BlueApp for ServiceNow

Using the BlueApp for ServiceNow, you can streamline incident response activities by collecting data from ServiceNow and automatically opening ServiceNow incident tickets in response to threats detected by USM Anywhere. The BlueApp for ServiceNow gathers data from the following ServiceNow tables. When you enable access to these tables, the BlueApp pulls all their records and creates events in USM Anywhere. ServiceNow Tables Pulled by the BlueApp

Table Name	Description
pwd_reset_request	A table containing password reset requests
sysevent	A table containing events generated by the ServiceNow system
syslog_transaction	A table containing transaction logs
sys_audit	A table containing inserts and updates to audited records
sys_audit_delete	A table containing audit-deleted records
sys_user	A table containing all the user records
sys_user_role	A table containing all the user role records
sys_attachment	A table containing all the attachment records
report_view	A table containing report_view access control records

The BlueApp for ServiceNow is available in the Standard and Premium editions of USM Anywhere. See the Affordable pricing to fit every budget page for more information about the features and support provided by each of the USM Anywhere editions.

If the BlueApp fails and you receive a message informing you that it has not been loaded, please contact LevelBlue Technical Support for assistance.

This topic discusses these subtopics:

Creating SentinelOne Response Action Rules Configuring the BlueApp for ServiceNow

⌘I

USM Anywhere™

USM Central™

Automated Policy Manager

BlueApp for ServiceNow