A post was made and I was working through some security stuff of my one. I felt inspired to make a post about it. Below is a list of logs we need to review regularly for ServiceNow
Can anyone provide us with Names, Tables, and Sources for the logs listed?
- Authentication successes and failures
- Authorization (access control) failures
- This would be very verbose and you wouldn’t want this.
- Do you mean code failures? They would show up as errors in the logs… but not explicitly listed for an acl, just an code error.
- Application startups and shutdowns
- So. Application startups depends on what you mean
“applications”. If you mean NODES than thats on
sys_cluster_state
in the payload look forservlet.started
xml node. - If you mean something else I don’t think that’s how this works.
- So. Application startups depends on what you mean
“applications”. If you mean NODES than thats on
- Configuration changes
- this is available on
sys_update_xml
- this is available on
- Changes to code files or memory
- This is the same as configuration changes. Servicenow has no files you can modify like a traditional server, at least not that we can access.
- Application errors and system events e.g. syntax and runtime errors, connectivity problems, performance issues, third party service error messages, file system errors
- Input validation failures e.g. protocol violations, unacceptable
encodings, invalid parameter names and values
- I’d guess this would be in the syslog_list, but I’m not sure exactly the types of things you’re expecting.
- Output validation failures e.g. database record set mismatch,
invalid data encoding
- I’d guess this would be in the syslog_list, but I’m not sure exactly the types of things you’re expecting.
- Session management failures e.g. cookie session identification value modification
- Acceptance of EULA/terms of use
- Not ootb, but if you applied servicenowguru’s then you’d look on the “Terms Acceptance table”. However I can’t find the update set to download.
- Personal data usage notification/consent
- Not sure what you mena by this. Do you mean like HIPAA, PII and the like? If so there’s nothing to say this ssn, or address is added as a comment in the system. You’d have to add that via a customization.
- Attack detection e.g. excessive authentication failures, file upload
virus detection
- See Auth Failures
- There is no virus checking to my knowledge of uploaded files,
however you can control the upload types and sizes from these
properties
- System Properties >
glide.ui.strict_customer_uploaded_content_types
restricts what can be loaded vs downloaded to stop xss - System Properties >
glide.security.file.mime_type.validation
restricts the file’s mime type on upload - System Properties >
glide.ui.strict_customer_uploaded_static_content
restricts the files somehow - System Properties >
glide.attachment.extensions
restricts the files extensions allowed to be uploaded - System Properties >
glide.image_provider.security_enabled
restricts access to uploads to authenticated users - System Properties >
glide.ui.attachment.download_mime_types
restricts downloadable mime types
- System Properties >
- Any other logs that would help identify suspicious, unacceptable, unexpected behavior, or other possibly malicious activities.