Collect Information for Accessing Your ServiceNow Instance

1. From SSPM, get the redirect URLs that you will need when you register your OAuth 2.0 application in ServiceNow. For onboarding, you must specify the redirect URL for onboarding for scans. If you also want to enable ServiceNow ticketing from SSPM, you must also specify the redirect URL for ticketing.

   To get the redirect URL for onboarding ServiceNow for scans, you will begin the onboarding procedure in SSPM, but you will not complete the procedure.

   1. From the Add Application page in SSPM ( Posture SecurityApplicationsAdd Application), click the ServiceNow tile.
   2. On the Posture Security tab, Add New instance.
      SSPM displays a configuration page for onboarding a ServiceNow instance. The Redirect URL field displays the redirect URL value.
   3. Copy the redirect URL and paste it into a text file.
      Do not continue to the next step unless you have copied the redirect URL. You will need to specify this URL later when you are configuring your OAuth 2.0 integration application.

   If you also want to link SSPM to the ServiceNow instance for ticketing, get the redirect URL for ticketing. To get this redirect URL, you will begin the procedure for linking SSPM to ServiceNow for ticketing, but you will not complete the procedure.

   1. Select SaaS SecuritySettings Workflow Ticketing Settings.
   2. Add Link for ServiceNow.
      The login page for linking to a ServiceNow instance is displayed. The Redirect URL field displays the redirect URL value. Copy the redirect URL and paste it into a text file.
      Do not continue to the next step unless you have copied the redirect URL. You will need to specify this URL later when you are configuring your OAuth 2.0 integration application.
2. Create an authentication scope to limit access to ServiceNow REST APIs.

   During onboarding, you will log in to a ServiceNow account and will grant SSPM access to that account. SSPM will get access to your ServiceNow account through an OAuth 2.0 integration application that you will create. By default, the OAuth token will have full access to the REST APIs that the ServiceNow account can access. Although SSPM will access only the Table API, the OAuth token will allow more access than SSPM requires. Before you create the OAuth 2.0 integration application, create an authentication scope, which will limit SSPM's access to only the Table API. You can create a scope that allows SSPM read-access only or full read and write access to the Table API. Later, you will assign this scope to your OAuth 2.0 application.

   1. Log in to ServiceNow as an administrator.
   2. Make sure the REST API Auth Scope plugin (com.glide.rest.auth.scope) is activated in ServiceNow. To verify that the plugin is activated, navigate to System Definition Plugins and use the search field to locate the plugin. If the plugin is not installed, refer to the ServiceNow documentation to install and activate the REST API Auth Scope plugin.
   3. Create the authentication scope.
      1. Navigate to the Authentication Scopes table (sys_auth_scope.list) by using the filter navigator.
      2. Click New to define the authentication scope.
      3. Specify a meaningful Name for your authentication scope, such as SSPM Connector. You can optionally specify a longer Description.
         Make note of the authentication scope name. You will need to specify this name later when you are configuring a REST API Auth Scope and your OAuth 2.0 integration application.
      4. Submit.
   4. Create a REST API Auth Scope and link it to your authentication scope.
      The REST API Auth Scope is where you will limit SSPM access to the Table API only. You can allow SSPM full read and write access to perform all HTTP methods, or you can limit SSPM to read-only access (GET method only).
      1. Navigate to the REST API Auth Scopes list (System Web ServicesAPI Auth ScopesREST API Auth Scope).
      2. Click New to define the REST API Auth Scope.
      3. In the Name field, specify a name for your REST API Auth Scope.
      4. From the REST API list, select Table API.
      5. Configure the REST API Auth Scope to allow SSPM full read and write access (all HTTP methods) to the Table API, or read-only access (HTTP GET method only).
         • Read-only Access: Configuring the REST API Auth Scope for reduced, read-only access will enable SSPM to perform configuration scans, risky account scans, and third-party plugin scans. However, SSPM will not be able to perform automated remediation of misconfigured settings.
           To configure the REST API Auth Scope for read-only access, complete the following steps:

           1. Deselect the Apply auth scope to all http methods in this API checkbox.
           2. From the HTTP Method list, select GET.

         • Read and Write Access: Configuring the REST API Auth Scope for full read and write access will enable SSPM to perform configuration scans, risky account scans, and third-party plugin scans. It will also enable SSPM to perform automated remediation of misconfigured settings.
           To configure the REST API Auth Scope for Read and Write access, select the Apply auth scope to all http methods in this API checkbox.

      6. In the Auth Scope field, specify the name of the authentication scope that you created earlier. This specification links the REST API Auth Scope to the authentication scope.
      7. Submit.
3. Create your OAuth 2.0 application in ServiceNow.

   1. Log in to ServiceNow as an administrator.
   2. Navigate to the Application Registries page (System OAuth Application Registry).
   3. From the Application Registries page, create a New application.

   4. ServiceNow prompts you to select the type of OAuth application that you want to create. Specify that you want to Create an OAuth API endpoint for external clients.
      ServiceNow displays a dialog for configuring your OAuth 2.0 application.

   5. Fill in your OAuth 2.0 application details using the fields that ServiceNow provides.
      • Specify the Redirect URL for onboarding ServiceNow, and, optionally, the redirect URL for linking to ServiceNow for ticketing. If you are adding both redirect URLs, separate the two URLs with a comma.
      • Under Auth Scopes, add the authentication scope that you created earlier.
   6. Submit.
      ServiceNow registers your new OAuth 2.0 application and displays the Application Registries page. The Application Registries page now lists your OAuth 2.0 application.
   7. Open your OAuth 2.0 application and copy the Client ID and Client Secret into a text file.
      Do not continue to the next step unless you have copied the Client ID and Client Secret. You must provide this information to SSPM during the onboarding process.