Configure ServiceNow Actions (Optional)

To configure actions for ServiceNow, perform the following procedure.

Continue after Step 4 of Configure Vulnerability Response (Optional).

Prerequisites

• Requires Carbon Black Cloud Enterprise EDR
• Create a ServiceNow Configuration Profile

Procedure

1. Select the Add/Remove IoC Details checkbox to configure the Add IOC to Feed action.
2. Provide values for the following fields:
   • Watchlist name: Provide the name of any existing classifier watchlist or provide a new name for the watchlist.
     Note:

     • If the specified watchlist does not exist, the application will create it.
     • If the watchlist exists but is not valid, the wizard will raise the following error: "Watchlist must be empty or subscribed to a Feed".
   • Report prefix: Provide the prefix for the report to be created to which to add the IOCs
   • Report severity: Specify the report severity.

   

3. Click Next.

What to do next

Configure Alert Filtering for ITSM and SecOps Apps (Optional)