Designate email domains as untrusted or trusted
Designate specific email domains as untrusted or trusted so that you can monitor the metrics for incoming emails from these sources in your instance.
Before you begin
Role required: security_dashboard_user or admin
About this task
Important: Instance Security Center (ISC) reached end of sales in September 2024 and is a legacy product. ServiceNow Security Center is the recommended replacement. For more information, see Migrating to Security Center.
This procedure applies to instances still running ISC. If you have migrated to ServiceNow Security Center, email monitoring is available by navigating to Security Center > Metrics > Email. The trusted and untrusted email domain designation feature described in this topic is not available in Security Center.
When untrusted or trusted domains send emails to your instance, their daily counts appear on the Untrusted Incoming Email or Trusted Incoming Email metrics on the Email page. You can then track email activity from these domains and use email logs to view specific incoming emails. You can also specify a user, usually a manager, or a security analyst, to notify whenever activity occurs from the untrusted or trusted domain.
Note: Designating an email domain as untrusted is for security tracking purposes only. Administrators can also set up a system address filter to ignore emails from untrusted domains. To learn about filtering emails to block their delivery, see System address filters.
Procedure
Navigate to All > System Security > Instance Security Center.
On the Instance Security Center homepage, select Email from the Metrics menu.
Email option from the Metrics menu.
On the Email page, in the Untrusted And Trusted Domains section, click New.
On the form, fill in the fields.
| Field | Description |
|---|---|
| Domain | Name of the email domain that you are designating as untrusted or trusted. For example, enter `servicenow.com` to designate ServiceNow employees can send trusted emails to the instance. |
| Category | Category that indicates if the email domain is untrusted or trusted:- Untrusted Designates that the email domain as untrusted. You use it to identify domains that send suspicious or emails that pose a potential security threat to the instance.
Designates that the email domain as trusted. You use it to identify domains when your metrics indicate that the incoming emails from it pose no security threats. Designating the domain as trusted enables you to track its inbound email activity over time. |
| Active | Check box for enabling or disabling the designated untrusted or trusted status for the specified email domain. |
| Notify | Name of the user to notify by email when activity occurs in the untrusted or trusted domain. Click the spotlight search icon ( Image omitted: Search.png Search) to search for the name of the user. Leave the <strong>Notify</strong> field blank if you do not want notifications sent.</td></tr></tbody>
ResultUntrusted or trusted email domain information is also added to the Untrusted And Trusted Domains listing on the Email page. Parent Topic:Email metrics Related topics |