ServiceNow

You can configure Lacework to forward events to ServiceNow using the ServiceNow REST API. Lacework requires a ServiceNow user name with either a web_service_admin, rest_api_explorer, or admin role.

For management and security purposes, Lacework recommends creating a dedicated Lacework-ServiceNow user. For more information, refer to ServiceNow documentation: REST API Reference.

After you create a ServiceNow user and password, return to the Lacework Console and complete the following steps:

1. Log in to the Lacework Console with a Lacework user that has administrative privileges.
2. Select Settings > Integrations.
3. Under OUTGOING, select ServiceNow.
4. Click + Add Integration.
5. Name the integration.
6. Enter your ServiceNow user name.
7. Enter the user name password.
8. Add your instance URL.
9. Select an alert severity level; Lacework forwards events that only meet or exceed the chosen threshold.
10. Click Save.

You should now start to receive Lacework events in the ServiceNow security incident response system.