Enabling Asset Bypass (SOAR Action in ServiceNow)

This SOAR action puts an asset into Bypass mode.

• This action can be run from an alert and from a device.
• After the asset is put into Bypass mode in Carbon Black Cloud, the status displays as BYPASS in ServiceNow after the next device sync in the Carbon Black Cloud device table.
• If the asset associated with an alert is removed from Bypass mode, a note displays in Carbon Black Cloud for that alert.
• To directly bypass the asset, you must add configuration items (affected CIs) to the related Security Incident.