ServiceNow SecOps Training Course Content
This 2-day course provides a high-level view of how the SecOps suite bridges the gap between Security and IT.
- Security Incident Response (SIR): Learning the lifecycle of an incident from ingestion (SIEM/Email) to closure.
- Vulnerability Response (VR): Understanding how to prioritize flaws based on business impact rather than just CVSS scores.
- Threat Intelligence (TI): Introduction to TISC (Threat Intelligence Security Center) and ingesting IoCs (Indicators of Compromise).
- Configuration Compliance: Identifying misconfigured assets (e.g., open ports) that violate security policies.
This is the "deep dive" for engineers who build the workflows.
- Now Assist for SecOps: Using Generative AI to summarize security incidents, generate resolution plans, and automate shift handovers.
- Integration Frameworks: Connecting to SIEMs (Splunk, Microsoft Sentinel) and EDRs (CrowdStrike, SentinelOne).
- Major Security Incident Management (MSIM): Setting up dedicated workspaces for high-impact breaches that require cross-departmental coordination.
- Playbooks & Automation: Building "Agentic Workflows" in Flow Designer that can automatically isolate a host or reset a password via IntegrationHub.
Focuses on managing the overwhelming volume of scanner data.
- Vulnerability Workbenches: Configuring the Vulnerability Manager Workspace for real-time visibility.
- Remediation Target Rules: Setting up SLAs for "Time to Remediate" based on the severity of the vulnerable item.
- Cloud Security Integrations: Ingesting vulnerabilities from cloud-native tools like Wiz and Tenable Cloud Security.
- Exception Management: Implementing dynamic questionnaires that require justification and risk assessment for skipping a patch.
Latest advanced features and capabilities in ServiceNow SecOps:
- Threat Investigation Canvas: A new visual workspace for mapping MITRE ATT&CK techniques onto active investigations.
- Process Mining for SecOps: Visualizing where bottlenecks occur in your incident response to improve MTTR (Mean Time to Respond).
- Security Posture Control (SPC): Monitoring gaps in security coverage (e.g., "Which servers are missing our EDR agent?").
- AI Control Tower: Governing the AI agents used in security automation to ensure they follow compliance and privacy guardrails.