How can you speed up Incident Response on ServiceNow for Automated Enrichment of security incidents using Threat Intelligence ?

How can you speed up Incident Response on ServiceNow for Automated Enrichment of security incidents using Threat Intelligence ?

February 19, 2021
Profile Icon

Jason Franscisco

Today, most enterprise customers have a manual Swivel-Chair Enrichment processes where Level 1 or Level 2 incident handlers within the security operation center are Swivel-Chairing and logging into external systems. An example is to perform observable look up in RecordedFuture or an IOC look up in VirusTotal or CrowdStrike and so on.

To help SOC analysts to automatically enrich newly created security incidents, Loginsoft has built the integration for Thirdparty Intelligence source with ServiceNow which now allows a Level 1 or Level 2 incident handlers to speed up incident response by performing automatic Threat Lookups, observable lookups, get network statistics and so on for a particular endpoint.

Use Cases Developed for the Integration:

  • Perform Manual enrichment by adding observables manually to the Security Incident form and launching workflows.
  • Build enrichment app that enables the automatic lookup of artifacts added to incidents.
  • Run Automatic enrichment lookups on selected observables upon incident creation.
  • Perform threat enrichment on observables to find out if any security threats.
  • Run Threat Lookup to perform a lookup on more than one observable.
  • Run Threat Lookup related link to perform a lookup on single observable.
  • Feed Ingestion
  • With Feed Fetch Interval, the ingested observable can be created as a new security incident then the enriched data for that IOC will automatically added to the created incident.

Automatic Enrichment

In the below case, IP address is automatically parsed and shown as Malicious from a Threat Intelligence source by performing Automatic Threat Look Up.

Automatically Enriched Observable for a Security Incident
IP Address shown as Malicious IP

Manual Enrichment

The Threat Lookup Results shows from Two Threat Intelligence Sources, VirusTotal and RecordedFuture in the sample image below.

Results shown from Threat Intelligence sources.

Manual Enrichments

Similarly, SOC Analyst can do a Manual Look Up Observable for a Security incident by selecting the configured Sources available.

Manual Enrichment of Observables from Sources configured.

Explore Cybersecurity Platforms

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros.

Learn more
white arrow pointing top right

About Loginsoft

For over 16 years, leading companies in Telecom, Cybersecurity, Healthcare, Banking, New Media and more have come to rely on Loginsoft as a trusted resource for technology talent. Whether Onsite, Offsite, or Offshore, we deliver.

Loginsoft is a leading Cybersecurity services company providing Security Advisory Research to generate metadata for vulnerabilities in Open source components, Discovering ZeroDay Vulnerabilities, Developing Vulnerability Detection signatures using MITRE OVAL Language.

Expertise in Integrations with Threat Intelligence and Security Products, integrated more than 200+ integrations with leading TIP, SIEM, SOAR and Ticketing Platforms such as Cortex XSOAR, Anomali, ThreatQ, Splunk, IBM QRadar, IBM Resilient, Microsoft Azure Sentinel, ServiceNow, Swimlane, Siemplify, MISP, Maltego, Cryptocurrency APIs with Digital Exchange Platforms, CISCO, Datadog, Symantec, Carbonblack, F5, Fortinet and so on.

Interested to learn more? Let’s start a conversation.

Book a meeting


Latest Articles

Get practical solutions to real-world challenges, straight from experts who conquered them.

View all our articles

Sign up to our Newsletter