Configure how an automatic event is created
Configure the ServiceNow AI Platform to automatically create events in MISP.
Before you begin
- Review the MISP user role and permissions that are required for using the MISP bi-directional features.
- Role required: sn_si.admin, sn_ti.admin
Procedure
Navigate to All > MISP Integration > Automatic Event Creation Profiles.
Click New.
On the form, fill in the fields.
| Field | Description |
|---|---|
| Name | Name of the automatic event creation profile. |
| Description | Brief description about the profile. A more detailed description is shared through the attributes in the next stage of the event's creation. |
| Order | Order of the profile when triggering conditions are met. The default is 100. Leave this setting at the default.If you create multiple profiles, this value provides a run-time execution priority when two or more profiles share triggering conditions. The profile with the lowest number has the highest priority. |
| Source | MISP source for the event creation. |
| Active | Option that indicates if the profile is active or inactive. The option is cleared by default to indicate that the profile is turned off.This profile is not active until you complete all the profile configuration steps and click Finish. |
- Click Continue.
Parent Topic:MISP administration
Related topics
Getting started with MISP integration for Security Operations
Install and configure the MISP integration for Security Operations
Review the MISP integration settings
Configure MISP sighting searches
Troubleshooting MISP integration
Configure event trigger conditions
Configure the event trigger conditions in the ServiceNow AI Platform so that you can automatically trigger an event in MISP when the conditions are met.
Before you begin
Role required: sn_sec_misp.write
Procedure
On the Trigger Conditions form, fill in the details that can trigger an event.
You can build a compound logic by providing the trigger conditions that are based on security incident fields or observable fields. You can also create events in MISP if observables don't have a corresponding event in MISP. You can choose to build a compound logic by using a combination of the three trigger conditions - Trigger based on security incident fields, Trigger based on observable fields, and Create MISP event, if an observable doesn't have corresponding events in MISP. If you select multiple triggers, you can join them by using the AND condition. Consider creating a profile with new conditions if you must use the OR condition.
| Field | Description |
|---|---|
| Trigger based on security incident fields | MISP event that you can create if all the security incident trigger conditions are met. |
| Security Incident Trigger Conditions | Filters in the first row that you can set by using the lists and fields of the conditions builder. To add more conditions, click AND or OR. If AND is selected, all conditions must be matched. If OR is selected, either condition can be matched.To set a second filter condition, click New Criteria. |
| Trigger based on observable fields | MISP event that you can create if all the observable trigger conditions are met. |
| Observable Trigger Conditions | Filters in the first row that you can set by using the lists and fields of the conditions builder. To add more conditions, click AND or OR. If AND is selected, all conditions must be matched. If OR is selected, either condition can be matched.To set a second filter condition, click New Criteria. |
| Create MISP event if observable doesn't have corresponding events in MISP | MISP event that you can create if an observable doesn't have corresponding events in MISP. |
The following example shows the event trigger conditions as you set up the MISP event creation profile.
Configure conditions that are based on an event that is created in MISP.
- Click Continue.
Map the MISP event fields
Map the MISP event fields in the ServiceNow AI Platform so that security incident information is available when MISP events are created.
Before you begin
Role required: sn_sec_misp.write
Procedure
- On the form, fill in the fields.
| Field | Description |
|---|---|
| Event Info | Event information that is automatically created from the ServiceNow AI Platform Security Incident Response.The Event Info field supports substitution variables by using ${SIR FIELD LABEL}$. During an event creation, these variables are replaced with the actual security incident field values. The ${URL}$ substitution variable is replaced with the URL of the security incident. |
| Distribution | Option that controls who can view this event after the event is published. This option also controls whether the event is synchronized to other servers. The distribution is inherited by the attributes, and the most restrictive setting wins. The distribution options are as follows: - Your organization only: Enables only members of your organization to view this event. The event can be pulled to another instance by one of your organization members where only your organization can have the access to view it. Events with this setting are not synchronized. - This community only: Enables users that are part of your MISP community to view the event, including your own organization, organizations on this MISP server, and organizations that run MISP servers that synchronize with this server. Any other organizations that connect to your linked servers are restricted from viewing the event. - Connected communities: Enables users that are part of your MISP community to view the event including all organizations on this MISP server, all organizations on the MISP servers that synchronize with this server, and the hosting organizations of servers that connect to any server that is two hops away. Any other organizations that are connected to the linked servers that are two hops away are restricted from viewing the event. - All communities: Shares the event with all MISP communities. |
| Threat Level | Field that indicates the risk level of the event. You can categorize incidents into three different threat categories \(low, medium, high\). This field can also be left as undefined. The following are the options: - Low: General mass malware - Medium: Advanced Persistent Threats \(APT\) - High: Sophisticated APTs and 0-day attacks |
| Analysis Status | Current stage of the analysis for the event, with the following possible options: - Initial: The analysis is just beginning - Ongoing: The analysis is in progress - Completed: The analysis is complete |
The following example shows the form that you can use to create an event in MISP.
Configure the form to create a new event in MISP.
- Click Continue.
Map or associate SIR observables as attributes to MISP events
Map the Security Incident Response observable types to the MISP attribute types because the MISP attribute types and the SIR observables may be different.
Before you begin
Role required: sn_sec_misp.write
About this task
The MISP integration for Security Operations provides a base system mapping that you use when you add SIR observables as attributes to a MISP event.
You can choose to modify the base system mapping to suit your environment. For example, you can map multiple SIR observables to only one MISP attribute type. If any observable types are not mapped, the other MISP attribute type is selected by default.
Procedure
On the Additional Options form, map the SIR observable and MISP attribute types.
Map the Security Incident Response observable types to the MISP attribute types as described in the following table.
| Field | Description |
|---|---|
| Add all associated observables as attributes | Option that you enable to add available observables in a security incident to a MISP event as attributes.This option enables the mapping in the Observable Type to Attribute Type Mapping section. |
| Observable Type To Attribute Type Mapping | Option to map the SIR observable types to the MISP attribute types. For example, you can map the CVE Number in SIR to the vulnerability attribute in MISP.You can add a SIR observable type to only one MISP attribute type. The base system provides a mapping of the SIR observable types to the MISP attribute types. If any SIR observable types are not mapped to a MISP attribute type, then the observable is mapped to the other attribute type in MISP. To add a new mapping, click Add Observable Type, search for the SIR observable type, and then map to the corresponding MISP attribute type. Click the Remove Mapping icon Image omitted: misp-remove-mapping.png Remove mapping. to remove the SIR and MISP attribute mapping association.</p> Note: For more information on MISP attribute types, see the MISP documentation. |
| Filter observables based on security tags | Option to filter the observables based on the selected security tags.Security tags: Add tags to filter the observables. For example, if you are adding a tag called 'Block from sharing' or 'TLP: White' then if one of the observables has any of these tags associated then these observables will not be added as an attribute to the MISP event during the MISP event creation. |
| Set attribute IDS flag when observable finding is malicious | Option that lets you know that if an observable is marked as malicious in SIR, then the corresponding attribute in MISP has the IDS flag enabled. If the IDS flag is not set, the attribute is considered as contextual information and is not used for automatic intrusion detection. |
The following example shows how to navigate to the additional options page. On this page, you can enable the SIR observables and MISP attribute types mapping, add new SIR observable types, such as the IPV6 network and IPV4 network, and map it to the MISP attribute type domain IP address.
Map SIR observable and MISP attribute type.
Synchronize MITRE-ATT&CK information to MISP events
Synchronize the MITRE-ATT&CK information with MISP attributes for better security incident and threat analysis.
Before you begin
Role required: sn_sec_misp.write
Procedure
- On the Additional Options form, review the options to synchronize the MITRE-ATT&CK information with the MISP attributes.
| Field | Description |
|---|---|
| Sync Security Incident MITRE-ATT&CK™ techniques as local galaxies to MISP event | Option to synchronize the ServiceNow AI Platform SIR security incident MITRE-ATT&CK™ techniques as local galaxies in the MISP event.Note: To add local galaxies, the user who has configured the integration should belong to the host organization of the corresponding MISP server. |
| Sync Security Incident MITRE-ATT&CK™ techniques as global galaxies to MISP event | Option to synchronize the ServiceNow AI Platform SIR security incident MITRE-ATT&CK™ techniques as global galaxies in the MISP event. |
Result
You created a profile that enables you to automatically create events in MISP from the ServiceNow AI Platform. You can now view the events in the Associated MISP Events related list.
Add MISP tags to events
Add MISP tags to the created MISP events.
Before you begin
Role required: sn_sec_misp.write
Procedure
On the Additional Options form, navigate to Select MISP tags to add to the event section on the form view.
Review the options to add tags to the created events.
Field Description Add tags to the created MISP event Option that allows you to automatically add MISP tags to the events that are created from ServiceNow. Tags (Local) The selected tags will be added as local tags to the MISP event. Tags (Global) The selected tags will be added as global tags to the MISP event. Click Save.
Result
Adding MISP tags helps in classification of the event.