Cisco Secure Access Push Security Events integration with ServiceNow, Overview

ServiceNow Integration with Secure Access Push Security Events

Configure the integration of Cisco Secure Access Data Loss Prevention (DLP) Push Security Events with ServiceNow.

Secure Access logs security events when end users send requests to destinations associated with Security categories. The Security categories are Command and Control, Malware, Phishing or other security criteria.

Secure Access publishes the DLP Push Security Events for ServiceNow in JSON using the cloud events schema.

Organizations can add Third-party Integrations in Secure Access to receive the Push Security Events. Set up a Webhook for ServiceNow in Secure Access and add the Webhook to the Third-party Integration for ServiceNow.

For more information, see Third-Party Integrations API and Overview of Push Security Events.

Use Cases

  • ServiceNow creates incidents when the ServiceNow HTTP listener receives the DLP Push Security Events from Secure Access.
  • ServiceNow identifies the values of the fields in the security events.

Step 1: Set Up ServiceNow to Receive Secure Access Push Security Events

Before you begin, obtain a ServiceNow account with administrative privileges.

  1. In the ServiceNow app, create a Group for your Cisco Secure Access organization.
  2. Set up filters in ServiceNow. The filters enable ServiceNow to read specific fields in the Secure Access DLP Push Security Events. Optionally add boolean logic with the ServiceNow filters.
    • cisco_origin: The name of the Cisco Secure Access origin.
    • metadata.correlation_id: The correlation IDs for the Secure Access services.
    • policy.name: The name of the DLP policy that triggered the DLP security event.
    • cisco_dlp_metadata.severity: The severity of the security event.
    • cisco_dlp_metadata.event_type: Type of the security event.
    • cisco_organization_id: The ID of the Secure Access organization.
  3. Configure authentication for the ServiceNow HTTP listener. Allow end users to manage Basic authentication for the Cisco Secure Access Group.
  4. Submit the configuration of the Group for Cisco Secure Access.
  5. ServiceNow exposes a single Scripted REST API endpoint URL for all Groups.
  6. When you configure a Webhook in Secure Access, add the exposed ServiceNow endpoint URL to the Webhook.

Step 2: Set Up Push Security Events in Secure Access for ServiceNow

A Secure Access Third-party Integration for Push Security Events requires the configuration of a Secure Access Webhook and credentials for the Webhook.

Configure the Secure Access Third-party Integration for ServiceNow with the DLP Push Security Events only.

  1. Add a Webhook in Secure Access for the integration with ServiceNow. Configure the Webhook with the URL and the Basic authentication credentials of the HTTP listener.
  2. Add a Third-party integration for Push Security Events in Secure Access.
    • For the format of the Push Security Events, select Cloud Events.
    • For the Security Events, select the DLP Push Security Events only.
  3. Validate that your target system receives the Secure Access DLP Push Security Events.