IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  SNOW integration : Send attachment from ServiceNow to Resilient

    Posted Thu June 13, 2019 11:47 AM
    Edited by Zohra SMAIL Thu June 13, 2019 11:49 AM
    Hello,

    I recently integrated snow into my Resilient platform and noticed that everything is bidirectional (incident creation, task creation, note creation/update) except for the Attachment where one only can send an attachment in one way, from Resilient to ServiceNow.

    Seeing that, I decided to develop my own workflow on ServiceNow side, using Resilient Helper. But then I ran into a documentation that says that Resilient Helper API only provides the following functions:

    ..when I want to deal with attachments!
    I see then that this is impossible to implement with the help of Resilient Helper. Then I had the idea to do this on Resilient with REST API, but then the user would have to log in to Resilient to fetch the incident attachment. Not very smart.

    Is there any better way to implement this?

    Thanks in advance.

    Kind regards.


    ------------------------------
    Zohra SMAIL
    ------------------------------


  • 2.  RE: SNOW integration : Send attachment from ServiceNow to Resilient

    Posted Fri June 14, 2019 03:45 AM
    Hi Zohra,

    The current version of our ServiceNow App (v1.0.0) does not support sending Attachments from a ServiceNow Record to an IBM Resilient Incident.

    The best was to implement this would be to add new functionality to the Resilient Helper to support it and this is something we hope to do in our next release of v2.0.0.

    Today, there is no clean way to do it.

    ------------------------------
    Shane Curtin
    Integrations Engineer - IBM Resilient
    ------------------------------



  • 3.  RE: SNOW integration : Send attachment from ServiceNow to Resilient

    Posted Fri June 14, 2019 09:43 AM

    HI Zohra,

    You can write an integration which is called by the workflow to do this via an automatic rule that is triggered when the servicenow number field is set. If no attachments then no action is needed. We are using a custom built integration to do our servicenow functionality so not sure if that is what you are looking to do but it is possible without a user fetching the number. Let me know if you have any additional questions.

     

    Cheers,

     

     

    image001.png@01D3710F.8410AD90

     

    Ron Varghese

    Engineer, Information Security

    Cloud Security Operations

    5100 Rings Road, Dublin, OH 43017

    614.757.0101 dir

     


    _________________________________________________

    This message is for the designated recipient only and may contain privileged, proprietary
    or otherwise private information. If you have received it in error, please notify the sender
    immediately and delete the original. Any other use of the email by you is prohibited.

    Dansk - Deutsch - Espanol - Francais - Italiano - Japanese - Nederlands - Norsk - Portuguese - Chinese
    Svenska: http://www.cardinalhealth.com/en/support/terms-and-conditions-english.html






  • 4.  RE: SNOW integration : Send attachment from ServiceNow to Resilient

    Posted Fri July 12, 2019 10:59 AM
    Hi Ron,

    I managed to send the attachment's link in note. the user only have to go to the link and fetch the attachment. It is also possible to send the attachment by mail.

    Thanks for your contribution

    Zohra

    ------------------------------
    Zohra SMAIL
    ------------------------------