Install: TruSTAR for ServiceNow V2
This document explains how to install and configure the TruSTAR Workflow App for ServiceNow (Paris version).
Time to Install: 15-20 minutes
- ServiceNow version: Paris, Quebec
- ServiceNow Security Incident Response" module ver 10.0.4 or greater.
The TruSTAR-ServiceNow module is certified for the Paris version only.
- To install directly from the ServiceNow store, you must be using the Paris version.
Installing the TruSTAR App
This procedure downloads the TruSTAR App from the ServiceNow app store.
- Log into the ServiceNow store with HI credentials.
- Search for TruSTAR Integration for ServiceNow.
- Select the TruSTAR integration and click Get.
- Accept any license terms and select the instance where the integration will be installed.
- Log in to the instance where you want to install the application.
- Navigate to System Applications > Applications.
- Select the Downloads tab.
- Locate the TruSTAR Integration, select it, and click Install.
Setting Up User Roles
TruSTAR recommends creating at least two separate roles:
- An Admin role that can edit the TruSTAR application configuration table and perform all other actions offered in the TruSTAR App. In ServiceNow, this is the x_tstar_trustarv2.TruSTARAdmin role.
- A User role that can perform all actions except editing the TruSTAR application configuration table. In ServiceNow, this is the x_tstar_trustarv2.trustar_user role.
You can also set up these roles:
- Security Incident Response: Enables the user to adminster and interact with the SIR table and tickets listed in that table. The sn_si.analyst role provides the functionality you need for the TruSTAR App, but you can also select other roles. ServiceNow documentation for these roles.
- Threat Intelligence: Enables the user to adminster and interact with the Observables table that stores Observables and enrichment data. The sn_ti.observable.admin role provides the functionality that you need for the TruSTAR App, but you can also choose different roles with more fine-grained control. ServiceNow documentation for these roles.
Configuring the TruSTAR App
This section explains how to configure these settings for the TruSTAR App:
- Global Settings
- SIR Submission Settings
- Observable Enrichment Settings
After you finish editing the parameters, you must click the Update Configuration button to save your changes.
- Log into ServiceNow using the Admin role.
- Select TruSTAR on the left menu. If you don't see it listed, use the Search box to locate it.
- Select Configuration, then Settings on the left menu.
- Click New on the top menu bar to begin the configuration. There are three sections to the configuration, as explained in the three tables below:
- Global Settings
- SIR Submission Settings
- Observable Enrichment Settlings
- When you have completed all three sections, click Save to save your changes.
You must configure these settings to use the TruSTAR App.
The TruSTAR Web App URL. This parameter is automatically set to https://api.trustar.co
TruSTAR API Key
Used to make API calls. Finding your API Key
TruSTAR API Secret
Used when making API calls. Finding your API Secret Key
These settings on the SIR Submission tab are used when submitting ServiceNow reports to the TruSTAR platform.
Submission Enclave ID(s)
The Enclave(s) to import data from. To import data from multiple enclaves, separate each Enclave ID with a comma and no spaces. You must specify at least one Enclave ID.
Auto Submit SIR
Select this to automatically submit a new SIR Ticket as a report to TruSTAR.
SIR Fields to Submit
The fields from an SIR ticket that will be included in the report sent to TruSTAR. Click the icon to open a text field that displays the selected SIR fields. You can add or remove fields by clicking the Add/Remove Multiple button on the right of the text field.
The default is to include the Short Description and Description fields.
The incident categories that will not be submitted to TruSTAR. Click the icon to edit the category list.
The default is that no categories are excluded.
Add Observables to Observables Table
Select this to copy the Observables in the Description section of the SIR ticket and add them to the Observables table in that SIR.
Create Observable Enrichment Work Note Summary
Select this to provide a comprehensive list of Indicators with Normalized and Intel Source scoring and links to each Indicator in TruSTAR. This will appear in the Work Notes section of the ticket.
Share to TruSTAR Settings
These settings on the SIR Submission tab define what information is shared with TruSTAR.
Share SIR Reports to Enclaves
Select this to enable a user to share reports and enrichment data to shared Enclaves in TruSTAR.
Sharing Enclave ID(s)
A comma-separated list of Enclave IDs to share reports and indicators to in TruSTAR.
Select this to redact a TruSTAR Report before sharing it into other Enclaves. The redaction process uses the redaction list your organization has stored in TruSTAR.
Share SIR Indicators to Enclaves
Select this to send Indicators from a SIR to a shared Enclave.
These settings on the Observable Enrichment tab control how Observables are handled between ServiceNow and TruSTAR.
Enable Observable Auto Enrichment
Select this to automatically enrich Observables with all available data and metadata from TruSTAR. All data returned from TruSTAR is shown in the Threat Lookup table in the SIR.
Enrichment Enclave IDs
The Enclave(s) to use for enriching Observables. To use multiple enclaves, separate each enclave ID with a comma and no spaces. You must specify at least one Enclave ID.
Select this to enable the Enrichment Period (below).
Expiration Period (# Days)
Number of days before Indicator information in the ServiceNow Threat Lookup Table is updated with any new information from TruSTAR.
The default is 7 days.
After configuration, the TruSTAR App is ready for use.