ServiceNow Integration with DefectDojo

ServiceNow Integration with DefectDojo

ServiceNow is an enterprise workflow platform used widely for IT service management (ITSM), where operations teams track Incidents, changes, and requests. Its security operations applications, Security Incident Response (SIR) and Vulnerability Response (VR), add security-specific tables such as Security Incidents and Vulnerable Items. Records are created and updated through ServiceNow's REST APIs, which is how DefectDojo Pro pushes Findings into it.

ServiceNow Integration with DefectDojo

Our infrastructure and operations teams take their work from ServiceNow, not from a security tool, so that is where our vulnerability findings need to go. The DefectDojo Pro ServiceNow integration creates an Incident (or, with the SecOps variant, a Security Incident or Vulnerable Item) for each Finding or Finding Group we push, and keeps it updated as the Finding changes. When a Finding is mitigated, marked a false positive, or risk-accepted in DefectDojo, the ServiceNow record moves to the mapped state, so the operations queue reflects what security has already decided.

Why ServiceNow Matters

Remediation usually happens outside the security team, and in many organizations the teams that patch servers and change configurations already work from ServiceNow.

• Putting findings in ServiceNow means they enter existing assignment groups, queues, and SLAs instead of a separate list.
• SIR and VR give security operations their own tables with security-specific fields and states.
• ServiceNow records carry the audit trail many change and compliance processes require.
• Without an integration, someone copies findings into tickets by hand and closes them by hand, and the two systems drift apart.

Advantages of This Integration

What we gained by pushing DefectDojo findings to ServiceNow:

• Automatic ticket creation. An Issue Tracker Assignment on an Asset or Engagement can create a record for every new Finding, update existing records on edit, or both.
• Push filters. Automatic creation can be limited to a minimum severity and to active Findings only, so Info findings and already-closed ones don't generate tickets.
• Status sync. Severity maps to ServiceNow Impact, and DefectDojo status maps to the record's State, so closures, false positives, and risk acceptances reach ServiceNow without manual edits.
• Data Policy friendly. Custom Field Mappings can attach required fields such as close_code and close_notes to state transitions, which avoids rejected writes on instances that enforce them.
• Idempotent SecOps syncs. The SecOps integration tags each record with the DefectDojo identifier in correlation_id and adopts a matching record instead of creating a duplicate.
• Visible failures. Each Issue Tracker Mapping lists push errors with the time, reason, and affected Finding.

How This Integration Works

ServiceNow is a DefectDojo Pro Downstream Connector. Downstream Connectors are on for every DefectDojo Pro instance, Cloud and On-Premise. The DefectDojo docs list Jira as the issue-tracking integration available in Community Edition.

There are two ServiceNow variants:

• ServiceNow pushes Findings as ServiceNow Incidents.
• ServiceNow SecOps / Vulnerability Response pushes Findings and Finding Groups to a Security Incident (sn_si_incident, the default) or a Vulnerable Item (sn_vul_vulnerable_item).

1. Create credentials in ServiceNow. For the ServiceNow Incident integration, DefectDojo uses OAuth 2.0. On Zurich and later releases, open Application Registry, choose New Inbound Integration Experience, then OAuth - Client credentials grant, and set the OAuth Application User to the service account that will create Incidents. ServiceNow generates the Client ID and Client Secret. On earlier releases, create an OAuth API endpoint for external clients and obtain a refresh token for the service account through ServiceNow's OAuth token endpoint, as described in the DefectDojo docs. SecOps accepts OAuth, an API key (sent as x-sn-apikey), or HTTP Basic credentials.

2. Create the Integration Instance. Under Connect > Downstream, add ServiceNow (or ServiceNow SecOps) and enter an Instance Label, your instance URL as Location (for example https://your-organization.service-now.com/), and the credentials.

3. Create an Issue Tracker Mapping. Review the severity and status mappings and adjust them to your instance. For SecOps, pick the Target Table. Add Custom Field Mappings for anything your instance requires.

4. Assign Assets or Engagements. An Issue Tracker Assignment links an Asset or Engagement to the Mapping and sets the push behavior: explicit only, link new Findings automatically, update existing links on edit, or both. To give different Assets different assignment groups, create a Mapping per Asset.

5. Push. Findings in an assigned Asset or Engagement show a Push to Integrator action for manual pushes, and automatic pushes follow the Assignment. Linked tickets appear in the Integrator Tickets column with the ticket ID, a direct link, and a changelog.

Data Granularity: What Gets Sent

In the Incident integration, reference fields such as assignment_group and assigned_to set through Custom Field Mappings expect a sys_id, not a display name.

Use Cases

Server patching through ITSM: Infrastructure scanner findings for an Asset are pushed automatically as Incidents to the Windows and Linux operations groups, with updates on edit enabled. When the next scan shows a vulnerability gone, DefectDojo mitigates the Finding and the Incident moves to Closed.

Vulnerability Response programs: Organizations running ServiceNow VR use the SecOps variant to write Vulnerable Items, while DefectDojo remains where findings from many scanners are deduplicated before anything reaches ServiceNow.

Security incidents from pentests: High-severity pentest findings are pushed manually as Security Incidents so the SIR team tracks them with their own workflow, and updates from DefectDojo land in work notes.

Instances with strict Data Policies: A ServiceNow team requires a Resolution code on every closed Incident. A static close_code mapping on the Closed transition satisfies the policy, and closures from DefectDojo go through.

Operational Tips

• Check your instance's state values before going live. Customized states, or tables other than incident, need numeric state values from the instance's choice list.
• Set a minimum severity and active-only filter on automatic Assignments so ServiceNow receives work, not noise. Updates to already-linked tickets are always sent, so closures still propagate.
• If an Incident fails to close with an HTTP 403 Data Policy Exception, add the required close fields as transition-specific Custom Field Mappings.
• Note the expiry of OAuth secrets and refresh tokens. Earlier ServiceNow releases default to a refresh token lifespan of about 100 days.
• Push Finding Groups rather than individual Findings when one fix (one patch, one package upgrade) resolves many Findings, so operations teams get one ticket per fix.
• Deleting a Finding in DefectDojo resolves the SecOps record rather than deleting it, so records are never lost from ServiceNow's audit trail.