FAQ: TruSTAR for ServiceNow
- Related Links
- Manually Installing the App
- Uninstalling the App
- Known Issues
This document covers how to manually install the TruSTAR Workflow App for ServiceNow (London and newer versions), update or uninstall the App, and includes sections on troubleshooting and known issues.
Manually Installing the App
To manually install the TruSTAR Workflow App for ServiceNow, first download the XML bundle here. This XML file supports all available TruSTAR actions from ServiceNow.
Follow these steps to install the XML file into ServiceNow:
- In ServiceNow, go to System Update Sets on the left menu.
- Click Retrieved Update Sets.
- Go to Related Links and Click Import Update Set from XML.
- Select the XML update set you want and click Upload.
- Once the upload has finished, click on the TruSTAR upload set and open.
- Click Preview Update Set at the bottom of the right area to see details of the set.
- Click Commit Update Set to complete the process. After the commit has finished, you must reload the form to see TruSTAR menu items.
Uninstalling the App
- Log in to ServiceNow as Admin.
- Go to System Applications on the left menu.
- Select Applications.
- From the Application Manager, select TruSTAR - Integration.
- Click Uninstall on the next screen then click on the confirmation dialog to proceed with the uninstall.
Q: Does the TruSTAR App ingest work notes or secure notes?
A: No. If you want to submit Indicators or other data to TruSTAR, this information can be inserted in the Description or Short Description fields. The same applies for attachments in Reports; Indicators can be added to either of the Description fields.
Q: Why don't I see TruSTAR enrichment in work notes?
A: Verify that you are submitting the Security incident to your enclave in TruSTAR. Also, check that the filter for worknotes is not turned on. If this filter is selected, it prevents all worknotes from showing, including any enrichment from TruSTAR.
Apply Button does not always save settings.
When configuring the App settings, the Apply button does not always save and apply settings. To ensure that your changes are saved and applied, use the Save button, not the Apply button.
Auto-enrichment runs Observable Enrichment on the same Observable multiple times
You may see this issue if you submit a Security Incident and Observable Enrichment is selected. Observable Enrichment is run multiple times on the same Observable.
TruSTAR Admin role cannot perform some actions
You may not be able to perform actions such as Send to TruSTAR or Whitelist Observable in the TruSTAR App. To resolve this issue, check that the itil and sn_si.read roles are assigned to the TruSTAR App Admin Role. For Madrid users, assign these roles to the Custom User directly.
Popup displayed when selecting integrations for Observable Enrichment
You may see this issue when you try to submit an Observable Enrichment. A popup titled “Leave Site?” saying “Changes you made may not be saved.” appears after you click the Submit button.
This is a known platform limitation. The workaround is to cick Leave and your settings will not be affected. You can use the application normally.
Latency issues attributed to cache
If you notice slowness when loading or other caching issues, you can change how the cache operates in the ServiceNow instance.
- Make sure you are logged into the ServiceNow instance as an Admin user.
- Navigate to System Properties =>All Properties.
- Locate the system property x_tstar_trustar.last_lookup_time.
- Click on the property name. You now see the following message at the top of the instance:
This record is in the TruSTARv2 application, but Global is the current application. To edit this record, click here.
- Click the word here in that message. This switches you from Global to the TruSTAR App.
- In the next screen, click the checkbox for ignore cache to change the scope of the application. Selecting this field avoids the performance cost of flushing all caches and retrieving new property values.