ServiceNow

PlexTrac offers an integration with ServiceNow's ITSM and GRC platform modules to allow red and blue teams to collaborate without switching between workflow tools.

ServiceNow GRC (Governance, Risk, and Compliance) is a module of the ServiceNow platform that helps organizations manage their governance, risk, and compliance processes. ServiceNow ITSM (IT Service Management) is a module of the ServiceNow platform that enables organizations to manage their IT services and operations.

Overview

Data flows from PlexTrac to ServiceNow when a finding is used to create a ticket but only from ServiceNow to PlexTrac after setup. The synchronization between PlexTrac and ServiceNow occurs every 30 minutes.

Only one ServiceNow integration can exist per PlexTrac instance.

Creating a Ticket

Step 1: On the row of the finding used to create a ticket, click the three dots under the "Actions" column and click Link ServiceNow ticket.

Step 2: A modal appears. Select the ServiceNow module, the ticket type, and the priority.

For the GRC module, an additional option exists to define the ticket issue rating.

Step 3: Click Save.

The finding now shows the ServiceNow ticket ID and a hyperlink to access the ticket on ServiceNow.

Field Mappings

When a PlexTrac finding is used to create a ticket in ServiceNow, it defaults to a status of New with the following information populated:

PlexTrac	Direction	ServiceNow
Description	-->	Description
Recommendations	-->	Description
References	-->	Description
Affected Assets	-->	Description

When the ticket is created, the priority and issue rating values are stored within ServiceNow.

Existing Ticket Updates

After the ticket is created in ServiceNow, that ticket can only be modified from ServiceNow.

The following fields are then sent from ServiceNow to PlexTrac:

ServiceNow	Direction	PlexTrac
Work Notes	-->	Status Tracker
Status	-->	Status

When a remediation ticket is created in ServiceNow, the finding status in PlexTrac remains "Open" or "In Progress" until closed.

Status Mappings

Below are the mappings of status from ServiceNow to PlexTrac for the various scenarios:

For a task and ticket:

ServiceNow Status	Direction	PlexTrac Status
Closed Complete	-->	Closed
Closed Incomplete	-->	Closed
Closed Skipped	-->	Closed

For an incident:

ServiceNow Status	Direction	PlexTrac Status
Resolved	-->	Closed
Closed	-->	Closed
Canceled	-->	Closed

For an sn_grc_issue:

ServiceNow Status	Direction	PlexTrac Status
Closed Complete	-->	Closed
Closed Incomplete	-->	Closed

If the status value in ServiceNow does not match one of the mapping rules above, the finding will not be updated in PlexTrac when data is synchronized.

Timestamp Logic

Timestamps are captured in two scenarios for this integration:

• When the issue type is created in ServiceNow

• When a work note is created or updated in ServiceNow

Issue Type Timestamps

The timestamp is derived from the time zone set for the ServiceNow instance. PlexTrac has no influence on this time zone.

Scenario: A user in PlexTrac links a finding with ServiceNow. An issue type is created in ServiceNow, and a time stamp is applied to the creation date based on how that ServiceNow instance was configured.

Work Note Timestamps

The timestamp is derived from when the integration sync last ran, not when the work note was created in ServiceNow. It is not a real-time integration timestamp.

Scenario: A user in SerivceNow adds a comment to an associated finding, which triggers an integration event with PlexTrac. When that happens, a note is created in PlexTrac with a timestamp of the synchronization event. That timestamp is stored within PlexTrac in UTC time and then presented to the user in their local time when viewed in PlexTrac.

Configuring an Integration

Step 1: From the Admin Dashboard, click Integrations under "Tools & Integrations."

Step 2: Click Connect within the ServiceNow box.

Step 3: Click Configure ServiceNow Integration.

For information on setting up OAuth or generating an API key within ServiceNow, click the links above the button.

Step 4: Select the integration authentication method.

Step 5: Enter the information into the provided boxes and click Test Connection.

A message will appear to confirm if the connection was successful or not.

Step 6: View the available modules to identify which fields have read and write access. Click Confirm.