Configure ServiceNow Export Connector

There are two steps to configure a ServiceNow export connector:

  • Create a connection to your ServiceNow instance.
  • Create a Smart Group with parameters configured to include the assets (and data) to export to ServiceNow. After the Smart Rule is created, the data in the rule is refreshed and exported based on the Smart Rule Action expiration period, which is every hour by default.

Create ServiceNow Export Connector

Follow the steps below to create the connector:

  1. In the BeyondInsight Console, go to Configuration > General > Connectors.
  2. In the Connectors pane, click Create New Connector.
  3. Enter a name for the connector.
  1. Select ServiceNow Export Connector from the Connector Type dropdown list.
  2. Click Create Connector.
  3. Select the applicable Organization from the dropdown list.
  4. Leave Active (yes) enabled. Asset data is imported from ServiceNow only when the box is checked.
  5. Enter a ServiceNow Username and Password. The credentials for the ServiceNow system must provide access to the web service and be able to create requests.
  6. If you are using an older version of ServiceNow and you are using update sets, enable the Using Update Set option.
  7. Enable Asset Export.
  8. For the export options, enter the following information:
    • Web Service URL: Enter the URL to the ServiceNow instance.
    • Field Mappings: Enter the field mappings according to which export options you selected. Available fields and suggested field mappings are detailed in sections below.
  9. Click Test Connector to ensure the connection to the ServiceNow instance is working.
  10. Click Create Connector.

Create Field Mappings for Exporting Assets

When creating field mappings, the following must be considered:

  • Asset ID must be mapped to a ServiceNow field.
  • The ServiceNow field name must be mapped if assets are being exported.

These BeyondInsight asset fields are available for export:

  • Asset ID
  • Asset Name
  • Dns Name
  • Ip Address
  • Operating System
  • Asset Risk
  • Workgroup
  • SmartGroup Name
  • Date Added
  • Last Updated
  • Literal Value (Enter Literal Value)

Suggested Field Mappings

ServiceNow Field Data Type Asset Field Literal Value
correlation_id or custom correlation_id field String Asset ID  
correlation_display or custom correlation_display field String (Literal Value) BeyondInsight Asset
name String Asset Name  
ip_address String IP Address  
Os String Operating System  
Map other fields as determined by user requirements.

Create a Smart Group

Assets exported are defined in the Smart Group. After the Smart Group is created, the data in the rule is processed and exported every hour.

You can change the processing time in the RemManagerSvc.exe.config file. For more information, please see Change the Data Export Processing Frequency.

  1. Configure the Smart Group as usual.
  1. In the Actions area, select Export Data.

Screen capture of Export Data filter for Smart Group used for ServiceNow Export Connector

  1. Select the name of the connector.
  2. Select an audit group from the list.
  1. Enter the expiration period in days, and then click Save.

 

Assets(depending on what is defined in the collector details) are only exported once in the defined expiration period. However, an asset may be exported more than once if, for any reason, the item is excluded from the smart group but is re-included later. After the expiration period passes, if that asset or vulnerability remains in the smart group, it is exported again.

For more information on working with Smart Rules, please see the BeyondInsight User Guide.

Change the Data Export Processing Frequency

You can set the data export processing frequency value in the RemManagerSvc.exe.config file, located in the BeyondInsight installation directory, by changing the referenceTime value.

<!-- Data export processor. This exports Assets and/or Vulnerabilities to external systems such as BMC Remedy. -->
<Process name="DataExportProcessor" assembly="" order="13" active="true" accessType="internal">
<Handlers>
<Handler name="DataExportHandler" handlerType="1" runFrequency="1" frequencyType="h" referenceTime="1:00" namespace="" order="0" active="true"></Handler>
</Handlers>
</Process>

Effective version 21.2, the data export processor does not export vulnerabilities.

Import the BeyondInsight Update Set

The update set provides the BeyondInsight modules and menus in your ServiceNow instance. The BeyondInsight update set file you must import to your ServiceNow instance is located in the following installation directory:

%\Program Files(x86)\eEye Digital Security\Retina CS\ServiceNow

For more information on transferring update sets in ServiceNow, please see Update set transfers.