SecOps - ServiceNow Community

Security Operations

Overcome threats and vulnerabilities, improve cyber resilience, and speed response time.

Read Latest Release News

Video Player is loading.

Current Time 0:00

Duration 0:00

Loaded: 0%

Stream Type LIVE

Remaining Time 0:00

Hot Topics

Security Operations Resource Library
Article

Security Operations Resource Library

Welcome to the Security Operations Resource Library!...

Sarah Wood
2025 Security Operations Events
Article

2025 Security Operations Events

2025 Security Operations Events We look forward to w...

Sarah Wood
The SOC Agent Advantage: Wrap-up your Security Incidents with Ease
blog

The SOC Agent Advantage: Wrap-up your Security Incidents with Ease

Madhumitha Redd
Security Posture Control: Enabling visibility and prioritization in expo...
blog

Security Posture Control: Enabling visibility and prioritization in expo...

Gopi37
Enhancing Security Investigations with AI-Powered Correlation and Now As...
Article

Enhancing Security Investigations with AI-Powered Correlation and Now As...

Miranda Ju
What's New in Security Operations November Store Release
blog

What's New in Security Operations November Store Release

With the 2024 Q4 Store r...

lanemclaughlin
Revolutionizing Security Incident Management: Introducing November Gen A...
Article

Revolutionizing Security Incident Management: Introducing November Gen A...

Miranda Ju
What's New in Security Operations- Xanadu Release
Article

What's New in Security Operations- Xanadu Release

With the 2024 Xanadu rel...

lanemclaughlin
Threat Intelligence Security Center (TISC) updates from August and Novem...
blog

Threat Intelligence Security Center (TISC) updates from August and Novem...

Kalyan8
Threat Intelligence Security Center (TISC) is Generally Available now!
blog

Threat Intelligence Security Center (TISC) is Generally Available now!

Kalyan8
Announcing Security Posture Control
blog

Announcing Security Posture Control

Introduction Security Posture Control is a new produ...

Gopi37

Getting Started

Welcome Guide

Major Security Incident Management Welcome Guide

Product Checklist (SIR)

Product Checklist (VR)

Quick Start (Setting up section)

FAQ

Measure and Grow

Measuring Success

Product Docs

Performance and Measurement

Value Measurement

Connect at events

Get Started With Security Operations Applications

Online 04/09/25

[APAC] Get Started With Security Operations Applications

Online 04/09/25

Office Hours: Security Operations Applications

Online 04/24/25

ServiceNow will be at RSA Conference 2025

Online 04/28/25

On Demand Events

Get Started With Security Operat...
Event

Get Started With Security Operat...

11/05/2024

ServiceNow
"Success with VR" webinar series
Article

"Success with VR" webinar series

For those of you which have joined the "Success with...

Eliz Skogquist
"Success with SIR" webinar series
Article

"Success with SIR" webinar series

For those of you which have joined the "Success with...

Eliz Skogquist
Leveraging the Cybersecurity Executive Dashboard
Article

Leveraging the Cybersecurity Executive Dashboard

Andy Ojha, Principal Out...

Eliz Skogquist
On Demand Webinar: Learn how AI ...
Event

On Demand Webinar: Learn how AI ...

09/25/2024

Megan Le
"Success with SIR" webinar: Understanding SI task types, Security KBs an...
Article

"Success with SIR" webinar: Understanding SI task types, Security KBs an...

Eliz Skogquist
Understand Threat Intelligence Security Center's Value to your Organizat...
Article

Understand Threat Intelligence Security Center's Value to your Organizat...

Eliz Skogquist
Take a look at the Major Security Incident Management Bootcamp
Article

Take a look at the Major Security Incident Management Bootcamp

Eliz Skogquist

Resources

What's New Blog

Release Notes

Entitlements

Store

SecOps roadmap

This is a private group

SecOps roadmap

Activity in SecOps

Ask a Question

Question status: Question status:

Sorted by:

Featured The SOC Agent Advantage: Wrap-up your Security Incidents with Ease

Our first SOC agent is live! Closing security incident has just become a command away! Have you ever felt that closing a security incident is tedious and time taking as you will have to ensure that post incident analysis is complete, closure notes ...

blog

Featured Get Ready for Connect x Accelerate 2025 – ServiceNow’s Integrated Risk and Security Symposium!

The future of Risk Management and Security Operations is here – and we want YOU to be part of it! ServiceNow Risk and Security Operations customers are invited to join us at the upcoming Connect x Accelerate 2025: The Integrated Risk and Security Sy...

Article
Best Practices
Security Incident Response
Security Operations
Vulnerability Response

Featured Knowledge25 - Registration is open - and check out pre-con!

The ServiceNow Knowledge 25 conference is coming up soon! This year the pre-conference activities will be different. New exciting changes. There will be 60 and 90-minute sessions where we will cover topics we can't often fully cover in traditional ...

blog

Featured Recommended Training for Security Operations

ServiceNow training and certification sets you and your business up for success, which is why it’s critical to make training an essential part of your ServiceNow program. By building the right skills, you can deliver more value more quickly, increase...

Article
Application Vulnerability Response
Configuration Compliance
Container Vulnerability Response
DLP
MSIM
Now Assist for SecOps
SBOM
SecOps
Security Incident Response
Security Operations
Security Posture Control
Software Bill of Materials

Featured SecOps Training - Instructor-led options

This article is complementary to Sarah Wood's article: Recommended Training for Security Operations - here is the link to that one. It contains both instructor-led and on-demand information. This article is specific to instructor-led classes. https:/...

Article
Security Incident Response
Vulnerability Response

field is not editable

I have created a new field but while checking in the form it is not editable. Read only check box is not selected. I also checked in UI policies and i didn't found anything. There were no client scripts on that table. What else I need to check?

Question

Urgent! KPIs for Response Task & Remediation task

My customer is using the Yokohama version of the platform.I wanted to check with you all to see if there are any out-of-the-box (OOTB) dashboards or reports available for tracking Response Tasks and Remediation Tasks. Specifically, I’m looking for an...

Question

Auto Technique extraction rule for Azure Sentinel

We have integrated the Azure Sentinel with ServiceNow for Security Incident creation, and it also passes the Tactic and Technique information. We have enabled the MITRE ATT&CK matrice (Enterprise) and the associated techniques, however, this is only ...

Question

「First.org EPSS Integration」ジョブの実行が長時間化かつエラーが発生する

Vulnerability Integration[sn_vul_integration]テーブルから「First.org EPSS Integration」を実行したところ、実行時間が10時間以上かかり、かつ複数のデータソースにて「Job exceeded processing time and was forced to completes status」エラーが発生し、ジョブのステータスも「Error」となっております。再度ジョブの実行を試した際も、実行時間は一日以上かかり、同様のエラーが...

Question

How to Calculate Deferred State Duration and Adjust Age Duration in Vulnerability Item Form?

Hello Community, I need to create two custom fields in the Vulnerability Item form in ServiceNow: 1. A field to calculate the Deferred State Duration, which tracks how long a vulnerability item remains in the Deferred state. 2. The second field shoul...

Question

Run Vulnerability calculator flag on Vulnerability entries table

which otb scheduled job works to update "run vulnerability calculator" flag to false?

Question
Security Operations
Vulnerability Response

VR: How to Filter Vulnerabilities by CVE Pattern (e.g., CVE-2024-*)

Hi everyone,We are currently evaluating ServiceNow Vulnerability Response (CR) and have integrated it with Qualys, which has imported around 1,000 IT vulnerabilities into our instance.I would like to filter all vulnerabilities based on a CVE pattern,...

Question

Resolved! In Vulnerable Item Detections- Configuration Item do match DNS name and NetBIOS name.

Hello All, I have a situation where on the Vulnerable Item Detections, the CI does not match the detection DNS name and NetBIOS name. Anyone have an idea why this could be happening? Example - CI is of class- Incomplete IP Identified Device and on t...

Question
Vulnerability Response

Filter Rapid7 data based on Asset tags

I am trying to filter the data that comes from Rapid7 to SN VR module based on the asset tags in Rapid7. Although SN provided a documentation on adding additional parameters (https://www.servicenow.com/docs/bundle/xanadu-security-management/page/prod...

Question

How to create a play book on Security Incident Response????

Hello All, I am new to SecOps implementation and got an opportunity to configure a new Playbook in the Security Incident Response. What are the best practices need follow? What are the prerequisites? How to implement a new Playbook for enriching the ...

Question
Security Incident Response

CMDB Install state moves to retired or non operational

Hi Everyone, What happens to a CI when it is not discovered for 60 days? Any OOB scheduled job will run and change its state? Without any configuration? Something from OOB? Thanks!

Question

Resolved! Add columns to the Vulnerability Manager Workspace List View

I'm integrated with tenable.sc Is there a path to add Proof and CVE as columns to the Vulnerability Manager Workspace list view?

Question

Resolved! Search directly for CVE’s with Tenable.sc plugin-based integration

Our VR integration is with tenable sc. The data comes in as tenable plugins (third party entries) We would like a way to search for CVEs without having to go through Tenable plugins (Third party Entries). This is really for reporting/ Performance Ana...

Question
Integrations
Vulnerability Response

Resolved! unable to find and configure "Respond" button in DLP Analyst Workspace

I am unable to find and configure "Respond" button in DLP Analyst Workspace, which appears on the top right corner of the incident form in the workspace. I checked in UI actions , UI builder. Any guidance would be appreciated

Question
DLP

Resolved! Pricing for Secops Module

Hi everyone, Can anyone provide a license pricing for Secops Module please?

Question

Ask a Question

Top Helpful Authors

User

Count

View all

Unanswered questions

Subject

Author

Posted

Ability to add multiple tenable third-party entri...

Friday

Associate user created “preferred” solution with T...

Thursday

Close button on questionnaire in workspace is not ...

Thursday

implementation sequence for Third Party Risk Manag...

Wednesday

Map entities from Sentinel to ServiceNow

a week ago

View all

Connect at events

Get Started With Security Operations Applications

Online 04/09/25

[APAC] Get Started With Security Operations Applications

Online 04/09/25

Office Hours: Security Operations Applications

Online 04/24/25

ServiceNow will be at RSA Conference 2025

Online 04/28/25

Let's connect together

Join us to make our over 775K member community even better. Create your free account and make the world work better for everyone.

Join the Community

Security Operations

Hot Topics

Security Operations Resource Library

Sarah Wood

2025 Security Operations Events

Sarah Wood

The SOC Agent Advantage: Wrap-up your Security Incidents with Ease

Madhumitha Redd

Security Posture Control: Enabling visibility and prioritization in expo...

Gopi37

Enhancing Security Investigations with AI-Powered Correlation and Now As...

Miranda Ju

What's New in Security Operations November Store Release

lanemclaughlin

Revolutionizing Security Incident Management: Introducing November Gen A...

Miranda Ju

What's New in Security Operations- Xanadu Release

lanemclaughlin

Threat Intelligence Security Center (TISC) updates from August and Novem...

Kalyan8

Threat Intelligence Security Center (TISC) is Generally Available now!

Kalyan8

Announcing Security Posture Control

Gopi37

Getting Started

Welcome Guide

Major Security Incident Management Welcome Guide

Product Checklist (SIR)

Product Checklist (VR)

Quick Start (Setting up section)

FAQ

Measure and Grow

Measuring Success

Product Docs

Performance and Measurement

Value Measurement

Get Started With Security Operations Applications

[APAC] Get Started With Security Operations Applications

Office Hours: Security Operations Applications

ServiceNow will be at RSA Conference 2025

On Demand Events

Get Started With Security Operat...

ServiceNow

"Success with VR" webinar series

Eliz Skogquist

"Success with SIR" webinar series

Eliz Skogquist

Leveraging the Cybersecurity Executive Dashboard

Eliz Skogquist

On Demand Webinar: Learn how AI ...

Megan Le

"Success with SIR" webinar: Understanding SI task types, Security KBs an...

Eliz Skogquist

Understand Threat Intelligence Security Center's Value to your Organizat...

Eliz Skogquist

Take a look at the Major Security Incident Management Bootcamp

Eliz Skogquist

Resources

What's New Blog

Release Notes

Entitlements

Store

SecOps roadmap

Related Products

Governance, Risk, & Compliance

Operational Technology (OT)

ITSM

Software Asset Management

CMDB

ServiceNow Impact

Featured The SOC Agent Advantage: Wrap-up your Security Incidents with Ease

Featured Get Ready for Connect x Accelerate 2025 – ServiceNow’s Integrated Risk and Security Symposium!

Featured Knowledge25 - Registration is open - and check out pre-con!

Featured Recommended Training for Security Operations

Featured SecOps Training - Instructor-led options

Resolved! In Vulnerable Item Detections- Configuration Item do match DNS name and NetBIOS name.

Resolved! Add columns to the Vulnerability Manager Workspace List View

Resolved! Search directly for CVE’s with Tenable.sc plugin-based integration

Resolved! unable to find and configure "Respond" button in DLP Analyst Workspace

Resolved! Pricing for Secops Module