Security Operations common functionality Whenever any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, or Threat Intelligence) are activated, the Security Support Common plugin is activated. This plugin loads various modules that provide functionality that is common across all Security Operations applications. Note: Only users with the Security Support Common Admin role [sn_sec_cmn.admin] can view and use the Security Operations module. This role is inherited when you are assigned an administrative role in any of the Security Operations applications. Create and define filter groups in Security OperationsCreate and use filter groups to locate records from any table on your instance. For example, you can create a group of all computers by the same manufacturer. You can also filter configuration items (CIs) that have similar vulnerabilities or that fall within a particular subnet IP address range. Security Operations email processingYou can set up the integration of information from external detection systems, provide granularity in processing security operations records, handle unmatched emails, and prevent duplication of records using Email Processing.Security Operationsuser-defined escalationYou can create an escalation path for security incidents for issues requiring more attention or expertise. Once an escalation group exists, a button appears on any security incident in that group. Create workflow triggersCreate a workflow trigger that contains a condition on a table. Security Operations enrichment data mappingEnrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records.Security Operations workflows use enrichment data maps and provide output data to security incidents.Security Operations field mappingSecurity Operations tables can be mapped to and from other tables linking a security incident to a customer service case to other parts of the Security Operations system. For instance, you can integrate a plugin to a Security Incident Response task.Search Security OperationsYou can find information quickly in any Security Operations application using the search icon in the screen header. Zing is the text indexing and search engine that performs all text searches in your instance.Security Operations orchestrationSecurity Operations Orchestration activities allow users to interact with and retrieve data from Windows or UNIX-based systems and environments using workflows. Components installed with Security Support CommonSeveral types of components are installed with Security Support Common. They provide common functionality for use across the various security applications, such as Security Incident Response.