Thank you for your feedback.
Form temporarily unavailable. Please try again or contact to submit your comments.
  • London
  • Kingston
  • Jakarta
  • Istanbul
  • Helsinki
  • Geneva
  • Store

Manual search commands

Manual search commands

Manual search commands are entered from any Search window. You can create a security incident or event. After the command, there are pairs of field names and values used to create the desired record.

Security event

The security event command, snsecevent, creates an event in ServiceNow with the Security classification.

These events can be reviewed on their own, or alert rules within ServiceNow or manual actions can turn an event or collection of events into a security incident.

The following example defines the required parameters, as well as some additional data, and shows the result (no error message) after a successful run.

If the event becomes a security incident and each parameter is sent into the event, this data is used to populate the security incident as follows:

Parameter Name Required Use Use in Security Incident
node Yes The node represents the server or configuration item for the event. Ideally, this maps to an existing CI within ServiceNow. Affected CI

Short description

type Yes The category of event. Short description
resource Yes The affected resource. Short description
source No The origination of this data. By default, the Splunk server generates the data. Activity log
external_url No The drilldown URL to use in ServiceNow to get back to the Splunk data regarding this event. By default, this contains the result link for any alert, or a link to the default Splunk search page. External URL accessed via the Drilldown button on the Security Incident form
All other values (category, subcategory in the example above) No Any field that is not part of the information field in the event and is used if a security incident is created. If the field exists, and is not populated, the security incident uses that value – for example, the category passed through the Event becomes the category of the new security incident. If a field with this name does not exist, the value is placed in the activity log.

Security incident

The Security Incident command, snsecincident, creates a new Security Incident in your ServiceNow instance.

Parameter Required Use
short_description Yes A short, one line description of the incident.
category No The category of the security incident. If this category does not exist, it will be created.
subcategory No The subcategory. If this subcategory does not exist, it will be created.
cmdb_ci No The affected resource (server or configuration item) for the security incident. Ideally, this will map to an existing CI within ServiceNow.
description No The longer, detailed description of the incident.

There are many possible useful columns – anything in the Security Incident transform map may be used, and if new columns are added to the security incident, they too may be used here, as long as they are in the transform map. Some useful columns: location, priority, assignment_group, assigned_to, affected_user, attack_vector, and watch_list.