• The Managing category is renamed to Obtained.
• The Pricing category is renamed to Price.
• The Licensing category is renamed to License Status.

• Add the full version of a software product in the software product life cycle when associating an application service to a software model.
• Retrieve the risk that is calculated based on both the software model and the version added in the application service software model.
• Identify the software model by its name and full version in the By Business Application, By Product Classification, and By Software Model views in the TPM timeline screen.
• View the software model in the By Product Classification view in terms of the software product model. Expand the software product model group to view all the versions associated with the model.

• License counting and reporting per domain:

  You can view the ITOM Subscription Unit (SU) consumption by domain. Use this information to attribute consumption and costs to other organizations.

• Exclusion of desktop and PaaS-Managed virtual machines:

  You can identify virtual machines (VMs) that are used as desktops (such as VMware VDI) or managed automatically by PaaS (such as AWS EC2 Container Service). You can exclude VMs from the Server Licensed Resource category.

• ITOM Discovery:

  ITOM Discovery is an entry-level package alternative which you can use to build a healthy data platform. This package measures the licensed usage of the Discovery feature and Service Graph Connectors.

• ITOM Optimization:

  The Cloud Insights feature enables broader cost-management use cases. ITOM Optimization v2 subscriptions are no longer factored in Cloud Insights usage.

• Health Log Analytics:

  If you purchase this subscription, consumption is reflected via ITOM Health, but is based on log data. Consumption is also based on the events and performance metrics received from licensable resource types.

CMDB tracks source information for non-dependent relationships, such as the source name, in the Relationship Sources [sys_rel_source] table. You can use Information in that table to decide whether it is safe to delete a non-dependent relationship.

When a non-dependent relationship is deleted from the CI Relationship [cmdb_rel_ci] table, all corresponding records in the Relationship Sources [sys_rel_source] table are automatically deleted.

In the base system, the Suggested Relationship [cmdb_rel_type_suggest] table details the relationship types that are appropriate for a CI type, based on its class. ITOM Visibility, if available, uses enhanced discovery patterns to identify and add CI relationships to the Suggested Relationships table. As a result, the CI Class Manager contains a more comprehensive view of CIs and their relationships.

Also, if you are integrating third-party data into the CMDB, use information stored in the Suggested Relationships table to select relationships that are in compliance with Common Service Data Model (CSDM) standards.

Query rules are used to filter the records in CSM-related tables that are accessible by users with CSM roles. These filters, which are applied in query business rules and READ ACLs on CSM-related tables, are stored in a metadata table.

• Enable HTML editor while creating a case.
• Configure the CSM standard ticket page.
• A case is rejected only when a user enters the reason for rejection.
• Users cannot add comments to a case in closed state.
• Hide system-generated emails from the activity stream.

Pipeline UI steps are shown in the order they ran instead of the order configured in DevOps pipeline steps.

Version 1.20: The end time in the Pipeline UI signifies the time when the pipeline finished running, not necessarily when pipeline was completed.

Version 1.21: Commits reverted in the same pipeline execution are not shown in change request and artifact version commit lists.

• Use a new table for topology based correlation instead of suggested relations. Take full control of the relations from a dedicated location.
• Perform Impact Analysis on application services without CIs. Create application services without CIs, bind alerts to the application services, and ensure that the severity is reflected accurately.

In GRC: Profiles (Version 12.0.5), the GRC Business User role is now assigned to any user account that performs a GRC operation for licensing purposes. Those users are added to the GRC: Business User group. You can remove this role from users as needed.

Version 10.0: Use SOX content in GRC components, such as entities, control objectives, audit tasks, and so on. The layout and view of existing SOX reports have been improved. New features and capabilities have been added to ServiceNow® Policy and Compliance Management and ServiceNow® Advanced Risk.

• Trigger any subflow.
• Identify when parameters are required or optional.

Create lifecycle event triggers using the ServiceNow® Flow Designer feature. Eliminate the need for administrators to create business rules for lifecycle event triggers.

• License counting and reporting per domain:

  You can view the ITOM Subscription Unit (SU) consumption by domain. Use this information to attribute consumption and costs to other organizations.

• Exclusion of desktop and PaaS-Managed virtual machines:

  You can identify virtual machines (VMs) that are used as desktops (such as VMware VDI) or managed automatically by PaaS (such as AWS EC2 Container Service). You can exclude VMs from the Server Licensed Resource category.

• ITOM Discovery:

  ITOM Discovery is an entry-level package alternative which you can use to build a healthy data platform. This package measures the licensed usage of the Discovery feature and Service Graph Connectors.

• ITOM Optimization:

  The Cloud Insights feature enables broader cost-management use cases. ITOM Optimization v2 subscriptions are no longer factored in Cloud Insights usage.

• Health Log Analytics:

  If you purchase this subscription, consumption is reflected via ITOM Health, but is based on log data. Consumption is also based on the events and performance metrics received from licensable resource types.

• License counting and reporting per domain:

  You can view the ITOM Subscription Unit (SU) consumption by domain. Use this information to attribute consumption and costs to other organizations.

• Exclusion of desktop and PaaS-Managed virtual machines:

  You can identify virtual machines (VMs) that are used as desktops (such as VMware VDI) or managed automatically by PaaS (such as AWS EC2 Container Service). You can exclude VMs from the Server Licensed Resource category.

• ITOM Discovery:

  ITOM Discovery is an entry-level package alternative which you can use to build a healthy data platform. This package measures the licensed usage of the Discovery feature and Service Graph Connectors.

• ITOM Optimization:

  The Cloud Insights feature enables broader cost-management use cases. ITOM Optimization v2 subscriptions are no longer factored in Cloud Insights usage.

• Health Log Analytics:

  If you purchase this subscription, consumption is reflected via ITOM Health, but is based on log data. Consumption is also based on the events and performance metrics received from licensable resource types.

• License counting and reporting per domain:

  You can view the ITOM Subscription Unit (SU) consumption by domain. Use this information to attribute consumption and costs to other organizations.

• Exclusion of desktop and PaaS-Managed virtual machines:

  You can identify virtual machines (VMs) that are used as desktops (such as VMware VDI) or managed automatically by PaaS (such as AWS EC2 Container Service). You can exclude VMs from the Server Licensed Resource category.

• ITOM Discovery:

  ITOM Discovery is an entry-level package alternative which you can use to build a healthy data platform. This package measures the licensed usage of the Discovery feature and Service Graph Connectors.

• ITOM Optimization:

  The Cloud Insights feature enables broader cost-management use cases. ITOM Optimization v2 subscriptions are no longer factored in Cloud Insights usage.

• Health Log Analytics:

  If you purchase this subscription, consumption is reflected via ITOM Health, but is based on log data. Consumption is also based on the events and performance metrics received from licensable resource types.

• Items from other scopes are visible in read-only mode to allow cross-scope configuration.
• URL smart button configuration UI enables you to configure parametrized URLs.
• You can now configure URL functions on list item function instances.
• Four new icons are available in the applet icon picker.

• Use the action ribbon within a record to provide a quick access to various actions, like upload documents, add images, and take photographs.
• Wide screen support for images and videos that optimize the appearance of graphical displays.

• On new instances, you no longer need the pa_viewer role to view the following items. Instead, indicator and breakdown ACLs are respected:
  • Analytics Hub
  • Text Analytics widgets
  • KPI Details
  • Breakdowns on workbench widgets
• Performance Analytics widgets: In general, Performance Analytics widgets follow indicator and breakdown ACLs.
• Targets and Thresholds: On the Analytics Hub, no roles are required to create personal targets and thresholds.

• Create and edit KPI Details targets.
• Modify KPI Details thresholds.

• Set a start date in the future.
• Set a review date on which to consider updating the target.
• Set the target as an improvement on the average score or on the previous target. You can set the improvement as a percentage.

The following configuration options are new:

• Configure the use of indicators as data sources by role:

  The par_vis_config.data_source.can_select_indicator system property enables an administrator to allow specified user roles to select indicators as data sources from the Data Visualization Configuration panel. See Available system properties.

• Apply dynamic filtering for breakdowns:

  When filtering on breakdown elements, you can apply the [is (dynamic)] filter option. This option shows personalized data applicable only to the person viewing the visualization. Element filter options include: "One of my groups," "Groups I manage," and "Me". To understand the concepts behind applying dynamic filtering for breakdown elements, see Personalized visuals.

• Show scores that do not match breakdown elements:

  When you select an indicator as the data source, you can filter the results by breakdown and breakdown element. If you have the Label for unmatched field defined on the breakdown source for a selected breakdown, this label appears in your choice of Elements. Select the label to display scores that do not match any of the elements. This option helps provide views into whether you need to create additional breakdowns or adjust data values.

• Show real-time score for single score visualizations:

  Enable the Real time update option for a score visualization. Enable the Show score update time option to display the timestamp of when a score was last updated.

• Show forecast ranges:

  Enable the Show forecast range option to view forecast ranges for time series visualizations based on indicators.

• Follow filters for a workspace:

  Enable the Follow filters option to display visualizations with the filters that are set for the workspace.

• Drill down into visualization values data:

  Set the Enable drilldown option to allow users to click a visualization value to display its data subset.

• Use multiple data sources:
  Add multiple data sources of the same type for time series and bar visualizations. Configure the following:

  • Individual renaming of data sets.
  • Time series visualization type per metric.
  • Metric and Trend by fields for each source.
  • Y axes used per metric for time series visualizations.
  • Maximum number of groups for multiple data sources. The maximum is either based on the first metric's setting or set individually per source.

• email notifications for issue managers
• ability for issue managers to review issue owner responses
• ability to create issues on policies and authority documents
• select issue ratings that populate the due date based on configured time frames
• create SLAs based on due date and due date reminder email notifications
• capture the issue confirmed date when an issue is confirmed through issue triage, or when a new issue is moved from the New state to Analyze, Review, or Respond
• the minimum role for the "Assigned to" user is GRC Business User [sn_grc.business_user]
• the minimum role for the Issue manager is GRC User [sn_grc._user]

• set up the frequency of acknowledgement campaigns per policy
• schedule acknowledgement campaigns automatically based on frequency
• send out acknowledgement tasks to newly-added users in the audience for an ongoing campaign
• cancel acknowledgement tasks for users removed from the audience for an ongoing campaign
• extend the due date for newly-added users
• define a warning that a campaign will be cancelled due to an associated policy being retired
• define several types of email notifications for audience members and campaign owners

Improved exploration of available use case templates with a linear display of the template cards.

Added the default sort action Recommended to sort use case templates in this order: Guided Setup templates, followed by Classic Pretrained Setup templates, and then Classic Setup templates. You can also sort by A-Z or Z-A.

Showcase the business value of implementing pretrained use cases by selecting the check boxes in the Business Value faceted filter section. Pretrained use cases that meet the selected business value criteria are sorted at the top of the use case template list.

Added a default sort option to show use cases that require immediate attention. The sort option shows integrated underperforming use cases first and indicates the training state, for example, In Progress, followed by integrated normal performing use cases that don't require attention.

• Report on questions using any report type which supports grouping, stacking, columns, and rows.
• Filter on the Variables and Questions fields in the condition builder.
• Sort by the Variables and Questions fields from the Add Sort option in the reports filter.

The configuration of the data visualization component has more styling and data handling options along with an enhanced user interface.

• Searches the junk folder for matching phishing emails and deletes them when you initiate an Microsoft Exchange Online search and delete action.
• A security tag is applied to a security incident, and a work note is created when the search and delete action fails.
• An error email notification is sent to a group, and a work note is created when the Microsoft Exchange Online credentials expire.

• You can select multiple similar alerts in a single profile.
• If a Splunk event field is mapped to a multi-value field and the aggregated event field values are different than the initial triggering event, the additional values are added to the SIR incident field. This applies to commonly mapped multi-value fields: Observables, Configuration Items, and Affected Users.
• New in 11.0.1: You can copy Splunk Enterprise Event Ingestion profiles settings from one Now Platform instance to a different Now Platform instance using the export/import capability. The settings you can export and import include profile name, correlation rules, mappings, filters, aggregation criteria, field translations, fetched sample data, scheduling, and configuration tile source information.
• New in 11.0.1: A new mapping field Splunk Alert Name will appear at the top of the Notable Event Sample Ingestion in the Mapping Section that allows for mapping an event to the source alert rule in Splunk.
• New in 11.0.1: Added left navigation menus for Event Import and Event to Task Table Entries to assist with troubleshooting
• New in 11.0.1: When a single notable event field contains multiple values, those values are parsed and mapped to individual field entries on the SIR incident form. For example, the source IP addresses, asset names, or URLs may have multiple observable field entries or multiple CIs, those are parsed and mapped to individual field entries on the SIR incident form.
• Fixed in 11.0.1: Fetching of sample data breaks when an alert name has a special character like Comma(,).
• Fixed in 11.0.1: The Splunk profile sometimes may not connect when multiple Splunk sources are configured.

• When a notable event correlation rule is disabled or inactive in Splunk Enterprise Security, profile settings (for example sample events, mappings) are retained. Rules must be de-selected and replaced. When new settings are created existing settings (for example sample events, mappings) are erased.
• Suppressed notable events in Splunk ES are excluded during an ingestion of events without additional filtering required.
• Updated the polling mechanism for profiles to create an overlap window between successive polls to ensure that no notable events are missed within a specific interval.
• When two or more Splunk ES fields are mapped to a single SIR field, for example Description, and if one Splunk ES field value is NULL or empty, the SIR field populates the remaining non-NULL field values.
• Notable events are ingested even if the correlation rule has special characters, such as the backslash (\), extra spaces at the end of the rule name, and other special characters (~!@#$%^&*()_+{}[]“:;‘?><,./|\).
• New in 11.0.0: You can copyS plunk Enterprise Security profiles settings from one Now Platform instance to a different Now Platform instance using the export/import capability. The settings you can export and import include profile name, correlation rules, mappings, filters, aggregation criteria, field translations, fetched sample data, scheduling, and configuration tile source information.

• Map multiple fields for configuration items and observable fields when there are multiple raw base events that are related to a single alarm.
• Search for LogRhythm alarms and events in the mapping section.
• View raw events in a separate related list for raw base alarms.
• View all the raw base alarms by using a new navigation link that has been added to the LogRhythm Drilldown Event module.

The following features have been updated for the Microsoft Graph Security API alert ingestion integration:

• Eliminate scripting by leveraging data lookup rules that can now be set on any table within the current scope.
• A user with the catalog_admin role can create or edit a catalog data lookup definition.

• Macro is renamed Custom.
• Macro with Label is renamed Custom with Label.

• Managed by
• Approval group

• Location
• Service level requirement
• Monitoring requirements
• Managed by
• Prerequisites
• Maintenance schedule

Starting with the Quebec release, you must request and activate only the Software Asset Management - SaaS License Management Integrations (com.sn_sam_saas_int) plugin. By activating this plugin, the Software Asset Management - SaaS License Management (com.sn_sam_saas) and Software Asset Management Spoke (com.sn_sam_spoke) plugins activate automatically.

• While posting time, the operational resource plan associated with a task is automatically filled out in the time card. If multiple operational resource plans are associated with a task for that time period, you can select a different resource plan in the Resource plan field. For more information, see the Create a time card topic.
• View the hourly rate of a rate line in functional currency in the Rate in functional currency field of the Rate Line form.

• Chat Setup form: Use system properties listed in the System Messages related list on the Chat Setup form to change the default message text for standard bot messages displayed in Virtual Agent and Live Agent chat.
• Idle Virtual Agent conversations: The default idle timeout period for conversations abandoned by requesters is two hours (7200 seconds) rather than 24 hours. The scheduled job that automatically closes idle conversations, Time Out Abandoned VA Conversations, runs hourly each day rather than once a day. You can also add properties to specify idle timeout values by channel, which overrides the idle timeout period set for all idle conversations.
• Conversation states: The Interactions [interactions] table captures the current conversation state in the State field (In Progress, Closed Complete, and Closed Abandoned). The State Reason field provides detailed explanations for the Closed Complete and Closed Abandoned states, based on whether you're using Virtual Agent, Virtual Agent with Live Agent, or Live Agent only.
• Virtual Agent Designer
  • Virtual Agent text formatting: Enable topic authors to use text formatting to highlight and structure bot responses in web/mobile channels, including bold and italic text, bullet lists, links (URLs), and emojis.
  • Secure input handling: Support for the secure input and handling of passwords in Virtual Agent, including password obfuscation during user input and conversation processing, pass-through to third-party services, and storage such as logs, queues, and tables.
  • Virtual Agent message layouts: Display message content in table and image card layouts. Use the Table bot response control to display content in a column layout with optional column headers.
  • Topic discovery fallback option for NLU-based topics: Specify keywords that Virtual Agent can use during topic discovery when NLU returns no matches.
  • Topic Properties page:
    • Topic types: Includes setup and small talk topics, which were formerly topic categories.
    • Category: Set more than one category for a topic and make the category visible to end users.
    • Condition: Specify topic conditions that control topic accessibility to the end user through a condition builder.
  • Topic management:
    • Node highlighting during topic testing: Quickly see which node (control) is in use as you test (preview) your topic. The current (active) conversation node is automatically highlighted in the Virtual Agent Designer canvas or table view.
    • Search by chat node name in the Virtual Agent Designer canvas.
• Additional multi-language NLU support: Expanded international language support for sixteen languages. The following five languages have intent and entity support: English, French, German, Spanish, and Japanese. The remaining languages have intent-only support: Dutch, Italian, Polish, Brazilian Portuguese, French Canadian, Swedish, Danish, Norwegian, Finnish, Korean, and Chinese.
• NLU support for new system entities: New entities include person name, number, and currency.

• Chat menu: Provide end users with options to enable or disable incoming audible alerts and notifications. You can also provide authenticated end users with the option to subscribe or unsubscribe from receiving notifications through Virtual Agent.
• Input validation of certain data types: Virtual Agent automatically validates the formats of the following items when entered by end users: email, phone number, date, IP address (IPV4 and IPV6), and URLs. If the validation fails, Virtual Agent displays an error message that identifies the invalid data type.

• Synchronous authentication of messages
• Performance enhancements: Send outbound data via a Flow Designer subflow instead of an action for better response times
• Framework support for various features: bot messages, chat branding, contextual actions, custom controls, display of typing indicators to user and agent, notifications, skip functionality (enable user to skip input controls), dynamic translation, user account linking and Quebec features such as secure password handling, text formatting, and system messages.

• On a vulnerability group record in the Open state, when all its associated VIs are removed or deleted, the VI counts are set to 0 and the VG state transitions to Closed with the next run of a scheduled job. Alternatively, you can click the Update status link at any time to refresh the VG record on demand.
• The Source field on the vulnerable item record is read-only.
• Detection records associated with vulnerability groups are displayed as expected.
• The vulnerability item is moved to the In Review state as expected when the associated vulnerability group is moved to In Review.
• The type of change request you select is created as expected from a vulnerability group record.
• SLAs are set as expected when a vulnerability group is split.
• A deferred vulnerability group is set to the Open state when the associated GRC policy expires.
• The Proof field on the vulnerable item detection record is populated as expected after an upgrade to the new detection framework.
• Status changes for vulnerable items and vulnerability groups are updated and displayed as expected.
• The reapply job sets the time zone for the Remediation target date on a vulnerability group record.
• When vulnerable items are deferred, the system property sn_vul.vulnerable_item.approval_required is ignored and the State field on vulnerable items or vulnerability groups is set as expected.

• When an integration run is queued while another integration is in process, the new integration's start time is set as expected.
• If a current integration run is in the Wait Complete state, the next integration run will not start.

• All date-time formats are supported when configuring the Tenable Vulnerability Integration in the Setup Assistant.
• The system's date format is supported for Exception rules.

• Weight values are used as expected by vulnerability calculators to calculate risk scores for vulnerable items. If an exploit exists but there is no information for Exploit attack vector or Exploit skill level, these weights are not added to the VI’s risk score.
• Nulled configuration items are filtered out when calculating Impacted Services, which might improve your performance for this job.
• Deferral expiration emails are triggered as expected.
• All supported languages are available for the Change Request Type field.
• The Summary field on the Rapid7 Solution records is populated as expected.
• Users without User IDs are not automatically added to Exception Rule records.
• Users in assignment groups have the Mark as False positive and Request Exception UI actions available.
• Exception rules also work for vulnerable items without detections.
• Work notes are available when setting filters even when you add new fields.
• The Microsoft Security Response Center Solution Integration (MSRC) API key is no longer required.

• Removed RCA (Restricted Caller Access) record that is not used by VR.
• Domain separation support for the Reapply Calculator feature.
• The App-Sec-Manager role has permission to cancel an Application Vulnerability Integration run.
• Performance enhancements for updates to the vulnerability entry rollup of the Vulnerability Rollup calculator.
• Domain separation support for the exception rule in Exception Management.
• The Reapply remediation target rule job works as expected when the BETWEEN operator is used in the Condition builder.
• False positive Until date validation works as expected.
• The Cancel Exception rule works as expected.
• Domain separation support for the auto-close VI feature.

• Assignment rules
• Remediation target rules
• Vulnerability calculators

Starting with v 13.0, all searches for these forms and records are not case-sensitive.

• For Qualys detections, if the scanner continues to find VIs that were set to Resolved but then not transitioned to Closed/Fixed by subsequent scans, these VIs move back to the Open state when the last found date is later than the Resolved date.
• For Rapid7 detections, an option is now available on the Rapid7 configuration page in your instance to reopen resolved VIs by age. If enabled, VIs set to Resolved but then not transitioned toClosed/Fixed by subsequent scans transition back to the Open state after the number of days that you enter.

• When enabled, (true), the Run separately attribute ensures that integrations of the same type that are also enabled do not run simultaneously.
• For some third-party integrations, a series of integration runs is required to import requested data. For these types of chained integration runs, the Next integration column on the integrations List view displays the next integration scheduled to run in the series after the integration displayed in the Name column is successfully completed.

• Increased the password field length in the Rapid7 Configuration table to accommodate a KMF change.
• Updated permissions for one of the client scripts to ensure proper access.

If you choose to close vulnerable items with the Assets last scanned option selected, a completed run from the comprehensive integrations is not required.

• When enabled, (true), the Run separately attribute ensures that integrations of the same type that are also enabled do not run simultaneously.
• For some third-party integrations, a series of integration runs is required to import requested data. For these types of chained integration runs, the Next integration column on the integrations List view displays the next integration scheduled to run in the series after the integration displayed in the Name column is successfully completed.