SOF Day 2 Review

Which of the following frameworks does ServiceNow come with baseline?

There are multiple answers.

• NIST Stateful

• NIST Closed

• SANS

• NIST Open

True or False: ITIL differentiates between a Service Incident and a Security Incident.

• True

• False

What are the three main ways Security Incidents are created in ServiceNow?

• Self-Service (Security Catalog)

• Integration (Email or Web Services)

• Pen and Paper

• Manually by Agents

What are some of the assignment options for Security Incidents? (Choose more than one answer.)

• Automatic

• Workflow-Driven

• Telepathy

• Manual

• Pre-emptive Closure

What is the table name for Security Incident?

• sn_si_security_incident

• security_incident

• sn_si_task

• sn_si_incident

Which two tables does Threat Intelligence use?

• sn_ti_observable

• sn_ti_ioc

• sn_ti_indicator

• sn_ti_threat

What is an observable?

• Something you see

• A stateful property or measureable event pertinent to the operation of computers and networks

• System logs that help agents solve security incidents

ServiceNow has Store plugins for which of the following Security Products?

There are multiple answers.

• VirusTotal

• Qualys

• Your Organization's In-House App

• Rapid7

• ThreatCrowd

What roles need to be considered for reporting/data visualization?

There are multiple answers

• Managers

• Analysts

• The Media

• Accountants

• CISO/C-Level

What was your favorite part of the Day 2 course material? (Security Incident, Threat Intelligence, Integrations, Reporting)