Skip to main content

Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

ServiceNow Cloud Connector

ServiceNow offers software as a service (SaaS) for technical management support to help organizations manage digital workflows for enterprise operations. The ServiceNow cloud computing platform provides IT service management (ITSM) services to process customer service requests including incidents, problems, changes, and other services. For more information, see the ServiceNow Documentation.

Prerequisites to Configure the ServiceNow Connector

Before you configure the ServiceNow connector you must complete the following prerequisites:

  • Ensure that you have ServiceNow Fuji release version or later

  • Note the user name and password of a user with read permission for the following tables:

    • sysevent (login events)

    • sys_audit (user lockout and update related events)

    • sys_audit_role (roles related events)

    • sys_user (user added events)

    • pwd_reset_request (password reset events)

    • sys_attachment (attachment events)

    • syslog_transaction (resource views events)

    • report_view (report run events)

    • sys_user_role (roles defined, data enrichment)

  • Ensure that you enable table auditing for the following system tables to track changes:

    • sysevent (login events)

    • sys_audit_delete (user deleted events)

    • sys_audit (user lockout and update related events)

    • sys_audit_role (roles related events)

    • sys_user (user added events)

    • pwd_reset_request (password reset events)

    • sys_attachment (attachment events)

    • syslog_transaction (resource views events)

    • report_view (report run events)

  • Obtain the value for the ServiceNow Time Zone

Enable Auditing for a Table

To enable auditing for a table:

  1. Log in to the ServiceNow console as an administrator.

  2. Navigate to System Definition > Dictionary.

  3. Select the table you want to audit, in the list of dictionary entries. For example, cmdb_ci_computer or sys_user.

  4. Select the dictionary entry for the table.

  5. Select Audit to enable table auditing.

  6. Click Update.

    Note

    Follow this procedure to enable and verify table auditing for multiple tables for which you want to get audit.

Obtain the Time Zone Value

To obtain the time zone value:

  1. Log in to the ServiceNow console as an administrator.

  2. Navigate to Self Service > My Profile.

  3. Click your profile image, then click Profile.

  4. Note the time zone value on the profile page.

Configure the ServiceNow Connector

ServiceNow offers software as a service (SaaS) for technical management support to help organizations manage digital workflows for enterprise operations. The ServiceNow cloud computing platform provides IT service management (ITSM) services to process customer service requests including incidents, problems, changes, and other services. For more information, see the ServiceNow Documentation.

The following table displays audit source API and security events supported by the connector.

Audit Source: API

Service or Module Covered

Event Types

Event Included

Event Logs

sysevent table events

The event log records all system events that occur within the system. For example, login success, login failed, logout, attachment downloaded, and user impersonation events

System Audit

User management

sys_audit table events

User locked-out, unlocked, added, deleted, updated, activated, and deactivated

Password management

Password rest, password changed

Resources management

Resource created, deleted, and updated

System Audit Delete

User deletion

sys_audit_delete table

User deletion events

Resource deletion

sys_audit_delete table

Represents events related to deletion of resources in the system

User

User management

sys_user table

Represents user management events such as user profile edited, and settings changed

Password history

History for the password field of the user

Roles

Role management

sys_audit_role table

Represents changes to user roles

Transaction Log

Transaction log

syslog_transaction table

Represents transactions activities such as resource viewed

Report View

Reports usage

Represents events related to reports usage such as report run

System Attachment

Attachment management

sys_attachment table

Represent activities related to attachments such as attachment uploaded

Table 26. Audit source API and security events supported by the connector


To configure the ServiceNow connector to import data into the Exabeam Cloud Connectors platform:

  1. Complete the Prerequisites to Configure the ServiceNow Connector.

  2. Log in to the Exabeam Cloud Connectors platform with your registered credentials.

  3. Navigate to Settings > Accounts > Add Account.

  4. Click Select Service to Add, then select ServiceNow from the list.

  5. In the Accounts section, enter the required information. Required fields are indicated with red bar.

    1. Account Name – Specify a name for the connector. For example, ServiceNow_customer_support.

    2. (Optional) Description – Describe the ServiceNow connector. For example, Corporate service management system.

    3. Hostname – Enter the domain name for the ServiceNow account. For example, myorg.servicenow.com.

    4. Username – Enter the user name of ServiceNow administrator.

    5. Password – Enter the password for the ServiceNow administrator.

    6. Time-Zone – Enter the time zone value that you obtained while completing prerequisites. The Exabeam Cloud Connector platform uses this value while ingesting audit events from ServiceNow.

  6. To confirm that the Exabeam Cloud Connector platform communicates with the service, click Test Connection.

  7. Click Done to save your changes. The cloud connector is now set up on the Exabeam Cloud Connector platform.

  8. To ensure that the connector is ready to send and collect data, Start the connector and check that the status shows OK.