Skip to main content
{ Security Operations }

ServiceNow Security Incident Triage

Reads each new security incident in ServiceNow Security Incident Response, joins the affected asset to the CMDB, finds related incidents, and leaves the context and a proposed priority as a work note.

What this agent does

This agent reviews new security incidents in ServiceNow Security Incident Response. For each one, it looks up the affected configuration item in the CMDB and reads its owner, support group, environment, business service, and criticality. It finds open and recent incidents on the same asset or with the same category and source. It proposes a priority from the asset's criticality and the incident category, and it drafts the first question for the asset owner. It leaves all of this as one work note. It never changes the incident's state, assignment, or priority.

The challenge

A security incident arrives from the SIEM with a hostname and a category and little else. The analyst opens the CMDB to find who owns the host, whether it is production, and what business service it supports. They search for other incidents on the same host that someone is already working. That lookup starts every incident, and the queue grows while they do it.

The solution

The agent does the lookup before an analyst opens the incident. It states what the CMDB says and what it does not, and it names each related incident with its state. It proposes a priority and says why, and a person sets it. Provides an incident queue where every new incident arrives with its owner, its environment, its related incidents, and a proposed priority.

Workflow

  1. 01

    Pick incidents

    Take the security incidents in the Draft or Analysis state that the agent has not reviewed, oldest first, up to a limit I set.

  2. 02

    Look up the asset

    Match the affected configuration item, hostname, or IP address to the CMDB and read its owner, support group, environment, business service, and criticality.

  3. 03

    Find related incidents

    Search open and recently closed security incidents for the same configuration item, the same user, or the same category and source.

  4. 04

    Propose

    Propose a priority from the asset criticality and the incident category, and draft the first question for the owner.

  5. 05

    Comment

    Leave one work note with the context, the related incidents, the proposed priority, and the draft question.

Agent template 

# ServiceNow Security Incident Triage

## Measurable outcomes

Every new security incident has a work note with its asset context and related incidents before an analyst picks it up. Track the time from creation to the agent's work note. Track the reviewed, enriched, no CMDB match, and incidents with at least one related incident counts on each run.

## Procedure

Each run, take the security incidents in the Draft or Analysis state that the agent has not reviewed, oldest first, up to a limit I set. For each incident, read the category, the subcategory, the affected configuration item, the affected user, the source, and the description. Match the configuration item to the CMDB. When the incident names a hostname or IP address and no configuration item, search the CMDB by name, fully qualified domain name, and IP address, and say which field matched. Read the owner, the support group, the environment, the business service, the operational status, and the criticality from the configuration item and the business service it supports. Report a configuration item with no owner or support group as an ownership gap. Report an asset with no CMDB match as not in the CMDB, never as low criticality. Search the open security incidents and the incidents closed in the last 30 days for the same configuration item, the same affected user, or the same category and source, and name each one with its state and assignee. Propose a priority from the criticality of the asset and the business service and the incident category, with a mapping I set, and say when it differs from the current priority. Draft one question for the asset owner that an analyst can send, such as whether a named process or login was expected. Leave one work note with the asset context, the ownership gap when there is one, the related incidents, the proposed priority with its reasoning, and the draft question. State in each report that incidents under record-level restriction are not reviewed unless the integration user is an allowed member. Never change the state, the priority, the assignment, or the affected items, and never send anything to the owner. Start in a report-only mode so I can check its notes before it writes to incidents.

## Requirements

It needs ServiceNow Table API access to read security incidents and add work notes to them, and to read the CMDB configuration item, business service, and relationship tables, and nothing more. It never changes incident fields other than work notes, and it never changes the CMDB. Reports outside ServiceNow show categories, states, and counts, with hostnames and user names as stable pseudonyms.