Integrate Prisma Cloud with ServiceNow

1. Set Up Permissions on ServiceNow
2. Enable the ServiceNow Integration on Prisma Cloud
3. View Alerts
4. Manage your ServiceNow integration

Set Up Permissions on ServiceNow

1. Prerequisites for the Prisma Cloud and ServiceNow Integration

   1. You must have permissions to create a local user account on ServiceNow.

      Create a Username and password that are local on the instance itself. A local user account is a requirement because the ServiceNow web services cannot authenticate against an LDAP or SSO Identity provider and it is unlike the authentication flow that ServiceNow supports for typical administrative users who access the service using a web browser.Refer to the ServiceNow documentation for more information.

      
   2. Review the ServiceNow roles required.

      Prisma Cloud has verified that the following roles provide the required permissions. If your implementation has different roles and RBAC mechanisms, work with your ServiceNow administrator.

      New York, Orlando, and Paris

      • tt:[Optional] personalize for accessing tables.

        Personalize role is recommended to support type-ahead fields in notification templates for ServiceNow on Prisma Cloud. With this permission, when you enter a minimum of three characters in a type-ahead field, this role enables you to view the list of available options. If you do not enable personalize permissions, you must give table specific read-access permissions for type-ahead inputs.
      • evt_mgmt_integration basic role has create access to the Event [em_event] and Registered Nodes [em_registered_nodes] tables to integrate with external event sources.
      • itil role is required for the incident table actions.
      • sn_si.basic role is required for the sn_si.incident security incident table actions.
   3. For the user you added earlier, create a custom role with the permissions listed above.

      These permissions are required to create tickets and access the data in the respective ITSM, Events, and Security Incident Response tables and fields on ServiceNow.

      Prisma Cloud needs access to the Plugins (V_plugin), Dictionary (sys_dictionary), and Choice Lists (sys_choices) tables to fetch data from the ServiceNow fields. You can view this information in the ServiceNow notification templates that enable you to customize Prisma Cloud alerts in ServiceNow.

      1. Select User Administration > Roles to create a new role and assign it to the local administrative user you created earlier.
      2. Pick a table, such as the Plugins table, and select the menu (“hamburger”) icon next to a table column header to Configure > Table.
      3. Elevate the role to security_admin to enable modification of the access control list (ACL).

         
      4. Select Access Controls > New.
      5. Set Operation to Read and assign this permission to the role.

         
      6. Enable permissions for the remaining tables and assign them to the same role.

         Verify that all three tables—Plugins (V_plugin), Dictionary (sys_dictionary), and Choice Lists (sys_choices) have the role and the required permission especially if you have defined field-level ACL rules to restrict access to objects in your ServiceNow implementation.
   4. You must be familiar with the fields and field-types in your ServiceNow implementation to set up the Notification templates on Prisma Cloud. Because this knowledge is essential for setting up the mapping of the Prisma Cloud alert payload to the corresponding fields on ServiceNow, you must work with your ServiceNow administrator to successfully enable this integration.
2. Prerequisites for the Security Incident Module

   The Security Incident Response plugin is optional but is required if you want to generate Security Incident tickets. To create Security Incident tickets, you must also have the Security Incident Response plugin installed on your ServiceNow instance.

   Verify that the Security Incident Response plugin is activated. To activate a plugin you must be ServiceNow administrator; if you do not see the plugin in the list, verify that you have purchased the subscription.
3. Prerequisites for the Event Management Module

   The Event Management plugin is optional but is required if you want to generate Event tickets on ServiceNow. To create Event tickets, you must have the Event Management subscription and the plugin installed on your ServiceNow instance.

   Verify that the Event Management plugin is activated. To activate a plugin you must be ServiceNow administrator; if you do not see the plugin in the list, verify that you have purchased the subscription.
4. Prerequisites to set up OAuth 2.0

   Setting up Oauth 2.0 is optional. If you want to connect ServiceNow using OAuth 2.0, you must complete the following prerequisite steps on your ServiceNow instance to set up OAuth 2.0 for Inbound REST APIs.

   1. Log in to your ServiceNow instance using Admin credentials and go to the System OAuth > Application Registry.

      
   2. Select New, you will be directed to the Interceptor page.
   3. Select Create an OAuth API endpoint for external clients and enter the following details.

      • Name - Enter a meaningful name to identify Prisma Cloud.
      • Client ID - The ServiceNow OAuth server will automatically generate this.
      • Client Secret - Leave the Client Secret blank for the ServiceNow OAuth server to generate a secret automatically.
      • Refresh Token Lifespan - The default value is 8,640,000 seconds (100 days) and can be increased or decreased. This means, that after 100 days, you must reauthorize the OAuth connection. As a best practice, increasing the lifespan to a larger value reduces manual reauthorization. The max value is 2,147,483,647 seconds (~68 years).
      • Access Token Lifespan - The default value is 1800 seconds (30 Minutes) and can be increased or decreased.

        
   4. Click Submit. You will be directed to the Application Registries page.
   5. Select the record that you added. For example, PrismaCloudOAuth2.0.
   6. Copy the Client ID, Client Secret, and Refresh Token Lifespan details.

      You will need to enter the token while enabling ServiceNow as an external integration on Prisma Cloud.

      
5. Generate Refresh Token

   Perform the following steps to generate a refresh token to be added while connecting ServiceNow using OAuth 2.0.

   (tt:[NOTE]) As a best practice, use Postman to generate the refresh token.

   1. Log in to Postman and set the HTTP Method as POST.

      1. Enter the Endpoint URL as follows: https://<your-servicenow-instanceName>.service-now.com/oauth_token.do

         This is the default endpoint for getting access tokens.

         For example: https://dev123456.service-now.com/oauth_token.do
      2. Request Parameters must be sent in the HTTP POST Body.
      3. Requests should be formatted as x-www-form-urlencoded.
   2. Enter the following request parameters (JSON Key Values) and then click Send.

      • grant_type— password
      • client_id— <client_id-generated-in-servicenow-instance>
      • client_secret— <client_secret-generated-in-service-now-instance>
      • username— <your-servicenow-instance-username>
      • password— <your-servicenow-password>

        
   3. Copy the refresh_token from the response.

      You will need to enter the token when you Enable ServiceNow as an external integration on Prisma Cloud.

Enable the ServiceNow Integration on Prisma Cloud

1. Login to Prisma Cloud, and under Settings, select Integrations & Notifications.
2. Select Add Integration > ServiceNow.
3. Enter a meaningful Integration Name and a Description.
4. Enter your FQDN for accessing ServiceNow.

   Make sure to provide the FQDN for ServiceNow—not the SSO redirect URL or a URL that enables you to bypass the SSO provider (such as sidedoor or login.do) for local authentication on ServiceNow. For example, enter <yourservicenowinstance>.com and not any of the following:

   (tt:[NOTE]) You cannot modify the FQDN after you save the integration. If you want to change the FQDN for your ServiceNow instance, add a new integration.
5. Choose either Basic or Oauth 2.0 as the Authentication.

   1. For Basic Authentication, perform the following steps:

      1. Enter the Username and Password for the ServiceNow administrative user account.

         The ServiceNow web services use the SOAP API that supports basic authentication, whereby the administrative credentials are checked against the instance itself and not against any LDAP or SSO Identity provider. Therefore, you must create a local administrative user account and enter the credentials for that local user account here instead of the SSO credentials of the administrator. This method is standard for SOAP APIs that pass a basic authentication header with the SOAP request.
      2. Select the Service Type for which you want to generate tickets—Incident, Security, and/or Event.

         You must have the plugin installed to create Security incident tickets or Event tickets; make sure to work with your ServiceNow administrator to install and configure the Security Incident Response module or Event Management module. If you select Security only, Prisma Cloud generates all tickets as Security Incident Response (SIR) on ServiceNow.

         
   2. tt:[Optional] For Oauth 2.0 Authentication, perform the following steps:

      1. Enter the Client ID that you had copied earlier from the ServiceNow instance.
      2. Enter the Client Secret that you had copied earlier from the ServiceNow instance.
      3. Enter the Refresh Token that you had copied from the response in Postman.

         Once the Refresh Token expires, you must perform step 5— Generate Refresh Token as described in Set Up Permissions on ServiceNow and include it in the Prisma Cloud UI. For example, if you set the token value as 8,640,000 seconds (100 days), then after 100 days, you must reauthorize the OAuth connection.
      4. Enter the Token Lifespan (In Seconds) that you had copied earlier from the ServiceNow instance.
      5. Select the Service Type for which you want to generate tickets—Incident, Security, and/or Event.

         You must have the plugin installed to create Security incident tickets or Event tickets; make sure to work with your ServiceNow administrator to install and configure the Security Incident Response module or Event Management module. If you select Security only, Prisma Cloud generates all tickets as Security Incident Response (SIR) on ServiceNow.

         
6. Click Next, review the Summary and then Test Integration.

   If you have omitted any of the permissions listed in Set Up Permissions on ServiceNow, an HTTP 403 error displays.

   
7. Save Integration after the testing is successful.

   The integration will be listed on the Integrations page.

   
8. Next Steps

   Continue with setting up the notification template, and then verify the status of the integration on Settings > Integrations.

Interpret Error Messages

View Alerts

1. Modify an existing Alert Rule or create a new Alert Rule to send alert notifications to ServiceNow.
2. Login to ServiceNow to view Prisma Cloud alerts.

   When alert states are updated in Prisma Cloud, they are automatically updated in the corresponding ServiceNow tickets.

   (tt:[NOTE]) If Prisma Cloud is set to create a new ServiceNow incident through the notification template when an alert state changes from Resolved > Open (re-open), do not manually update the incident state. Prisma Cloud will automatically update the incident once the alert is resolved. Manually changing the incident will stop notifications from being sent.

   1. To view incidents (incident table), select Incidents.

      In ServiceNow, all the Open Prisma Cloud have an incident state of New and all the Resolved or Dismissed alerts have an incident state of Resolved.

      
   2. To view security incidents (sn_si_incident table), select Security Incidents.

      In ServiceNow, all the Open Prisma Cloud alerts have a state of Draft and all the Resolved or Dismissed alerts have a state of Review.

      
   3. To view event incidents (events table), select Event Management > All Events.

      

Manage your ServiceNow integration

• View— Select the View Integration icon on the Actions pane. The View ServiceNow Integration page will appear, displaying the current configuration details of the ServiceNow integration.
• Edit— Select the Edit icon on the Actions pane. The Edit ServiceNow Integration page will appear, allowing you to modify relevant configuration details such as enabling Oauth 2.0 Authentication or updating Refresh Token details.
• Delete— Select the Delete icon on the Actions pane to remove the integration.

Edit your ServiceNow Integration to enable Oauth 2.0

1. Perform steps 4 and 5 as described in Set Up Permissions on ServiceNow
2. Log in to Prisma Cloud and under Settings, select Integrations & Notifications.
3. Locate the ServiceNow account you want to Edit.

   
4. Select the Edit icon on the Actions pane. The Edit ServiceNow Integration page will appear, allowing you to modify relevant information.
5. Select Oauth 2.0 as the Authentication.
6. Enter the Client ID that you had copied earlier from the ServiceNow instance.
7. Enter the Client Secret that you had copied earlier from the ServiceNow instance.
8. Enter the Refresh Token that you had copied from the response in Postman.

   When the Refresh Token expires, you must perform step 5— Generate Refresh Token as described in Set Up Permissions on ServiceNow and include it in the Prisma Cloud UI. For example, if you set the token value as 8,640,000 seconds (100 days), then after 100 days, you must reauthorize the OAuth connection.
9. Enter the Token Lifespan (In Seconds) that you had copied earlier from the ServiceNow instance.
10. Click Next.

    
11. Review the Summary and then Test Integration.
12. Save Integration after the testing is successful.