the Incident creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/define-filters-for-incidents.md) -- Define and set filter conditions to filter the incoming  DLP  alerts. Determine the alerts that should be created as DLP incidents in ServiceNow.\n          - [Schedule the ICAP DLP incidents retrieval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/schedule-icap-dlp-incidents-retrieval.md) -- Set a schedule to retrieve ICAP DLP alerts that match the criteria in the profile.\n        - [View sensitive information for DLP alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/view-match-content.md) -- View the detected sensitive information for DLP alerts.\n        - [Download evidence files for DLP alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/download-icap-evidence-files.md) -- Download files that violate the DLP policy on provider that supports ICAP. Download this file onto your local machine from the DLP IR Analyst workspace and DLP IR End user workspace for approvers.\n        - [Preview evidence files for ICAP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/preview-file-icap.md) -- Preview DLP incident evidence files in the DLP IR Analyst workspace.\n        - [Review the ICAP DLP integration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/review-the-icap-dlp-integration-settings.md) -- Review the provider ICAP DLP integration settings and modify the default system properties to suit your environment.\n      - [Data Loss Prevention Incident Response with Microsoft](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/dlp-integration-microsoft.md) -- The Data Loss Prevention Incident Response with Microsoft provides a core framework to import Data Loss Prevention (DLP) incidents from multiple sources, such as Microsoft Purview apps, Microsoft Teams, Exchange Online, SharePoint Online, OneDrive for Business, and other event types.\n        - [Getting started with Microsoft DLP IR integration for data loss prevention](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/getting-started-microsoft-integration.md) -- Review the following information before you start setting up your Microsoft DLP IR integration for data loss prevention.\n        - [Install and configure the Microsoft DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/install-configure-microsoft-dlp-integration.md) -- Install and configure the  DLP Incident Response integration with Microsoft DLP from the  ServiceNow Store on your  ServiceNow AI Platform instance. Start investigating DLP incidents using the  Microsoft DLP event data.\n        - [Create a new incident profile for Microsoft DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/create-profile-microsoft-dlp-integration.md) -- Create an incident profile in your  ServiceNow AI Platform instance to retrieve the data from the Microsoft Purview and add the data into the ServiceNow DLP IR incident table.\n          - [Microsoft purview endpoint storage configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/microsoft-purview-endpoint.md) -- Microsoft Purview endpoint evidence files storage configuration tells you where the endpoint evidence files are being stored by the purview- Custom managed store or Microsoft managed storage environments.\n          - [Define filters to apply for the Incident creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/define-filters-profile-microsoft.md) -- Define and set filter conditions to filter the incoming  Microsoft DLP  events. Control which of these events should be created as DLP IR incidents on your ServiceNow instance.\n          - [Configure the match content for the incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/matching-content-configuration-microsoft.md) -- Provide the configuration to store the sensitive information internally, on the ServiceNow storage, or on the external cloud storage, such as Azure Storage or AWS S3 bucket. Retrieve the stored content while accessing the DLP IR Incident.\n          - [Schedule the DLP IR Microsoft incident retrieval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/schedule-profile-microsoft.md) -- Set a schedule to retrieve the incident data and ingest Microsoft DLP IR incidents that match the criteria in the profile. Configure the schedule to define how and when you pull incidents from Microsoft.\n        - [Configure Microsoft DLP IR integration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/configure-microsoft-integration-settings.md) -- Modify the  Microsoft DLP IR  integration default system properties.\n        - [Request release email from quarantine](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/request-email-from-quarantine.md) -- Use this feature to release the email that is quarantined from the Microsoft Purview compliance portal.\n        - [Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/download-file-dlp-microsoft.md) -- Download files or email that violates the DLP policy on Microsoft Purview. Download this file or email on to your local machine from the DLP IR Incident view. You can download the files for DLP IR incidents of type Scan source Exchange Online, OneDrive, and SharePoint.\n        - [Preview Evidence files for DLP incidents of type Exchange Online, OneDrive, and SharePoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/preview-file-dlp-microsoft.md) -- Preview Data Loss Prevention Incident Response evidence files in the DLP IR Analyst workspace.\n        - [Domain separation in Microsoft DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/data-loss-prevention/domain-separation-microsoft-dlp.md) -- Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.\n  - [Security Operations common functionality](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sec-ops-common-functionality.md) -- Whenever any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated, the Security Support Common plugin is activated. This plugin loads various modules that provide functionality that is common across all Security Operations applications.\n    - [Create and define filter groups in Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-filter-group.md) -- Create and use filter groups to locate records from any table on your instance. For example, you can create a group of all computers by the same manufacturer. You can also filter configuration items (CIs) that have similar vulnerabilities or that fall within a particular subnet IP address range.\n    - [Shared data transformation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/shared-data-transformation.md) -- The Security Incident Response, Vulnerability Response, and Threat Intelligence plugins share common features, for relationship data and duplication rules, used to import external and internal information into Security Operations.\n      - [Create duplication rules in Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-duplication-rules.md) -- You can use Duplication Rules to identify new email, enrichment data, or field maps with active duplicate records and process them appropriately.\n    - [Security Operations email processing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/email-processing.md) -- You can set up the integration of information from external detection systems, provide granularity in processing security operations records, handle unmatched emails, and prevent duplication of records using Email Processing.\n      - [Security Operations email properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/email-properties.md) -- Email Properties specify which inboxes are used as input in Email Parsing to import information from external detection systems to create records for security, vulnerability, and IoCs. You can set up a general account for all external detection systems to use, or individual email accounts for Security Incident Response, Threat Intelligence, or Vulnerability Response.\n        - [Create Security Operations email properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-email-properties.md) -- You can specify email addresses for reports and control automatic email behaviors using email Properties.\n      - [Security Operations email parsing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/email-parsing.md) -- Generate new Security Operations records from external detection systems using Email Parsing. This feature provides a method for integrating information from external tools such as malware detection, vulnerability detection, firewalls, threat intelligence, and more.\n        - [Create email parsers in Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/parsing-emails.md) -- Email Parsing creates Security Operations records from your email for security, vulnerability, and observables to expedite threat response and remediation.\n        - [Edit email records in Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/edit-email-records.md) -- Edit transforms in your existing email event records.\n      - [Unmatched Security Operations email events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/umatched-emails.md) -- Email events that do not match an email parser have their \"matched\" flag unset. You can view these email event records from the Unmatched Emails list, to reveal external detection systems whose emails are not yet parsed.\n        - [View and reprocess unmatched Security Operations emails](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/viewing-reprocessing-unmatched-emails.md) -- You can review Unmatched Emails for discontinued filters or as candidates for a new filter to maintain or improve the rate at which you catch email threats.\n    - [Security Operations field mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/field-mapping.md) -- Security Operations tables can be mapped to and from other tables, linking a security incident to a customer service case or a problem to other parts of the Security Operations system.\n      - [Map tables to tables with Security Operations field mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-field-mapping.md) -- Security Operations provides you with finer field-mapping granularity so you can map a Security Operations table to any other table.\n    - [Security Operations field value transforms](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/field-value-transforms.md) -- Transforms unique customer field values into field values recognized by Security Operations email parsing, data enrichment or tables using field maps. Supports choice fields, references, and aligns external data into the standard terminology and format for your new record.\n      - [Create Security Operations field value transforms](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-field-value-transforms.md) -- Field Value Transforms defines one transformation between provided source data, and the replacement value to use.\n    - [Security Operations enrichment data mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/enrichment-data-mapping.md) -- Enrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records. Security Operations workflows use enrichment data maps and provide output data to security incidents.\n      - [Create a Security Operations enrichment data map](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-enrichment-data-map.md) -- Transform data from JSON, XML, or Properties file format to ServiceNow records using enrichment data maps.\n    - [Security Operations user-defined escalation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/user-defined-escalation.md) -- You can create an escalation path for security incidents for issues requiring more attention or expertise. Once an escalation group exists, a button appears on any security incident in that group.\n      - [Create a Security Operations user-defined escalation group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-user-defined-escalation-group.md) -- Escalate a security incident to any group associated with the incident using Escalations.\n    - [Create domain-separated property overrides](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-dom-sep-prop-overrides.md) -- When you use domain separation, you can create overrides to existing Security Operations properties that allow you to customize the functions of the applications in each of your domains.\n    - [Create an operating system group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-new-os-group.md) -- Operating system groups are used to map an operating system to specific process types and scripts in Security Incident Response workflows. The scripts define how running processes for the defined operating system groups are retrieved. New operating systems can be added as needed.\n    - [Set up security tag groups and tags](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-class-group-and-tags.md) -- You can assign tags to security incidents, response tasks, vulnerable items, observables, IoCs, and security cases to create metadata on the responding record and define who should have access to specific types of security content. The tags can be added to security groups to organize them.\n      - [Create security tag rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-security-tag-rules.md) -- Security tag rules provide filtering for security tag access.\n      - [Import security tag rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/import-security-tag-rules.md) -- You can import security tag rules from other tables in your deployment.\n    - [Security annotations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-annotations.md) -- A security annotation is a note of explanation or comments added to a configuration item, observable, or use on a security incident.\n      - [Create security annotations for CIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-security-annotations.md) -- Annotations on CIs allow you to track activity across incidents. You can add annotations to a single or multiple CIs.\n      - [Create security annotations for observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-security-annotations-multiple.md) -- You can select a single or multiple observables and apply security annotations to them using the Actions on selected rows choice menu.\n      - [Create security annotations for users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-multi-sec-annotations-for-users.md) -- You can select a single or multiple users and apply security annotations to them using the Actions on selected rows choice menu.\n      - [View security annotations reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-security-annotations-report.md) -- The Security Annotations report presents details stored in the Security Annotations [sn_sec_cmn_security_annotations] table. You can customize the columns in the report and group the data in any way that suits you.\n    - [Components installed with Security Support Common](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/install-with-sec-sup-common.md) -- Several types of components are installed with Security Support Common. They provide common functionality for use across the various security applications, such as Security Incident Response.\n      - [View components installed with Security Support Common](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/installed-with-secops-common-NEW.md) -- Several types of components are installed when you activate the Security Support Common plugin including but not limited to tables, user roles, and modules.\n    - [Search Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_SearchSecOps.md) -- You can find information quickly in any Security Operations application using the search icon in the screen header. Zing is the text indexing and search engine that performs all text searches in your instance.\n    - [Security Operations Integration Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integ-ref.md) -- Developers and ServiceNow partners can use the information in this section to gain understanding of the under-the-hood functionality of third-party integrations, including development guidelines, integration capabilities, and workflows.\n      - [ServiceNow Security Operations integration development guidelines](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_IntegrationWritingGuidelines.md) -- The ServiceNow platform provides several mechanisms for developing integrations with external systems. The ServiceNow Security Operations product suite adds integration capabilities intended to streamline the process of integrating with security-focused external systems.\n        - [Types of ServiceNow integrations provided](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_TypesOfIntegrationsProv.md) -- The Security Operations applications (Security Incident Response, Threat Intelligence, and Vulnerability Response) can be seamlessly integrated with other ServiceNow applications to enhance their functionality.\n        - [Security Operations Integration Configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/third-party-integrations.md) -- Many of the integrations included in the base system require little or no setup, and operate in the same way. Certain integrations, such as the Qualys Cloud Platform, however, require separate steps for setting up the integration. Others support different sets of scan and lookup types and different rate limits.\n          - [Activate and configure third-party integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/install-config-3rd-party-integs.md) -- You can activate the plugins for third-party integrations and configure them for use from the same screen.\n          - [Create an integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-integrations.md) -- You can create an integration and add the associated integration card to the Security Integrations screen. This procedure is intended for partners who create third-party integrations.\n        - [Tips for writing integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_BestPractisesIntegrations.md) -- Avoid some of the pitfalls you can encounter when writing your own integrations by following these guidelines.\n        - [Integration troubleshooting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/c_IntegrationTroubleshooting.md) -- These troubleshooting suggestions can help you resolve common issues you can encounter when setting up or running integrations.\n          - [Replace an untrusted or expired third-party SSL certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_Import3rdPartySSLCert.md) -- When an SSL connection is required in an integration, there are circumstances when the certificate provided by the third-party vendor is either not yet trusted in ServiceNow or has expired. You can replace it or add a new certificate.\n      - [Integrations Capabilities framework 2.0](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/cj-sir-capfmw-about.md) -- The new Integration Capabilities Framework 2.0 has been redesigned to enable implementation of integrations in a simple and consistent manner. This ensures a consistent experience for similar types of integrations (for example: observable reputation lookup).\n        - [Supported integrations and components](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/cj-sir-capfmw-about.md) -- The new Integration Capabilities Framework 2.0 has been redesigned to enable implementation of integrations in a simple and consistent manner. This ensures a consistent experience for similar types of integrations (for example: observable reputation lookup).\n        - [Configurations in the new Capability Framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/cj-sir-capfmw-about.md) -- The new Integration Capabilities Framework 2.0 has been redesigned to enable implementation of integrations in a simple and consistent manner. This ensures a consistent experience for similar types of integrations (for example: observable reputation lookup).\n        - [Use with an installed integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/cj-sir-capfmw-about.md) -- The new Integration Capabilities Framework 2.0 has been redesigned to enable implementation of integrations in a simple and consistent manner. This ensures a consistent experience for similar types of integrations (for example: observable reputation lookup).\n        - [Use with a Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/cj-sir-capfmw-about.md) -- The new Integration Capabilities Framework 2.0 has been redesigned to enable implementation of integrations in a simple and consistent manner. This ensures a consistent experience for similar types of integrations (for example: observable reputation lookup).\n        - [Troubleshooting Integration Capability flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/cj-sir-capfmw-about.md) -- The new Integration Capabilities Framework 2.0 has been redesigned to enable implementation of integrations in a simple and consistent manner. This ensures a consistent experience for similar types of integrations (for example: observable reputation lookup).\n      - [REST APIs for third-party integration with Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/third-party-script-integrations.md) -- The Security Operations base system includes a series of scripted REST APIs that allow customers and partners to easily integrate with an existing Security Operations deployment. The APIs allow you to gather data from outside of your system (for example, a Python script is used to receive data from VirusTotal) and send it back to your instance.\n      - [Integration capabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/integration-capabilities.md) -- The Integration Capabilities framework provides a consistent architecture to support interoperability with third-party integrations. This abstracted interface and data model insulates integrations from changes to the core application and ensures a consistent experience for similar types of integrations.\n        - [Security Operations Integration- Block Request capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/block-request-capability.md) -- The Block Action capability blocks observables associated with a security incident on a firewall, web proxy, or other control point using implementation flows. This capability is used during incident response investigations to contain an identified threat.\n          - [Run Block Request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/run-block-request.md) -- Blocks communication with observables associated with a security incident.\n          - [Security Operations Integration - Block Request Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-block-request-workflow.md) -- The Security Operations Integration - Block Request flow is a high-level flow independent of integrations. It blocks observables associated with a security incident. Use it to fulfill an integration such as Palo Alto Networks - Firewall.\n        - [Security Operations Integration- Email Search and Delete capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/email-search-capability.md) -- The Email Search and Delete capability returns the number of threat emails from an email server search and, optionally, returns details for each email found. After the email search is completed, you can delete the emails.\n          - [Security Operations Integration - Email Search and Delete flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integ-email-search-delete.md) -- The Security Operations Integration - Email Search and Delete flow returns the number of threat emails from an email server search and, optionally, return details for each email found. After the email search is completed, you can delete the emails.\n            - [Legacy: Execution Tracking Begin (Mail Search) action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/execution-tracking-begins-mail-search-activity.md) -- The Execution Tracking - Begin (Mail Search) capability execution action creates an execution tracking record and marks the record state as Started. This action is used by all capability and implementation flows to keep track of their state.\n        - [Security Operations Integration- Enrich CI capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/enrich-ci-capability.md) -- The Enrich CI capability allows you to enrich data for configuration items associated with a security incident.\n          - [Security Operations Integration - CI Enrichment flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integ-enrich-ci-wf.md) -- The Security Operations Integration - CI Enrichment flow allows you to enrich data in configuration items (CI) associated with a security incident.\n        - [Security Operations Integration- Enrich Observable capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/enrich-observable-capability.md) -- The Enrich Observable capability allows you to enrich observables with additional information from a variety of sources using implementation flows. This capability is used during incident response investigations to contain an identified threat.\n          - [Security Operations Integration - Enrich Observable flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-enrich-observ-wf.md) -- The Security Operations Integration - Enrich Observable sub flow allows you to enrich observables with additional information from a variety of sources using implementation flow designer.\n        - [Security Operations Integration- Get Network Statistics capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-network-statistics-capability.md) -- The Get Network Statistics capability retrieves a list of active network connections from a host or endpoint. It can be used for incident enrichment during investigations. This capability is triggered automatically when a configuration item is added to a security incident.\n          - [Security Operations Integrations - Get Network Statistics flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-get-network-stats-workflow.md) -- The Security Operations Integrations - Get Network Statistics flow retrieves a list of active network connections from a host or endpoint.\n            - [Legacy: Execution Tracking - Begin (CIs) Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/execution-tracking-begins-cis-activity.md) -- The Execution Tracking - Begin (CIs) flow action starts the auditing process for a Security Operations Integration flow that operates on configuration items (CIs).\n          - [Get Network Statistics flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-incident-response/obtain-network-statistics-workflow.md) -- The Security Incident Response Get Network Statistics flow retrieves the network statistics for an affected Windows-based resource when added to a security incident in the Analysis state.\n        - [Security Operations Integration- Get Running Processes capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-running-processes-capability.md) -- The Get Running Processes capability retrieves a list of running processes on a configuration item (CI) from a host or endpoint. This capability is used for incident enrichment during investigations.\n          - [Security Operations Carbon Black Integration - Get Running Processes Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-cb-get-running-processes-workflow.md) -- The Security Operations Carbon Black Integration - Get Running Processes is the implementation for the Carbon Black integration launched by the Security Operations Integration - Get Running Process flow.\n            - [Collect Carbon Black Configurations Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/collect-cb-config-activity.md) -- The Collect Carbon Black Configurations flow action gathers configuration information to use in the flow.\n            - [Check MID Server Status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/check-mid-server-status.md) -- Determines whether the MID Server identified in the MID Server Host field of the integration's configuration is up and running. If the field is set to Any, the flow action verifies that any MID Server is up and running.\n            - [Get Sensor ID Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-sensor-id-activity.md) -- The Get Sensor ID flow action gathers sensor identifiers to use in the flow.\n            - [Create Session Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-session-activity.md) -- The Create Session flow action establishes a Carbon Black session to use in the flow.\n            - [Check Session Status Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/check-session-status-activity.md) -- Determines the status of a Carbon Black session within the flow.\n            - [Create Command Process Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-command-process-activity.md) -- The Create Command Process flow action create a Carbon Black command process to use in the flow .\n            - [Check Command Status and Get Process Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/check-command-status-get-process-activity.md) -- Checks the Carbon Black command status and retrieves processes to use in the flow.\n            - [Map Processes Data Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/map-processes-data-activity.md) -- The Map Processes Data flow action maps Carbon Black process data within the flow.\n            - [Legacy: Capability Execution Tracking - Complete Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/capability-execution-tracking-complete.md) -- The Capability Execution Tracking - Complete flow action updates the audit record when the flow is complete.\n            - [Close Session Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/close-session-activity.md) -- Closes a Carbon Black session within the flow.\n          - [Security Operations System Command Integration- Get Running Processes flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/obtain-WMI-retrieval-workflow.md) -- The Security Operations System Command Integration - Get Running Processes flow retrieves the running processes of a configuration item when added or updated to a Windows or Unix-based security incident in the Analysis state.\n            - [Combine results activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/combine-results-activity.md) -- The Combine results workflow activity merges the results from third-party integrations to use in the workflow.\n            - [Execute Shell Script activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/execute-shell-script-activity.md) -- The Execute Shell Script workflow activity runs a MID server shell script within the workflow.\n            - [Extract Shell Script from MID Script activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/extract-shell-script-mid-script-activity.md) -- The Extract Shell Script from MID script workflow activity pulls a MID server shell script to use with in the workflow.\n            - [Get Running Processes via PowerShell activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-running-processes-via-pwrshell-activity.md) -- The Get Sensor ID workflow activity gathers running processes using PowerShell to use in the workflow.\n          - [Security Operations - Get Running Processes Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-get-running-processes-workflow.md) -- The Security Operations - Get Running Processes flow is a high-level flow independent of integrations. It retrieves a list of running processes on a configuration item (CI) from a host. Use it to fulfill an integration, such as Carbon Black, or for a Windows-based security incident.\n        - [Security Operations Integration- Isolate Host capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/isolate-host-capability.md) -- The Isolate Host capability restricts system connections to other devices. Isolate host is executed against a configuration item (CI).\n          - [Run Isolate Host](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/run-isolate-host.md) -- Isolate Host restricts system connections to other devices.\n          - [Security Operations - Isolate Host Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-isolate-host-workflow.md) -- The Security Operations - Isolate Host flow is a high-level flow independent of integrations. It uses the configured queries to search for a set of configuration items. Use it to fulfill an integration, such as Carbon Black.\n          - [Security Operations Carbon Black Integration - Isolate Host Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-cb-isolate-host-workflow.md) -- The Security Operations Carbon Black Integration - Isolate Host is the implementation for the Carbon Black integration launched by the Security Operations Integration - Isolate Host flow.\n            - [Get Sensor ID Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-sensor-id-activity.md) -- The Get Sensor ID flow action gathers sensor identifiers to use in the flow.\n            - [Set Network Isolation Enabled activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/set-network-isolation-enabled-activity-cb-wf.md) -- The Set Network Isolation Enabled workflow activity enables network isolation.\n            - [Update Sensor activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/update-sensor-activity.md) -- The Update Sensor workflow activity updates the sensor to isolate hosts or endpoints.\n          - [Security Operations Carbon Black Integration- Remove Host Isolation Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-cb-remove-host-isolation-workflow.md) -- The Security Operations Carbon Black Integration - Remove Host Isolation flow unblocks communication with a specified host or endpoint in a Carbon Black system.\n        - [Security Operations Integration- Publish to Watchlist capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/pubish-to-watchlist-capability.md) -- The Publish to Watchlist capability adds observables and indicators associated with a security incident to a third-party watchlist that monitors for security events and generates alerts. This capability is used as part of incident response during investigations.\n          - [Security Operations Integration - Publish to Watchlist Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-publish-watchlist-workflow.md) -- The Security Operations Integrations - Publish to Watchlist flow is a high-level flow independent of integrations. It adds observables to third-party watchlist that support the capability. Use it to fulfill an integration.\n        - [Security Operations Integration- Sightings Search capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sightings-search-capability.md) -- The Sightings Search capability accepts a set of observables, finds any integrations that support a Sightings Search, then executes these searches.\n          - [Create sightings search configuration records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sightings-search-configurations.md) -- Create multiple sightings search configuration records and use them while querying multiple log stores or varying the search parameters.\n            - [Run a Sightings Search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/run-sightings-search.md) -- Determine the prevalence of a threat over time or test remediation or eradication efforts. You can select individual or multiple observables and the date range for your search from a security incident. Results are included in the Security Incident Observables related list.\n            - [Security Operations Integration - Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-sightings-search-workflow.md) -- Security Operations Integration - Sightings Search flow is a high-level flow independent of integrations. It uses the configured queries to search for a set of observables based on the configured integrations which support the capability. Use it to fulfill an integration such as Splunk or Elasticsearch.\n              - [Sightings Search - Determine Observables activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/determine-observables-sightings-search-activity.md) -- The Sightings Search - Determine Observables workflow activity determines which observables to include in the workflow.\n              - [Persistent Observable Sightings activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/persistent-observable-sightings-activity-arcsight-wf.md) -- The Persistent Observable Sightings workflow activity retrieves observables from the third-party integration.\n              - [Get Observable Sightings Queries activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-observable-sightings-queries-activity.md) -- The Get Observable Sightings Queries workflow activity retrieves queries from the integration configuration.\n              - [Security Operations - Arcsight Logger Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-sightings-search-arcsight-workflow.md) -- Security Operations - ArcSight Logger Sightings Search flow is the implementation for the Splunk integration launched by the Security Operations Integration - Sightings Search Flow.\n              - [Security Operations - Elasticsearch Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-sightings-search-es-workflow.md) -- Security Operations - Elasticsearch Sightings Search flow is the Elasticsearch implementation launched by the Security Operations Integration - Sightings Search flow.\n              - [Security Operations - McAfee ESM Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-sightings-search-mcafee-workflow.md) -- Security Operations - McAfee ESM Sightings Search flow is the implementation for the McAfee Sighting Search implementation launched by the Security Operations Integration - Sightings Search Flow.\n              - [Security Operations - QRadar Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-sightings-search-qradar-workflow.md) -- Security Operations - QRadar Sightings Search flow is the implementation for the IBM QRadar integration launched by the Security Operations Integration - Sightings Search flow.\n              - [Security Operations Integration - Splunk Sightings Search Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-integration-sightings-search-splunk-workflow.md) -- Security Operations - Splunk Sightings Search flow is the implementation for the Splunk integration launched by the Security Operations Integration - Sightings Search flow.\n            - [View Sightings Search Results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-sightings-search-results.md) -- You can review Sightings Search Results for internal and external malicious indicators.\n              - [Share Sightings Search results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/share-sightings-search-results.md) -- You can share local sightings details or results that are associated with a particular search with your Trusted Security Circle.\n              - [Share observables from a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/share-observable.md) -- Observables can be shared from a security incident in Security Incident Response to members in your trusted circle.\n            - [View Sightings Search Details](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-sightings-search-details.md) -- Review the aggregate details of all sighting searches.\n            - [View Sightings Search Data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/view-sightings-search-data.md) -- Review the aggregate data of all sighting searches.\n        - [Security Operations Integration - Threat Lookup capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sec-ops-threat-lookups-capability.md) -- The Threat Lookups capability performs threat intelligence lookups to determine whether one or more observables are associated with known security threats.\n          - [Security Operations Integration - Threat Lookup Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/sec-ops-integ-threat-lookup.md) -- The Security Operations Integration - Threat Lookup capability flow accesses available threat lookup implementations and executes the implementation flows associated with each to perform threat lookups of selected observables.\n        - [Change the order of flow execution](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/change-wf-execution-order.md) -- Integration capability implementations specify the flow to be executed. In the base system, flows are executed sequentially, in the order specified in the implementation. You can change the order as needed.\n      - [Common Security Operations integration flows and orchestration activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/common-wf-activities.md) -- Many of the flows associated with third-party integrations include the same activities. For example, activities for beginning and completing processing.\n        - [Legacy: Execution Tracking - Begin Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/execution-tracking-begin.md) -- The Execution Tracking - Begin flow action starts the auditing process for a Security Operations Integration flow that operates on observables.\n        - [Legacy: Capability Execution Tracking - Complete Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/capability-execution-tracking-complete.md) -- The Capability Execution Tracking - Complete flow action updates the audit record when the flow is complete.\n        - [Legacy: Capability Execution Tracking- Failure Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/capability-execution-tracking-failure.md) -- The Capability Execution Tracking - Failure flow action records a failure to the audit record.\n        - [Capability - Determine CIs activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/determine-cis-activity.md) -- The Capability - Determine CIs workflow activity determines which configuration items (CIs) to include in the workflow.\n        - [Create Enrichment Data records Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-enrich-data-records.md) -- The Create enrichment data records flow action creates or updates enrichment records to use in the flow.\n        - [Get Configuration Item FQDN Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-config-FQDN-activity.md) -- The Security Common Orchestration Get Configuration Item FQDN flow action retrieves the fully qualified domain name (FQDN) of a configuration item. This flow action can accelerate the investigation and remediation process.\n        - [Determine Observables activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/determine-observables-activity.md) -- The Determine Observables workflow activity determines which observable to include in the workflow\n        - [Get Supported Security Capabilities action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-supported-security-capabilities-activity.md) -- The Get Supported Capabilities flow action retrieves the name and number of integrations that are active and support the requested capability.\n        - [Legacy: Capability Execution Tracking- No Impls action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/execution-tracking-noimpls-activity.md) -- The Capability Execution Tracking - No Impls flow action creates an error record when no integration capability implementation is found.\n        - [Create Compliance Search Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-email-details-from-exch-server.md) -- The Create Compliance Search action creates a compliance search for emails in the designated Exchange server(s) using the search queries defined and returns the name of compliance search created.\n        - [Get IP from CI activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-ip-from-ci-activity-reference.md) -- This workflow activity determines the IPV4 address associated with a configuration item (CI).\n        - [Get Network Statistics via netstat Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-network-stats-netstat-activity.md) -- The Security Common Orchestration - Get Network Statistics via netstat flow action retrieves the network statistics for an affected resource on a Windows-based system. This flow action can accelerate the investigation and remediation process.\n        - [Get running processes via WMI activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-running-process-WMI-activity.md) -- TheGet Running Processes workflow activity retrieves the running processes of a configuration item on a Windows-based system. This activity can accelerate the investigation and remediation process.\n        - [Check Compliance Search Status Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/search-delete-email-threat-exchange.md) -- The Check Compliance Search Status action check the status of created compliance search on exchange server and if the status is completed return the information regarding email search found for the compliance search.\n        - [Update Task Worknotes activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/update-task-worknotes-activity.md) -- The Security Common Orchestration - Update Task Worknotes workflow activity updates the Activity section (work notes) of a task record. This is useful for logging information.\n        - [Roll up lookup info to security incident activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/r_RollUpScanInfoSI.md) -- The Roll up lookup info to security incident activity can be used with any workflow to gather information from a threat lookup and output a summary of the contents as well as the ID of the originating security incident in task work notes.\n        - [Update security incident with lookup results workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/t_UpdateSecIncScanResults.md) -- The Update security incident with lookup results workflow updates existing security incidents with lookup results.\n        - [Filter Allowlisted Observables activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/filter-whitelisted-observables-activity.md) -- The Filtered Allowlisted Observables workflow activity removes observables that can be ignored from the list of observables. This activity can accelerate the investigation and remediation process.\n        - [Write content to record as attachment activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/write-content-record-attachment-activity.md) -- This activity writes the content passed in from an input and creates a designated attachment to a given record.\n        - [Get IP from CI activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/get-ip-from-ci-activity.md) -- The Get IP from CI flow activity gathers the IP address from configuration items (CIs) to use in the flow.\n    - [Legacy: Security Operations workflow triggers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/workflow-triggers.md) -- Security Operations workflow triggers contain a condition on a table. All workflows attached to the workflow trigger record run when the condition is met.\n      - [Legacy: Create Security Operations workflow triggers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/create-workflow-triggers.md) -- Create a workflow trigger that contains a condition on a table.\n    - [Security Operations Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/security-operations-orchestration.md) -- Users can interact with and retrieve data from Windows or UNIX-based systems and environments using activity packs and workflows in Security Operations Orchestration.\n  - [Security Operations and the ServiceNow Store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/secops-and-store.md) -- Starting with Madrid, all Security Operations applications and supported integrations are available for download from the ServiceNow Store. This allows you to obtain new and updated features more rapidly. Before you can use any Security Operations applications, you must verify that you have entitlement to them (that is, you have valid licenses to use them), download them from the ServiceNow Store, and activate them.\n    - [Download an application from the ServiceNow Store for the first time](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/download-app-first-time.md) -- Downloading an application from the ServiceNow Store for the first time involves a number of easy steps. Some of the steps are performed on the ServiceNow Store and some in your instance.\n      - [Get entitlement for a Security Operations product or application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/entitle-secops-product.md) -- The first step in installing a Security Operations application is to verify that the application or the product and its associated applications have valid ServiceNow entitlements.\n      - [Activate a ServiceNow Store application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/activate-entitled-store-app.md) -- After an application has been given entitlement, you must activate its dependencies plugin and activate the application. This process also applies to applications downloaded to sub-production instances.\n    - [Install a Security Operations integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/install-non-core-apps.md) -- All ServiceNow integrations are available on the ServiceNow Store. Core applications, such as Security Incident Response, are visible in the ServiceNow Products tab on the store. Integration add-ons are visible in the Certified Apps tab.\n    - [Update an application previously downloaded from the ServiceNow Store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/update-app-from-store.md) -- If you have previously downloaded an application from the ServiceNow Store and a new version is available, you can update it in your instance.\n    - [Upgrade your instance to the next family release](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/upgrade-to-next-family.md) -- If you are currently running a family release and want to upgrade to the next release, it is not necessary to acquire the applications from the ServiceNow Store. The application is automatically updated when the platform is updated to the minimum required version.\n"}}