ServiceNow

The ServiceNow Playbook App provides users with a set of actions to work with ServiceNow table records and attachments. These actions provide the key building blocks for automating processes between ThreatConnect and ServiceNow. The following actions are available:

• List Table Records
• Get Table Records
• Create Table Records
• Update Table Records
• Add Attachment

This app can be found in the ThreatConnect App Catalog under the following name: ServiceNow

The ThreatConnect Activity Pack for

provides a set of activities that can be leveraged from ServiceNow Orchestration workflows to interact bidirectionally with ThreatConnect’s API and Playbooks. These activities provide a broad set of functionality that can be used for automating processes

associated with security operations and incident response. Think of it as predetermined automation actions that will allow ServiceNow analysts like you to interact with ThreatConnect in a variety of ways:

• Create ThreatConnect Incident – This activity creates an Incident in ThreatConnect
• Create ThreatConnect Indicator – This activity creates an Indicator in ThreatConnect
• Get ThreatConnect Incident – This activity retrieves  an Incident from ThreatConnect
• Get ThreatConnect Indicator – This activity retrieves an Indicator from ThreatConnect
• Filter ThreatConnect Indicators – This activity retrieves multiple Indicators from ThreatConnect
• ThreatConnect API Client –  This activity provides general-purpose access to the ThreatConnect API
• Run ThreatConnect Playbook – This activity triggers a ThreatConnect Playbook with an HttpLink Trigger

This app can be found in the ServiceNow store under the name: ThreatConnect Activity Pack for Orchestration

*This app now supports Quebec version

The ThreatConnect app for ServiceNow Security Operations provides Threat Lookup and Observable Enrichment capabilities against ThreatConnect intelligence and analytics collections. These features give analysts working inside ServiceNow the information they need to get relevant and actionable insights from intelligence sources within the ThreatConnect Platform. The app contains the following actions:

• Enrich Observables
• Provides detailed context from ThreatConnect in an enrichment table
• Perform Threat Lookups
• Produces Malicious or Unknown Rating automatically

This app can be found in the ServiceNow store under the name: ThreatConnect for Security Operations