Analyst1 for Security Incident Response connects ServiceNow with the Analyst1 threat intelligence platform. When a Security Incident contains an observable of a supported type, the integration queries Analyst1 and, if there is a match, maps the Analyst1 Risk Score to a ServiceNow Threat Finding (Malicious, Suspicious, Clean, or Unknown) along with additional context, and links back to the matching indicator in Analyst1.
The following observable types are supported:
- IP address (V4)
- IP address (V6)
- Domain name
- URL
- Email address
- SHA256 hash
- SHA1 hash
- MD5 hash
Results appear as standard lookup records directly on the Security Incident, so analysts get the enrichment from Analyst1 without leaving ServiceNow.
- Automatic threat lookups for Security Incident observables - IP addresses (V4/V6), URLs, domains, email addresses, and file hashes (MD5/SHA1/SHA256) - using Analyst1 threat intelligence
- Native SecOps Integration Framework Threat Lookup capability, configured in minutes from the Security Operations Integration Dashboard
- Findings (Malicious, Suspicious, Clean, Unknown) derived from Analyst1 risk scores and benign-entity intelligence, with the full API response preserved on each lookup result
- Admin-configurable finding overrides: 10 pre-defined mapping scenarios let security teams tune how Analyst1 verdicts map to ServiceNow findings without code
- Direct pivot from each lookup result to the matching indicator in the customer's Analyst1 tenant
- Built-in observable type filtering and duplicate-lookup suppression to conserve API usage
Initial release (1.0.0). Registers Analyst1 as a Threat Lookup provider for Security Incident Response via the SecOps Integration Framework. Includes OAuth2 (client credentials) authentication to the customer's Analyst1 tenant, automatic finding classification with configurable overrides, observable type filtering, and duplicate lookup suppression.
- ServiceNow Zurich release
- Security Incident Response (sn_si) version 13.6.5 or later, which provides the Security Integration Framework (sn_sec_cmn, sn_sec_core) and Threat Intelligence (sn_ti) components
- An Analyst1 instance with API access and OAuth2 client credentials (client ID and client secret), available from your Analyst1 Customer Success Manager or Analyst1 support
- Outbound HTTPS connectivity from the ServiceNow instance to the customer's Analyst1 instance base URL (for example, https://analyst1.example.com)
A single configured Analyst1 integration instance per ServiceNow instance is supported. No MID Server is required; all communication is direct outbound HTTPS from the instance.