Configure ServiceNow SIR integration field mapping
The ServiceNow Security Incident Response (SIR) module integration enables bi-directional case management, allowing you to create cases in ServiceNow from Forescout Cloud while also synchronizing comments and statuses in both directions.
ServiceNow payload mapping
When you create an SIR incident, Forescout Cloud automatically sends the following fields and information to ServiceNow.
| Field | Description |
|---|---|
| short_description | Title of the SIR incident provided by the Forescout case. |
| description | Detailed case summary, including detection and risk context. |
| state | Initial state of the SIR incident. |
| impact | Impact value mapped from the Forescout case severity. |
| urgency | Urgency value mapped from the Forescout case severity. |
| comments | Initial work notes or comments synced to ServiceNow. |
Impact and urgency mapping
When determining priority, Forescout calculates impact and urgency, while ServiceNow calculates the priority on their side of the integration for both standard and SIR incidents.
The following table shows how Forescout calculates severity based on impact and urgency for ServiceNow standard incidents.
| Forescout Case Severity | Impact | Urgency |
|---|---|---|
| Critical | HIGH (1) | HIGH (1) |
| High | HIGH (1) | MEDIUM (2) |
| Medium | MEDIUM (2) | MEDIUM (2) |
| Low | LOW (3) | LOW (3) |
The following table shows how Forescout calculates case impact based on SIR impact for SIR incidents.
| Forescout Case Impact | SIR Impact |
|---|---|
| Sev-1 | CRITICAL (1) |
| Sev-2 | HIGH (2) |
| Sev-3 | MEDIUM (3) |
| Sev-4 | LOW (4) |
| Sev-5 | LOW (4) |
| Forescout Case Severity | SIR Urgency |
|---|---|
| Critical | CRITICAL (1) |
| High | HIGH (2) |
| Medium | MEDIUM (3) |
| Low | LOW (4) |
minute read