This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Index template script Get started with Elastic Security »
Elastic Docs ›Elastic Security Solution [8.16] ›Post-upgrade steps (optional)

Update a deprecated ServiceNow connector

edit

Update a deprecated ServiceNow connector

edit

ServiceNow ITSM and SecOps connectors created in Elastic Stack version 7.15.0 or earlier are marked as deprecated after you upgrade to version 7.16.0 or later. Deprecated connectors have a yellow icon after their name and display a warning message when selected.

Shows deprecated connectors

Deprecated connectors will continue to function with the rules they were added to and can be assigned new rules. Deprecated connectors will also continue to function with the cases that they were assigned to, but cannot be assigned to new ones. It is strongly recommended to update deprecated connectors or create new ones to ensure you have access to connector enhancements, such as updating incidents.

Prerequisites

edit

Before creating a new ServiceNow ITSM or SecOps connector, you must complete the following within your ServiceNow instance:

Create a ServiceNow integration user

To ensure authenticated communication between Elastic and ServiceNow, create a ServiceNow integration user and assign it the appropriate roles.

  1. In your ServiceNow instance, go to System Security → Users and Groups → Users.
  2. Click New.
  3. Complete the form, then right-click on the menu bar and click Save.
  4. Go to the Roles tab, then click Edit.

  5. Assign the integration user the following roles: 

    • import_set_loader
    • import_transformer
    • personalize_choices
    • x_elas2_inc_int.integration_user (for ServiceNow ITSM connectors only)
    • sn_si.basic (for ServiceNow SecOps connectors only)
    • x_elas2_sir_int.integration_user (for ServiceNow SecOp connectors only)
  6. Click Save.

Create a CORS rule

A CORS rule is required for communication between Elastic and ServiceNow. To create a CORS rule:

  1. In your ServiceNow instance, go to System Web Services → REST → CORS Rules.
  2. Click New.

  3. Configure the rule as follows:

    • Name: Name the rule.
    • REST API: For ServiceNow ITSM connectors, choose Elastic ITSM API [x_elas2_inc_int/elastic_api]. For ServiceNow SecOps connectors, choose Elastic SIR API [x_elas2_sir_int/elastic_api].
    • Domain: Enter the Kibana URL.
  4. Go to the HTTP methods tab and select GET.
  5. Click Submit to create the rule.

Update a deprecated ServiceNow connector

edit

Follow these steps:

  1. Find Cases in the navigation menu, or search for Security/Cases by using the global search field, then select Settings.
  2. From the Incident management system list, select the deprecated connector to open the Edit connector flyout.
  3. Click Update <connector name>.
  4. In the warning message, click Update this connector.

  5. Complete the guided steps in the Edit connector flyout.

    1. Install Elastic for ITSM or Elastic for Security Operations (SecOps) from the ServiceNow Store.
    2. Enter the URL of your ServiceNow instance.
    3. Enter the username and password of your ServiceNow instance.
  6. Click Update.
« Index template script Get started with Elastic Security »