Skip to content

Commit af4b731

Browse files
jborsecnikjborsecnik
authored
Merge pull request #208655 from MicrosoftDocs/main
Merge main to Live 4 PM Sunday
2 parents 7b26b23 + 5348ef4 commit af4b731

File tree

4 files changed

+252
-212
lines changed

4 files changed

+252
-212
lines changed

‎articles/azure-functions/storage-considerations.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ Other platform-managed customer data is only stored within the region when hosti
7272
Functions uses a host ID value as a way to uniquely identify a particular function app in stored artifacts. By default, this ID is auto-generated from the name of the function app, truncated to the first 32 characters. This ID is then used when storing per-app correlation and tracking information in the linked storage account. When you have function apps with names longer than 32 characters and when the first 32 characters are identical, this truncation can result in duplicate host ID values. When two function apps with identical host IDs use the same storage account, you get a host ID collision because stored data can't be uniquely linked to the correct function app.
7373

7474
>[!NOTE]
75-
>This same collison can occur between a function app in a production slot and the same function app in a staging slot, when both slots use the same storage account.
75+
>This same kind of host ID collison can occur between a function app in a production slot and the same function app in a staging slot, when both slots use the same storage account.
7676
7777
Starting with version 3.x of the Functions runtime, host ID collision is detected and a warning is logged. In version 4.x, an error is logged and the host is stopped, resulting in a hard failure. More details about host ID collision can be found in [this issue](https://github.com/Azure/azure-functions-host/issues/2015).
7878

‎articles/defender-for-iot/organizations/TOC.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,11 @@
127127
- name: Splunk
128128
href: tutorial-splunk.md
129129
- name: ServiceNow
130-
href: tutorial-servicenow.md
130+
items:
131+
- name: ServiceNow integrations
132+
href: tutorial-servicenow.md
133+
- name: Legacy integration
134+
href: integrations/service-now-legacy.md
131135
- name: System deployment
132136
items:
133137
- name: Manage plans on Azure subscriptions

‎articles/defender-for-iot/organizations/integrations/service-now-legacy.md

Lines changed: 230 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,230 @@
1+
---
2+
title: Microsoft Defender for IoT integration with ServiceNow (legacy)
3+
description: In this tutorial, learn how to integrate the legacy ServiceNow integration with Microsoft Defender for IoT.
4+
ms.topic: tutorial
5+
ms.date: 08/11/2022
6+
---
7+
8+
# Tutorial: Integrate ServiceNow with Microsoft Defender for IoT (legacy)
9+
10+
> [!Note]
11+
> A new [Operational Technology Manager](https://store.servicenow.com/sn_appstore_store.do#!/store/application/31eed0f72337201039e2cb0a56bf65ef/1.1.2?referer=%2Fstore%2Fsearch%3Flistingtype%3Dallintegrations%25253Bancillary_app%25253Bcertified_apps%25253Bcontent%25253Bindustry_solution%25253Boem%25253Butility%25253Btemplate%26q%3Doperational%2520technology%2520manager&sl=sh) integration is now available from the ServiceNow store. The new integration streamlines Microsoft Defender for IoT sensor appliances, OT assets, network connections, and vulnerabilities to ServiceNow’s Operational Technology (OT) data model.
12+
>
13+
>Please read the ServiceNow’s supporting links and docs for the ServiceNow's terms of service.
14+
>
15+
>Microsoft Defender for IoT's legacy integration with ServiceNow is not affected by the new integrations and Microsoft will continue supporting it.
16+
>
17+
> For more information, see the new [ServiceNow integrations](../tutorial-servicenow.md), and the ServiceNow documentation on the ServiceNow store:
18+
>- [Service Graph Connector (SGC)](https://store.servicenow.com/sn_appstore_store.do#!/store/application/ddd4bf1b53f130104b5cddeeff7b1229)
19+
>- [Vulnerability Response (VR)](https://store.servicenow.com/sn_appstore_store.do#!/store/application/463a7907c3313010985a1b2d3640dd7e).
20+
21+
This tutorial will help you learn how to integrate, and use ServiceNow with Microsoft Defender for IoT.
22+
23+
The Defender for IoT integration with ServiceNow provides a new level of centralized visibility, monitoring, and control for the IoT and OT landscape. These bridged platforms enable automated device visibility and threat management to previously unreachable ICS & IoT devices.
24+
25+
The ServiceNow Configuration Management Database (CMDB) is enriched, and supplemented with a rich set of device attributes that are pushed by the Defender for IoT platform. This ensures a comprehensive, and continuous visibility into the device landscape. This visibility lets you monitor, and respond from a single-pane-of-glass.
26+
27+
In this tutorial, you learn how to:
28+
29+
> [!div class="checklist"]
30+
> * Download the Defender for IoT application in ServiceNow
31+
> * Set up Defender for IoT to communicate with ServiceNow
32+
> * Create access tokens in ServiceNow
33+
> * Send Defender for IoT device attributes to ServiceNow
34+
> * Set up the integration using an HTTPS proxy
35+
> * View Defender for IoT detections in ServiceNow
36+
> * View connected devices
37+
38+
## Prerequisites
39+
40+
### Software requirements
41+
42+
Access to ServiceNow and Defender for IoT
43+
44+
- ServiceNow Service Management version 3.0.2.
45+
46+
- Defender for IoT patch 2.8.11.1 or above.
47+
48+
> [!Note]
49+
>If you are already working with a Defender for IoT and ServiceNow integration and upgrade using the on-premises management console. In that case, the previous data from Defender for IoT sensors should be cleared from ServiceNow.
50+
51+
### Architecture
52+
53+
- **On-premises management console architecture**: Set up an on-premises management console to communicate with one instance of ServiceNow. The on-premises management console pushes sensor data to the Defender for IoT application using REST API.
54+
55+
To set up your system to work with an on-premises management console, you will need to disable the ServiceNow Sync, Forwarding Rules, and Proxy configurations on any sensors where they were set up.
56+
57+
- **Sensor architecture**: If you want to set up your environment to include direct communication between sensors and ServiceNow, for each sensor define the ServiceNow Sync, Forwarding rules, and proxy configuration (if a proxy is needed).
58+
59+
## Download the Defender for IoT application in ServiceNow
60+
61+
To access the Defender for IoT application within ServiceNow, you will need to download the application from the ServiceNow application store.
62+
63+
**To access the Defender for IoT application in ServiceNow**:
64+
65+
1. Navigate to the [ServiceNow application store](https://store.servicenow.com/).
66+
67+
1. Search for `Defender for IoT` or `CyberX IoT/ICS Management`.
68+
69+
:::image type="content" source="../media/tutorial-servicenow/search-results.png" alt-text="Screenshot of the search screen in ServiceNow.":::
70+
71+
1. Select the application.
72+
73+
:::image type="content" source="../media/tutorial-servicenow/cyberx-app.png" alt-text="Screenshot of the search screen results.":::
74+
75+
1. Select **Request App**.
76+
77+
:::image type="content" source="../media/tutorial-servicenow/sign-in.png" alt-text="Sign in to the application with your credentials.":::
78+
79+
1. Sign in, and download the application.
80+
81+
## Set up Defender for IoT to communicate with ServiceNow
82+
83+
Configure Defender for IoT to push alert information to the ServiceNow tables. Defender for IoT alerts will appear in ServiceNow as security incidents. This can be done by defining a Defender for IoT forwarding rule to send alert information to ServiceNow.
84+
85+
**To push alert information to the ServiceNow tables**:
86+
87+
1. Sign in to the on-premises management console.
88+
89+
1. Select **Forwarding**, in the left side pane.
90+
91+
1. Select the :::image type="icon" source="../media/tutorial-servicenow/plus-icon.png" border="false"::: button.
92+
93+
:::image type="content" source="../media/tutorial-servicenow/forwarding-rule.png" alt-text="Screenshot of the Create Forwarding Rule window.":::
94+
95+
1. Add a rule name.
96+
97+
1. Define criteria under which Defender for IoT will trigger the forwarding rule. Working with Forwarding rule criteria helps pinpoint and manage the volume of information sent from Defender for IoT to ServiceNow. The following options are available:
98+
99+
- **Severity levels:** This is the minimum-security level incident to forward. For example, if **Minor** is selected, minor alerts, and any alert above this severity level will be forwarded. Levels are pre-defined by Defender for IoT.
100+
101+
- **Protocols:** Only trigger the forwarding rule if the traffic detected was running over specific protocols. Select the required protocols from the drop-down list or choose them all.
102+
103+
- **Engines:** Select the required engines or choose them all. Alerts from selected engines will be sent.
104+
105+
1. Verify that **Report Alert Notifications** is selected.
106+
107+
1. In the Actions section, select **Add** and then select **ServiceNow**.
108+
109+
:::image type="content" source="../media/tutorial-servicenow/select-servicenow.png" alt-text="Select ServiceNow from the dropdown options.":::
110+
111+
1. Enter the ServiceNow action parameters:
112+
113+
:::image type="content" source="../media/tutorial-servicenow/parameters.png" alt-text="Fill in the ServiceNow action parameters.":::
114+
115+
1. In the **Actions** pane, set the following parameters:
116+
117+
| Parameter | Description |
118+
|--|--|
119+
| Domain | Enter the ServiceNow server IP address. |
120+
| Username | Enter the ServiceNow server username. |
121+
| Password | Enter the ServiceNow server password. |
122+
| Client ID | Enter the Client ID you received for Defender for IoT in the **Application Registries** page in ServiceNow. |
123+
| Client Secret | Enter the client secret string you created for Defender for IoT in the **Application Registries** page in ServiceNow. |
124+
| Report Type | **Incidents**: Forward a list of alerts that are presented in ServiceNow with an incident ID and short description of each alert.<br /><br />**Defender for IoT Application**: Forward full alert information, including the sensor details, the engine, the source, and destination addresses. The information is forwarded to the Defender for IoT on the ServiceNow application. |
125+
126+
1. Select **SAVE**.
127+
128+
Defender for IoT alerts will now appear as incidents in ServiceNow.
129+
130+
## Create access tokens in ServiceNow
131+
132+
A token is needed in order to allow ServiceNow to communicate with Defender for IoT.
133+
134+
You'll need the `Client ID` and `Client Secret` that you entered when creating the Defender for IoT Forwarding rules. The Forwarding rules forward alert information to ServiceNow, and when configuring Defender for IoT to push device attributes to ServiceNow tables.
135+
136+
## Send Defender for IoT device attributes to ServiceNow
137+
138+
Configure Defender for IoT to push an extensive range of device attributes to the ServiceNow tables. To send attributes to ServiceNow, you must map your on-premises management console to a ServiceNow instance. This ensures that the Defender for IoT platform can communicate and authenticate with the instance.
139+
140+
**To add a ServiceNow instance**:
141+
142+
1. Sign in to your Defender for IoT on-premises management console.
143+
144+
1. Select **System Settings**, and then **ServiceNow** from the on-premises management console Integration section.
145+
146+
:::image type="content" source="../media/tutorial-servicenow/servicenow.png" alt-text="Screenshot of the select the ServiceNow button.":::
147+
148+
1. Enter the following sync parameters in the ServiceNow Sync dialog box.
149+
150+
:::image type="content" source="../media/tutorial-servicenow/sync.png" alt-text="Screenshot of the ServiceNow sync dialog box.":::
151+
152+
Parameter | Description |
153+
|--|--|
154+
| Enable Sync | Enable and disable the sync after defining parameters. |
155+
| Sync Frequency (minutes) | By default, information is pushed to ServiceNow every 60 minutes. The minimum is 5 minutes. |
156+
| ServiceNow Instance | Enter the ServiceNow instance URL. |
157+
| Client ID | Enter the Client ID you received for Defender for IoT in the **Application Registries** page in ServiceNow. |
158+
| Client Secret | Enter the Client Secret string you created for Defender for IoT in the **Application Registries** page in ServiceNow. |
159+
| Username | Enter the username for this instance. |
160+
| Password | Enter the password for this instance. |
161+
162+
1. Select **SAVE**.
163+
164+
Verify that the on-premises management console is connected to the ServiceNow instance by reviewing the Last Sync date.
165+
166+
:::image type="content" source="../media/tutorial-servicenow/sync-confirmation.png" alt-text="Screenshot of the communication occurring by looking at the last sync.":::
167+
168+
## Set up the integrations using an HTTPS proxy
169+
170+
When setting up the Defender for IoT and ServiceNow integration, the on-premises management console and the ServiceNow server communicate using port 443. If the ServiceNow server is behind a proxy, the default port can't be used.
171+
172+
Defender for IoT supports an HTTPS proxy in the ServiceNow integration by enabling the change of the default port used for integration.
173+
174+
**To configure the proxy**:
175+
176+
1. Edit the global properties on the on-premises management console using the following command:
177+
178+
```bash
179+
sudo vim /var/cyberx/properties/global.properties
180+
```
181+
182+
2. Add the following parameters:
183+
184+
- `servicenow.http_proxy.enabled=1`
185+
186+
- `servicenow.http_proxy.ip=1.179.148.9`
187+
188+
- `servicenow.http_proxy.port=59125`
189+
190+
3. Select **Save and Exit**.
191+
192+
4. Reset the on-premises management console using the following command:
193+
194+
```bash
195+
sudo monit restart all
196+
```
197+
198+
After the configurations are set, all the ServiceNow data is forwarded using the configured proxy.
199+
200+
## View Defender for IoT detections in ServiceNow
201+
202+
This article describes the device attributes and alert information presented in ServiceNow.
203+
204+
**To view device attributes**:
205+
206+
1. Sign in to ServiceNow.
207+
208+
2. Navigate to **CyberX Platform**.
209+
210+
3. Navigate to **Inventory**, or **Alert**.
211+
212+
[:::image type="content" source="../media/tutorial-servicenow/alert-list.png" alt-text="Screenshot of the Inventory or Alert.":::](../media/tutorial-servicenow/alert-list.png#lightbox)
213+
214+
## View connected devices
215+
216+
To view connected devices:
217+
218+
1. Select a device, and then select the **Appliance** listed in for that device.
219+
220+
:::image type="content" source="../media/tutorial-servicenow/appliance.png" alt-text="Screenshot of the desired appliance from the list.":::
221+
222+
1. In the **Device Details** dialog box, select **Connected Devices**.
223+
224+
## Clean up resources
225+
226+
There are no resources to clean up.
227+
228+
## Next steps
229+
230+
In this article, you learned how to get started with the ServiceNow integration. Continue on to learn about our [Cisco integration](../tutorial-forescout.md).

0 commit comments

Comments
 (0)