SOAR Actions in ServiceNow

The ServiceNow Apps have a collection of SOAR (Security Orchestration, Automation, and Response) actions that are initiated on Alerts from the Security Incident record page and execute in Carbon Black Cloud.

Note: SOAR Actions are available based on their availability in the sensors deployed and the permissions configured for the API credentials.

Instructions for executing a SOAR action, and each supported action, are described in the following topics.