ServiceNow TISC Integration

The Censys for ServiceNow Threat Intelligence Security Center (TISC) integration adds the ability to:

• Automatically or manually enrich IPs, web properties, and certificate observables in ServiceNow TISC with Censys Platform data.

• Initiate a Censys rescan of a host or web property.

• Retrieve scan history for an IP address.

• Initiate a CensEye automated pivoting job to find assets related to an IP, web property, or certificate.

Additionally, it adds a dashboard that shows all Censys actions executed using the app.

This guide walks through how to set up and use the Censys for ServiceNow TISC.

Prerequisites

• A ServiceNow cloud-deployed instance on version Yokohama, Zurich, or Australia.

  • The ServiceNow instance must have the Threat Intelligence Security Center for Security Operations plugin installed.

• A ServiceNow admin user with access to your instance.

• Your Censys Platform organization ID.

  • To obtain your organization ID:

    1. Open the Platform web console and ensure that your organization account is selected. Go to Settings > Account Management > Personal Access Tokens.

    2. The ID for your organization is shown in the "Current Organization" box. Click Copy to copy it to your clipboard.

       

• A Censys Platform Personal Access Token (PAT). Instructions on how to create and manage PATs are available in the API documentation.

User roles

The following ServiceNow roles can be used for this integration.

• sn_sec_tisc.admin (application admin is added in this role)
• sn_sec_tisc.analyst
• sn_sec_cmn.admin

Censys recommends that you assign these roles to ServiceNow users based on your needs or create new users with the roles. An example role configuration for two new Censys-specific users is provided below.

Installation and configuration

To install and configure the integration, you need to add the integration from the ServiceNow console and set up Censys enrichment in TISC. To set up automatic enrichment, you need to configure it in the ServiceNow Flow Designer after app installation.

1. Install the Censys integration

1. Go to the ServiceNow Store page for the Censys for ServiceNow TISC integration. Click Get.
2. Log in to the instance that you want to install the integration on.
3. In ServiceNow, navigate to System Applications > All Available Applications > All.
4. Click the Not Installed tab.
5. Locate the Censys TISC integration, select it, and click Install.

2. Configure TISC observable Censys enrichment

1. In the ServiceNow console, go to Threat Intelligence Security Center.

2. In the left sidebar, select Integrations.

   

3. Go to Enrichment Integrations > Observable Enrichment.

4. Click Configure New Enrichment.

5. Select "Censys TISC Integration" and click Select.

   

6. On the "Configure new Censys integration" page:

   1. In the "Name" field, enter a name like "CensysEnrichment".

   2. In the "API Key" field, enter your PAT.

   3. In the "Organization ID" field, enter your Platform organization ID.

      

7. Click Save.

8. Click Enable.

Censys for ServiceNow TISC actions

The Censys for ServiceNow TISC integration adds the following actions.

Automatic enrichment

1. In ServiceNow, go to Process Automation > Flow Designer.

2. Select the Flows tab. Search for and select "Censys - Auto Enrichment Configuration Template."

3. Open the three-dot menu and click Copy flow.

   

4. In the "New flow name" field, enter a descriptive name for the flow.

5. In the "Application" field, select your Censys TISC integration.

6. In the "Trigger" section on your new flow, configure your desired frequency for automatic enrichment and click Done.

7. Under "Actions," select the first step labeled Censys - Lookup Multiple Records. You need to set up different copies of this flow for each observable type you want to enrich. Remove the types for your specific flow configuration, then click Done.

   

   1. (Optional) To configure automatic web property enrichment:

      1. Select the second step labeled Set Flow Variables.

      2. Next to Data, click the plus sign.

      3. In the Name dropdown, select port.

      4. In the "Data" field, enter the port numbers you want to target for web property enrichment.

         

      5. Click Done.

8. Select the third step labeled Lookup Capability Implementation Record. Remove the display name condition value and add the exact name of the integration in the value, like Censys Host Enrichment - CensysIntegration.

   • For host enrichment add Censys Host Enrichment - <Integration_configuration_name>.
   • For certificate enrichment add Censys Certificate Enrichment - <Integration_configuration_name>.
   • For web property enrichment add Censys Web Property Enrichment - <Integration_configuration_name>.

9. Click Done.

10. In the top right corner, click Activate.

Manual enrichment

To manually enrich an observable that is present in ServiceNow TISC:

1. Navigate to the observable IP address, domain name, or SHA-256 hash in the Threat Intelligence Security Center's Threat Intel Library.

2. On the top right corner of the page, click Run Observable Enrichment.

   

3. Select the appropriate type of Censys enrichment and click Submit.

View enriched data on observables

To see the Censys enrichment on an observable:

1. Navigate to the observable in the Threat Intelligence Security Center's Threat Intel Library.
2. Click the Enrichment Results tab and select the entry for Censys enrichment of that observable.
3. Click View HTML Raw Response.

A summary of important data about the observable is provided at the top of the window. Scroll down to the "Complete Raw JSON" or "Complete Data Table View" sections to see more information.

Run Censys Rescan on a host service or web property observable

To execute a rescan on a host service or web property observable:

1. Navigate to the observable in the Threat Intelligence Security Center's Threat Intel Library.

2. On the top right corner, click the three dot menu and select Censys Rescan.

   

3. Input the required parameters and click Submit.

After the rescan executes successfully, the resulting data will be available on the Enrichment Results tab.

Retrieve Censys host history for an observable

To retrieve the history for a host:

1. Navigate to the observable in the Threat Intelligence Security Center's Threat Intel Library.
2. On the top right corner, click the three dot menu and select Censys Host History.
3. Input the required parameters and click Submit.

After the data is retrieved, it will be available on the Enrichment Results tab.

Ad-hoc IOC lookup

To retrieve the Censys data for an observable that is not present in TISC:

1. In ServiceNow, go to Flow Designer > Subflows.
2. Search for and select "Censys - AdHoc IOC."
3. Click Test.
4. On the "Test subflow" window:
   1. In the "IOC Value" field, enter an IP address, hostname, or SHA-256 hash for a certificate.
   2. In the "Port" field, enter the port number. Note that this is only used for web property enrichment.
   3. In the "Integration Configuration" menu, select your integration.
   4. In the "Enrichment Type" dropdown, select the type of asset you are enriching.
   5. Click Run Test.

If the observable does not already exist in your Threat Intel Library, then it will be added and enriched with Censys data. If the observable already exists in your library, then this action will enrich the observable.

Related infrastructure

Use the related infrastructure action to discover and map internet-facing assets that share parsed Censys data key-value pairs. This action leverages the CensEye automated pivoting tool.

Each row of the output table is a Censys data key-value pair or group of key-value pairs, the count of assets in the Censys Internet Map that share that pair or group, and a link to see all assets that feature the pair in the Censys Platform.

Use the Censys TISC dashboard

To use the dashboard, in ServiceNow, go to Censys TISC Integration > Dashboard.

The dashboard contains an overview of automatic and manual enrichment actions executed using the app.