ServiceNow integration with Defender for Cloud

ServiceNow is a cloud-based workflow automation and enterprise-oriented solution that enables organizations to manage and track digital workflows within a unified, robust platform. ServiceNow helps to improve operational efficiencies by streamlining and automating routine work tasks and delivers resilient services that help increase your productivity.

ServiceNow can be integrated with Microsoft Defender for Cloud to allow customers to prioritize remediation of recommendations that affect your business. Defender for Cloud integrates workflows with the following ServiceNow modules:

• IT Service Management (ITSM) -For incident management. As part of this connection, customers can create and view ServiceNow tickets, that are linked to recommendations generated in Defender for Cloud.
• Configuration Compliance - For compliance management. As part of this connection, customers can review and address Defender for Cloud's CSPM plan's findings in ServiceNow's portal.

IT Service Management (ITSM)

As part of the integration, you can create and monitor tickets in ServiceNow directly from Defender for Cloud:

• Incident: An incident is an unplanned interruption of reduction in the quality of an IT service as reported by a user or monitoring system. ServiceNow’s incident management module helps IT teams track and manage incidents, from initial reporting to resolution.
• Problem: A problem is the underlying cause of one or more incidents. It’s often a recurring or persistent issue that needs to be addressed to prevent future incidents.
• Change: A change is a planned alternation or addition to an IT service or its supporting infrastructure. A change management module helps IT teams plan, approve, and execute changes in a controlled and systematic manner. It minimizes the risk of service disruptions and maintains service quality.

Bidirectional synchronization

As part of the governance capabilities within Defender for Cloud, you can enable a bi-directional integration between ServiceNow and Defender for Cloud, for the creation of ITSM incidents, changes or problem tickets.

Tickets can be initiated manually or automatically by leveraging governance automation rules.

Configuration Compliance module

As part of the integration, you can utilize the Defender for Clouds CSPM plan's findings into the ServiceNow Configuration Compliance module to unify compliance efforts across on-premises and cloud environments.

When you ingest Defender for Cloud's findings into ServiceNow's Configuration Compliance module, your teams can utilize the Configuration Compliance module to identify, prioritize and remediate configuration issues in your cloud assets. You can also reduce security risks and improve your overall compliance posture through automated workflows and real-time insights.

To integrate Defender for Cloud's findings into ServiceNow's Configuration Compliance module:

• In the Azure portal:

  • An Azure account with Defender for Cloud onboarded. If you don't already have an Azure account, create one for free.
  • Enable Defender for Cloud Foundational CSPM or Defender CSPM on the relevant Azure subscriptions, AWS accounts or GCP projects.

• In ServiceNow:

  • Have an application registry in ServiceNow.
  • Enable the ServiceNow Configuration Compliance module.
  • Enable the ServiceNow Microsoft Defender for Cloud integration..
  • Configure the Microsoft Defender for Cloud Integration in ServiceNow.

Related content

• Connect ServiceNow's ITSM module to Defender for Cloud
• Create a ticket in Defender for Cloud
• Assign an owner to an recommendation or severity level