Bitsight for Security Incident Response by ServiceNow Integration Guide

This guide provides instructions for integrating the Bitsight Security Ratings Platform and the Bitsight for Security Incident Response application by ServiceNow.

Requirements

• ServiceNow (Tokyo, San Diego, or Rome)
• Bitsight for Security Incident Response
• System permission: Sys_import_set_row
• Bitsight Security Ratings

Instructions

1. Go to the Bitsight platform and retrieve your Bitsight API token.

   Please use a Company API token. They prevent existing integrations from breaking if certain user accounts are deleted.

2. In the Bitsight for Security Incident Response application, assign a “x_bisit_secops_int.bitsight_secops_admin” role to a user.
3. As an admin user, go to the Application Configuration module.
4. Enter your Bitsight API token to the “API Token” field.
5. Check if the API token is set correctly by selecting the Test API Connection button. See testing the configuration.
6. Select the Company GUID button to automatically populate your company’s unique identifier.
7. Configure the max age of observations to import from the Bitsight platform. This is also for triggering security incidents and tasks.
   • Configure whether security incidents are to be created from observations.
   • Configure whether Bitsight Secops Tasks are to be created from observations.
   • Configure the max retention age of observations. Leave as “0” to prevent cleanup.
8. Go to the “Observations Import Schedules” page.
9. Open Bitsight Observations Import record.
   
   • Set the import time as desired (recommended daily).
   • Set the correct “Run As” user (existing active user with x_bisit_secops_int.bitsight_secops_admin role).

     Leaving this blank will result in a failure during the creation of Security Incidents from Business rules.