Bitsight for Security Incident Response by ServiceNow Integration Guide

Refer to the following guide to integrate the Bitsight Security Ratings Platform and the Bitsight for Security Incident Response application by ServiceNow.

Requirements

• A supported version of ServiceNow.
• The Bitsight for Security Incident Response solution.
• Have an Admin role in ServiceNow.

Instructions

1. Go to the Bitsight platform and retrieve your Bitsight API token.

   Use a Company API token to prevent existing integrations from breaking if certain user accounts are deleted.

2. In the Bitsight for Security Incident Response application, assign a x_bisit_secops_int.bitsight_secops_admin role to a user.
3. Go to the Application Configuration module.
4. Enter your Bitsight API token to the “API Token” field.
5. Check if the API token is set correctly by selecting the Test API Connection button. See testing the configuration.
6. Select the Company GUID button to automatically populate your company’s unique identifier.
7. Configure the max age of observations to import from the Bitsight platform. This is also for triggering security incidents and tasks.
   • Configure whether security incidents are to be created from observations.
   • Configure whether Bitsight Secops Tasks are to be created from observations.
   • Configure the max retention age of observations. Leave as 0 to prevent cleanup.
8. Go to the Observations Import Schedules page.
9. Open the Bitsight Observations Import record.
   • Run: Set the run frequency (recommended daily).
   • Time: Set the import time as desired.
   • Run as: Set the correct user (existing active user with x_bisit_secops_int.bitsight_secops_admin role).

     Leaving this blank results in a failure during the creation of Security Incidents from Business rules.