Integrations Capabilities framework 2.0

The new Integration Capabilities Framework 2.0 has been redesigned to enable implementation of integrations in a simple and consistent manner. This ensures a consistent experience for similar types of integrations (for example: observable reputation lookup).

The new framework has capabilities implemented using Flows.

Benefits from the enhanced framework implementation include:

• The capability flows that include only business level components without any implementation specific logic.
• The capability flows now accept a broad array of inputs and formats for maximum flexibility (For example, observable references, CI references, tasks, any table or sys_id combinations).
• Rate limiting or throttling on integration executions are now easy to configure (removing the need to do this using custom code or changes to implementation workflows).
• Enhanced auditing and execution tracking capabilities now enable better reporting and easier troubleshooting.
• Robust error handling functions are built into the capability flows to avoid duplicating implementation routines.
• Ability to configure conditional triggering of the capabilities or the integrations. This provides flexibility to automatically launch automations based on incident category.
• A default filter condition has been introduced on all capabilities to filter allow listed observables before inputs are provided to the integrations.

Note: This new capability framework does not upgrade the current capability framework. Both frameworks can work in parallel. For instructions on how to leverage the new capability framework, see Using the new Capability Framework with an installed integration and Using the new Capability Framework with a Flow.

Parent Topic:Security Operations Integration Reference

Supported integrations and components

The Security Incident Response plugin includes all the capability flows listed in Integration Capabilities Framework 2.0, and standard high-level filters that you can enable or disable depending on your requirement.

Note: If you want to use the new Capability Integration Framework with the New York release, you must install the ServiceNow IntegrationHub Starter Pack Installer plugin. Contact Customer Support for assistance with the installation.

Supported application versions

Starting with Security Incident Response 10.0, the following integrations are supported:

Starting with Security Incident Response 10.4, the following integrations are supported:

Components included

The new Capability Integration Framework includes the following components:

• Capabilities: All of the following capabilities that exist in the product today as workflows have been redesigned using Flows:
  • Block Request: Provides a way to block observables associated with a security incident on a firewall, web proxy, or some other control point. This capability is used during incident response investigations to contain an identified threat.
  • Email Search and Delete: Provides a way to search an email server during a security investigation and if necessary, delete emails from the server.
  • Enrich Configuration Item: Provides a general way to enrich configuration items with additional information from a variety of sources. This capability is used during incident response investigations to enrich data associated with a security incident.
  • Enrich Observable: Provides a general way to enrich observables with additional information from a variety of sources. This capability is used during incident response investigations to contain an identified threat.
  • Event Ingestion: Provides a general way to create a security incident by mapping events from an integration source to a security incident.
  • Get Network Statistics: Retrieves a list of active network connections from an endpoint or host. This capability is used for incident enrichment during investigations.
  • Get Running Processes: Retrieves a list of running processes from an endpoint or host. This capability is used for incident enrichment during investigations.
  • Isolate Host: Provides a way to isolate an endpoint or a host associated with a security incident. Isolate host is executed against a configuration item (CI).
  • Publish to Watchlist: Provides a way to add observables associated with a security incident to a watchlist that monitors for security events and generates alerts. This capability is used as part of incident response during investigations.
  • Sightings Search: Searches various SIEMs or other log stores for instances of observables. This capability is used to determine the presence of malicious IoCs in your environment.
  • Threat Lookup: Performs threat intelligence lookups to determine whether a certain observable is associated with a known security threat. This capability is used as part of incident response during investigations.
• New tables:
  • sn_sec_cmn_capability: Capability and flow that implements the capability.
  • sn_sec_cmn_capability_implementation: The actual implementation flow that provides the services of the capability.
  • sn_sec_cmn_capability_execution: The execution record for a capability at runtime.
  • sn_sec_cmn_capability_implementation_execution: The execution record for a capability implementation at runtime.
  • sn_sec_cmn_filter_condition: The filter conditions that can be applied at runtime to the capability or a capability implementation.
• Include script: CapabilityProcessor: Handles all the processing code for the framework.
• Rate limit: Capability Max Concurrent Req Per Period: Defines how many integrations can be executed in parallel.
• Scheduled job process capability implementation: Runs every 15 seconds and can be disabled in the Security Administration Properties page (Security Incident > Administration > Properties).
  • Enables or Disables the scheduled job, Process Capability Implementations: This job automatically schedules and manages capability implementation execution flows.
  • Enables or Disables Automated Lookups or Enrichments: Setting that activates or deactivates the scheduled job that performs automated threat lookup or enrichment of observables when observables are added to security incidents in the current capability framework.
  • Enables or Disables the scheduled job, Lookup Security Incident Observables: This job automatically schedules a Threat Lookup or Enrich Observables job when observables are added to a security incident.

Configurations in the new Capability Framework

This section describes the configurations available in the new framework.

Before you begin

Role required: sn_si.admin, flow_designer, action_designer

Procedure

1. Navigate to All > Security Operations > Integrations > Integration Capabilities (Flows).

2. The capabilities available with the base system are displayed.

**Note:**

These are the capabilities provided with the base system. You can use the capabilities, or you can customize them as required. The following steps describe how to configure a capability and the integrations implemented for the capability.

1. Select the link in the Name column to configure a capability.

   The Name, Application, Description, and the Flow that the Capability implements is displayed.

1. Select the Active check box to activate the capability.

   • Filter conditions at the capability level: When an integration capability implements a flow, the filter conditions associated with the flow will be executed before the capability flow is launched. For example, the Threat Lookup capability includes the Filter Allowlisted Observables condition as shown above. Select the Name link to edit the filter condition.

     Note: Select the Add worknote to task check box to add worknotes to include information on the filter conditions used.

    You can either define filter conditions or a script, or a combination of both. In the above example, a script is used to define the filter conditions. When the capability flow is executed, the script searches for allowlisted observables and removes them from the table.

    **Note:** The filter conditions set here are applicable to all active integrations defined in the **Capability Implementations** tab.

-   **Capability implementations**: Select the **Capability Implementations** tab. The implementations \(integrations\) that have been configured for the capability are displayed.

1. Select the Name link to view the Capability Implementation.

   The Name, Application, Description, and the Flow that the capability implements is displayed.

2. Select the Active check box to activate the capability.

   You can specify the following details:

Select the Name link in the Filter Conditions section to configure the conditions defined for the implementation. Add or delete filter conditions, modify the script if required and update the record.

Using the new Capability Framework with an installed integration

This section describes how to use the new capability framework for an existing integration.

Use the steps below to enable an already installed and configured integration (see supported list of Integrations in Supported integrations and components) to use the new capability framework.

Note: Integration Capability Framework 2.0 available with Security Incident Response 10.0.2 supports implementations for the Threat Lookup and Enrich Observable capabilities. Implementations for other capabilities will be made available in a future release.

Before you begin

• Role required: sn_si.admin

• Security Incident Response 10.0.2

• Navigate to Security Operations > Integrations > Capabilities.

• Click on Threat Lookup capability.
• Click the Capabilities Implementation tab.

1. 1. View the Capability Implementation record for the integration of interest (example: Crowdstrike Falcon Intelligence). The Active column should have the value as False.
2. Click the Name link to view the implementation record.

1. Select the Active check box.
2. Ensure the implementation record is pointing to the right configuration record (the tile name for the integration in Integration Configurations > Show Configurations (Yes)).

1. The implementation is enabled for use with the new framework.

Note: All supported Integrations when installed with Security Incident Response 10.0.2 will automatically be enabled under the new Integration Capability framework.

Using the new Capability Framework with a Flow

Use the steps below to create a flow and call the subflow provided by the new capability framework.

Before you begin

• Role required: sn_si.admin, flow_designer, action_designer
• Install one of the supported integrations (see Supported integrations and components)

The steps below describe how to create a sample flow and call one of the subflows provided with the new capability framework.

Procedure

1. Navigate to All > Flow Designer > Designer.

2. Select New and then select Flow to create a new flow and provide the necessary information for the properties.

**Note:** Select **System User** in the Run As choice list as shown in the above image.

1. Select a Trigger condition for the flow (a common trigger is the creation of a security incident record for a certain incident category).

2. In step 1 of the flow, select an action to get inputs from the security incident (for example, observables).

   You can select an action from the actions provided with the base system with the Security Support Common Spoke.

1. In step 2, select a subflow (for example, Threat Lookup).

2. Configure the subflow you have selected as shown below:

1. Save and publish the flow.

Troubleshooting Integration Capability flows

The Capability Executions option provides detailed information on each capability that has been executed.

Note: Completed executions are archived after 30 days.

1. Navigate to Security Operations > Integrations > Capability Executions..

1. Click on the Capability Executions link to view additional details.

Security Incident Record Worknotes

When observables have been added to a security incident and the trigger condition for the flow is met, the Threat Lookup and Enrich Observable subflows are initiated and the following work notes are added to the security incident:

• Flow execution started: Security Operations Integration - Enrich Observable V1
• Flow execution completed: Security Operations Integration - Enrich Observable V1
• Flow execution started: Security Operations Integration – Threat Lookup V1
• Flow execution completed: Security Operations Integration – Threat Lookup V1

To view these worknotes, login as a user with the sn_si.admin or sn_si.analyst, and flow_designer, and action_designer roles.

Navigate to the security incident record page and click on these worknotes to view the flow execution details.