Send Security Command Center data to ServiceNow

Standard-legacy, Standard, Premium, and Enterprise service tiers

The Security Command Center Enterprise service tier will shut down on May 21, 2027. If your organization uses the Enterprise service tier, then the organization will automatically move to the Premium service tier on or after May 21, 2027. Contact your account representative or a Google Cloud sales specialist if you have questions.

This document explains how to automatically send Security Command Center data to ServiceNow and provides guidance on how to manage the exported data. You can export the following data types:

• Findings
• Assets
• Audit logs
• Security sources

ServiceNow provides technical management support, including helpdesk functionality. Its management system helps automate task-intensive IT processes and events using digital workflows and employee service portals.

Supported versions

You can send Security Command Center information to ServiceNow IT Service Management (ITSM) or ServiceNow Security Incident Response (SIR).

Security Command Center supports integrations with the following ServiceNow versions:

• Vancouver
• Utah

If you use an earlier version (such as Rome, San Diego, or Tokyo), you should migrate to the latest supported version.

To get started with ServiceNow, see the ServiceNow contact page.

Limitations

This section describes the limitations of this integration.

You can fetch a combined maximum of 1,000 assets, findings, sources, or audit logs per API call.

Before you begin

Before integrating with ServiceNow, complete the Google Cloud configuration steps in the following section. To complete some tasks in this guide, such as the user creation steps, you must be a ServiceNow system administrator.

Google Cloud configuration

Before you can connect to ServiceNow, you need to create an Identity and Access Management (IAM) service account and grant the account the organization-level and project-level IAM roles required by the Google SCC SIR app or Google SCC ITSM app.

For more information about these roles, see Create a service account and grant IAM roles.

Create a service account and grant IAM roles

The following steps use the Google Cloud console. For other methods, see the links at the end of this section.

Complete these steps for each Google Cloud organization that you want to import Security Command Center data from.

1. In the same project in which you create your Pub/Sub topics, use the Service Accounts page in the Google Cloud console to create a service account. For instructions, see Creating and managing service accounts.

2. Grant the service account the following role:

   • Pub/Sub Editor (roles/pubsub.editor)

3. Copy the name of the service account that you just created.

4. Use the project selector in the Google Cloud console to switch to the organization level.

5. Open the IAM page for the organization:

   Go to IAM

6. On the IAM page, click Grant access. The grant access panel opens.

7. In the Grant access panel, complete the following steps:

   1. In the Add principals section in the New principals field, paste the name of the service account.

   2. In the Assign roles section, use the Role field to grant the following IAM roles to the service account:

   3. Security Center Admin Editor (roles/securitycenter.adminEditor)
   4. Security Center Notification Configurations Editor (roles/securitycenter.notificationConfigEditor)
   5. Organization Viewer (roles/resourcemanager.organizationViewer)
   6. Cloud Asset Viewer (roles/cloudasset.viewer)

   7. Click Save. The service account appears on the Permissions tab of the IAM page under View by principals.

      By inheritance, the service account also becomes a principal in all child projects of the organization. The roles that are applicable at the project level are listed as inherited roles.

For more information about creating service accounts and granting roles, see the following topics:

• Creating and managing service accounts
• Granting, changing, and revoking access to resources

Provide the credentials to ServiceNow

To provide IAM credentials to ServiceNow, create a service account key. You need the service account key in JSON format to complete this guide.

If you use multiple Google Cloud organizations, add this service account to the other organizations and grant it the necessary IAM roles, as described in steps 5 through 7 of Create a service account and grant IAM roles in the preceding section.

Note: Service account keys are a security risk if not managed correctly. You are responsible for the security of the private key and for other operations described by Best practices for managing service account keys. If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see Managing secure-by-default organization resources.

If you acquired the service account key from an external source, you must validate it before use. For more information, see Security requirements for externally sourced credentials.

Configure notifications

Complete these steps for each Google Cloud organization that you want to import Security Command Center data from.

1. Set up finding notifications as follows:

   1. Enable the Security Command Center API.
   2. Create a filter to export findings and assets.

2. Enable the Cloud Asset API for your project.

3. Create feeds for your assets. Create two feeds in the same Pub/Sub topic: one for your resources and one for your IAM policies.

   • Use a different Pub/Sub topic for assets than the one you use for findings.

   • For the feed for your resources, use the following filter:

     content-type=resource

   • For the IAM policies feed, use the following filter:

     content-type=iam-policy --asset-types="cloudresourcemanager.googleapis.com/Project"

4. Create a destination sink for the audit logs. This integration uses a Pub/Sub topic as the destination.

To configure ServiceNow, you need your organization IDs and Pub/Sub subscription names.

Set up ServiceNow

This section explains how to install the app, create users, configure connectivity, and set up ServiceNow to retrieve Security Command Center data.

Install the ServiceNow app

You must be a ServiceNow system administrator to complete this task.

1. Go to the ServiceNow store and search for one of the following apps:

   • If you are running ServiceNow ITSM, search Google SCC ITSM.

   • If you are running ServiceNow SIR, search Google SCC SIR.

2. Click the app and click Get.

3. Enter your ServiceNow ID credentials and proceed through the authentication process.

4. In the ServiceNow console All tab, search for System Applications and click All Available Applications > All.

5. Select Not installed. The console displays a list of applications.

6. Select the Google SCC ITSM or Google SCC SIR app and click Install.

Create users for the app

Create two users for the Google SCC ITSM or Google SCC SIR app and assign them the appropriate roles.

You must be a ServiceNow system administrator to complete this task.

Create the user accounts

1. In the ServiceNow console, search for Organization.

2. Click Organization > Users.

3. Click New.

4. Enter the information for the administrator account for the Google SCC ITSM app or Google SCC SIR app. For example, in the User ID field, enter google_scc_itsm_admin for Google SCC ITSM or google_scc_sir_admin for Google SCC SIR.

5. Click Submit.

6. To create a user account for the Google SCC ITSM app or Google SCC SIR app, repeat steps 3 to 5. For example, in the User ID field, enter google_scc_itsm_user for Google SCC ITSM or google_scc_sir_user for Google SCC SIR.

Assign roles to the accounts

1. In the Users list, click the name of one of the new accounts.

2. Under Roles, click Edit.

3. Add the roles that apply to the account:

   Username	Roles
   Google SCC ITSM admin (google_scc_itsm_admin)	x_goog_scc_itsm.Google_SCC_ITSM_Admin itil itil_admin personalize_dictionary oauth_admin
   Google SCC ITSM User (google_scc_itsm_user)	x_goog_scc_itsm.Google_SCC_ITSM_User itil
   Google SCC SIR admin (google_scc_sir_admin)	x_goog_scc_sir.Google_SCC_SIR_Admin sn_si.admin oauth_admin
   Google SCC SIR user (google_scc_sir_user)	x_goog_scc_sir.Google_SCC_SIR_User sn_si.analyst

4. Click Save.

5. To assign roles to the other account, repeat steps 1 through 4.

6. Sign out and sign in with the new accounts to verify the passwords.

Configure authentication with Security Command Center

Set up connectivity between Security Command Center and ServiceNow. If you support multiple organizations, complete these steps for each organization.

You must be a ServiceNow system administrator to complete this task.

Prepare the Java KeyStore certificate

1. Create a Java KeyStore certificate from the JSON file that contains your service account key. For instructions, see the ServiceNow guide to Create a Java KeyStore certificate (Xanadu).

2. In the ServiceNow console All tab, search for Google SCC ITSM or Google SCC SIR and click Guided Setup.

3. Click Get Started.

4. In Authentication Configuration, click Get Started.

Create the X.509 certificate

1. On the tasks page, in Create X.509 Certificate, click Configure.

2. Enter the following information:

   • Name: a unique name for this certificate

   • Format: PEM

   • Type: Java Key Store

3. Click the Manage Attachments icon and add the Java KeyStore certificate (.jks format) that you generated in Prepare the Java KeyStore certificate.

4. Click the Close icon.

5. Click Submit.

6. On the tasks page, in Create X.509 Certificate, click Mark as Complete.

Create the JWT key

1. On the tasks page, in Create JWT Key, click Configure.

2. Enter the following information:

   • Name: a unique name for this key

   • Signing Keystore: the certificate name specified in Create the X.509 certificate

   • Signing Algorithm: RSA 256

   • Signing Key: the password for the .jks file created in Prepare the Java KeyStore certificate

3. Click Submit.

4. On the tasks page, in Create JWT Key, click Mark as Complete.

Create the JWT provider

1. On the tasks page, in Create JWT Provider, click Configure.

2. Enter the following information:

   • Name: a unique name for this provider

   • Expiry Interval (sec): 60

   • Signing Configuration: the JWT key name specified in Create the JWT key

3. Click Submit.

4. On the tasks page, in Create JWT Provider, click Mark as Complete.

Create the authentication configuration

1. On the tasks page, in Create Authentication Configuration, click Configure.

2. Enter the following information:

   • Name: a unique name for this configuration

   • Organization ID: the ID for your organization in Google Cloud

   • Base URL: the URL for the Security Command Center API, typically https://securitycenter.googleapis.com

   • Client Email: the email address for the IAM credentials

   • JWT Provider: the JWT provider name specified in Create the JWT provider

3. Click Submit. An Authentication Successful message appears.

4. Close the Create Authentication Configuration window.

5. On the tasks page, in Create Authentication Configuration, click Mark as Complete.

Configure incident management for Security Command Center

Complete these steps to enable data collection from Security Command Center. To support multiple organizations, complete this section for each organization.

You must be a ServiceNow system administrator to complete this task.

Configure CI lookup rules

1. In the ServiceNow console All tab, search for Google SCC ITSM or Google SCC SIR and click Guided Setup.

2. Click Get Started.

3. In Incident Configuration, click Get Started.

4. To identify configuration items (such as assets) to add to incidents created from Security Command Center findings, use CI Lookup Rules. Complete the following:

   1. On the tasks page, in CI Lookup Rule, click Configure.

   2. Click New.

   3. Enter the following information:

      • Name: a unique name for this lookup rule

      • Lookup method: either Field Matching or Script

      • Order: the order that the app evaluates this rule in, relative to other rules

      • Source Field: the field in the findings data that serves as input for this rule

      • Search On Table: if matching on a field, the table to find the field

      • Search On Field: if matching on a field, the field to match with the Source Field

      • Script: if using a script, enter the script

      • Active: select to enable this lookup rule

   4. Click Submit.

   5. Repeat this step for additional configuration items, as required.

   6. On the tasks page, in CI Lookup Rule, click Mark as Complete.

Create the ingestion configuration

1. On the tasks page, in Ingestion Configuration, click Configure.

2. Click New.

3. Enter the following information:

   Field	Description
   Name	A unique name for this record
   Google SCC Configuration	The authentication configuration that you created in Configure authentication with Security Command Center. You require one ingestion configuration for each authentication that you configured.
   Recurring Data Collection	Select to allow regular data ingestion from Security Command Center
   Interval(second)	The time interval between data updates from Security Command Center
   One Time Data Collection	Select to allow data ingestion from Security Command Center. One-time data collection doesn't support audit logs.
   Collection Start Time	The date to start data ingestion from Security Command Center

   Don't select Active until you have completed the remaining steps in this section.

4. To add findings, complete these steps:

   1. In the Findings tab, select Enabled. When you enable findings, you also enable assets and sources automatically.

   2. Enter the following information:

   Field	Description
   Findings Subscription Id	For recurring data collections, the name of the Pub/Sub subscription for findings
   Google SCC Finding Name	The name of the incident field to populate with the finding name (for example, Description)
   Google SCC Finding State	The name of the incident field to populate with the finding state (for example, Description)
   Google SCC Finding Indicator	The name of the incident field to populate with the finding indicator (for example, Description)
   Google SCC Finding Resource Name	The name of the incident field to populate with the resource name for the finding (for example, Description)
   Google SCC Finding External URI	The name of the incident field to populate with the URL pointing to an external web page with more information about the finding, if available.
   Apply Filters	Available for one-time data collection, select to specify which projects, state, severity, or categories to include
   Project Name	The name of the project to retrieve findings from when Apply Filters is selected
   State	Whether the findings are active or inactive, when Apply Filters is selected
   Severity	The severity of the findings, when Apply Filters is selected
   Category	The category that you want to retrieve findings from, when Apply Filters is selected

5. To add assets, complete these steps:

   1. In the Assets tab, select Enabled.

   2. In the Asset Subscription Id field, for recurring data collections, enter the name of the Pub/Sub subscription for assets.

6. To add security sources, in the Sources tab, select Enabled.

7. To add audit logs, complete these steps:

   1. In the Audit Logs tab, select Enabled.

   2. In the Audit Logs Subscription Id field, for recurring data collections, enter the name of the Pub/Sub subscription for audit logs.

8. Click Submit.

9. If you get the message that the configuration is inactive, click OK. You activate the configuration in Activate the ingestion configuration.

10. On the tasks page, in Ingestion Configuration, click Mark as Complete.

Define incident creation criteria

To create incidents from findings, complete these steps:

1. On the tasks page, in Incident Creation Criteria (for Google SCC for ITSM) or Security Incident Creation Criteria (for Google SCC for SIR), click Configure.

2. Click the name of the incident configuration that you created.

3. In the Ingestion Configuration page, click the Incident Creation Criteria List (for Google SCC for ITSM) or Security Incident Creation Criteria (for Google SCC for SIR) tab.

4. Click New.

5. Enter the following information:

   • Condition: the dynamic condition under which an incident is created, based on field. For example, you can create incidents for findings with the Severity field set to High.

   • Order: the order for this condition, relative to other conditions.

6. Click Submit.

7. Repeat steps 4 through 6 for each condition that triggers incident creation.

8. Close the Ingestion Configuration page.

9. On the tasks page, in Incident Creation Criteria (for Google SCC for ITSM) or Security Incident Creation Criteria (for Google SCC for SIR), click Mark as complete.

Define assignment group criteria

To assign incidents to a group, complete these steps:

1. On the tasks page, in Assignment Group Criteria, click Configure.

2. Click the name of the incident configuration that you created.

3. In the Ingestion Configuration page, click the Assignment Group Criteria List tab.

4. Click New.

5. Enter the following information:

   • Assignment Group: the group that the incidents will be assigned to.

   • Condition: the dynamic condition that triggers incident assignment, based on a specified field. For example, you can assign incidents for findings with the Finding Class field set to Misconfiguration.

   • Order: the order for this condition, relative to other conditions.

6. Click Submit.

7. Repeat steps 4 through 6 for each group to assign incidents to.

8. Close the Ingestion Configuration page.

9. On the tasks page, in Assignment Group Criteria, click Mark as complete.

Activate the ingestion configuration

1. On the tasks page, in Activate Ingestion Configuration, click Configure.

2. Click the name of the incident configuration that you created.

3. Select Active.

4. To start collecting data, click Collect Data.

5. Click Update.

6. On the tasks page, in Activate Ingestion Configuration, click Mark as Complete.

Verify data retrieval

To verify that ServiceNow retrieves data from Security Command Center, complete these steps.

You must be a ServiceNow system administrator to complete this task.

1. In the ServiceNow console, click the All tab.

2. Search for Google SCC ITSM or Google SCC SIR and click Ingestion Configuration.

3. Check the state to verify that the app collects data.

4. Search for Google SCC ITSM or Google SCC SIR and click one of Assets, Findings, Sources, or Audit Logs. Verify that the app adds records for each enabled data type. If you configured automatic incident creation in the Findings configuration, verify that ServiceNow creates incidents related to each finding that matches your specified criteria.

View the dashboards

The Google SCC ITSM app lets you visualize the data from Security Command Center. It includes five dashboards: Overview, Sources, Findings, Assets, and Audit Logs.

You can access these dashboards in the ServiceNow console, from the All > Google SCC ITSM > Dashboards or the All > Google SCC SIR > Dashboards page.

Overview dashboard

The Overview dashboard contains a series of charts that displays the total number of findings in your organization by severity level, category, and state. Security Command Center compiles findings from built-in services, such as Security Health Analytics, Web Security Scanner, Event Threat Detection, and Container Threat Detection and any integrated services you enable.

To filter content, you can set the time range and organization ID.

Additional charts show which categories, projects, and assets are generating the most findings.

Note: You must be a Security Command Center Premium customer to receive findings from certain Security Command Center services, such as Event Threat Detection and Container Threat Detection.

Assets dashboard

The Assets dashboard displays a chart of Google Cloud assets, categorized by asset type.

You can filter asset data by organization ID.

Audit logs dashboard

The Audit logs dashboard displays a series of charts and tables that show audit log information. The dashboard includes administration activity, data access, system events, and policy-denied audit logs. The table includes the time, log name, severity, service name, resource name, and resource type.

You can filter the data by time range and organization ID.

Findings dashboard

The Findings dashboard includes a table of the 1,000 most recent findings. The table columns include items such as category, asset name, source name, security marks, finding class, and severity.

You can filter the data by time range, organization ID, severity, state, or finding class. If you set up automatic incident creation, the dashboard includes a link to the incident.

Sources dashboard

The Sources dashboard shows a table of all your security sources. Table columns include name, display name, and description.

To filter content, you can set the organization ID.

Create an incident manually

1. Sign in to the ServiceNow console as the Google SCC ITSM or Google SCC SIR administrator.

2. In the All tab, search for Google SCC ITSM or Google SCC SIR and click Findings.

3. Click the finding that you want to create an incident for.

4. In the findings page, for Google SCC ITSM, click Create Incident and for Google SCC SIR, click Create Security Incident.

Change a finding state

You can change a finding state from active to inactive or from inactive to active.

1. In the ServiceNow console, on the All tab, search for Google SCC ITSM or Google SCC SIR and click Findings.

2. Click the finding that you want to change the state for.

3. In the findings page, click Active Finding or Inactive Finding.

4. Click OK.

Uninstall the apps

You must be a ServiceNow system administrator to complete this task.

1. In the ServiceNow console All tab, search for System Applications and click All Available Applications > All.

2. Select Installed.

3. Select Google SCC ITSM or Google SCC SIR and click Uninstall.

View application logs

To view the logs for the app, complete the following:

1. Sign in to the ServiceNow console as the Google SCC ITSM or Google SCC SIR administrator.

2. In the All tab, search for Google SCC ITSM or Google SCC SIR and click Administration > Application Logs.

Troubleshooting

This section covers how to resolve common issues that you might encounter when configuring or using the ServiceNow integration.

Application cannot reconnect after three attempts

If the findings API call returns an HTTP 429 or 5xx status code, the application retries three times, waiting 60 seconds between attempts. If the third retry fails, the process fails. To change the response time, complete the following steps:

1. Sign in to the ServiceNow console as the Google SCC ITSM or Google SCC SIR administrator. For more information about these accounts, see Create users for the app.

2. In the All tab, search for Google SCC ITSM or Google SCC SIR and click System Properties.

3. Set the Number of max retries for an invalid response from Google SCC (in numbers) field to a number that is greater than 3.

4. Click Save.

Cannot install the app from the ServiceNow Store

1. Verify that you are logged in as the ServiceNow system administrator.

2. In the All tab, search for System Applications and click All Available Applications > All.

3. Check whether the app appears in the Installed tab.

Cannot create a new user

If you use the Rome release version, see Create a user for instructions.

Cannot fetch data

This issue can occur when fetching findings, assets, sources, or audit logs if the "Starting data ingestion for profile: PROFILE_NAME" message appears.

1. Sign in to the ServiceNow console as the Google SCC ITSM or Google SCC SIR administrator.

2. In the All tab, search for Google SCC ITSM or Google SCC SIR and click Administration > System Properties.

3. Verify that the following fields aren't empty:

   • Number of max retries for an invalid response from Google SCC (in numbers)

   • Time window to wait before making another request after reaching request limit (in milliseconds)

4. If the fields are empty, set the values as follows:

   • Set Number of max retries for an invalid response from Google SCC (in numbers) field to 3.

   • Set Time window to wait before making another request after reaching request limit (in milliseconds) to 60000.

5. Click Save.

Cannot add more than 250 worknotes or activities to an incident

1. Sign in to the ServiceNow console as a system administrator.

2. In the navigation bar, search for sys_properties.list.

3. In the System Properties window, create a filter Name is glide.history.max_entries.

4. Click Run.

5. In the property window, set Value to a number that is greater than 250.

6. Click Update.

Attachment isn't supported

1. Sign in to the ServiceNow console as a system administrator.

2. In the All tab, search for System Applications and click Security.

3. In the Security System Properties page, verify that the List of file extensions (comma-separated) that can be attached to documents via the attachment dialog field includes the extension that you want to attach without a leading dot—for example, xlsx,docx. If the field is blank, all extensions are allowed.

Maximum execution time exceeded

You receive this message when you attempt to access the dashboards.

For a resolution, see the ServiceNow support article, "Widget cancelled - Maximum execution time exceeded" message appearing on homepage (requires ServiceNow authentication).

What's next

• Learn more about setting up finding notifications in Security Command Center.

• Read about filtering finding notifications in Security Command Center.