ServiceNow Security Operations Reviews

For my customers, I deploy ServiceNow Security Operations, which is always in a cloud environment as it is a SaaS application. There is a provision for on-prem deployment, but the support is minimal from ServiceNow.

ServiceNow Security Operations provides significant control over vulnerabilities, allowing users to mark false alarms as false positives and ignore them, which is important because many vulnerabilities are not real but appear as such. There are many aspects that we could handle. For certain vulnerabilities, remediation requires spending extra on hardware or OS upgrades, or purchasing new versions, which implies a cost. For that reason, we can take an exception for a couple of months or days, and once that exception expires, that vulnerability automatically reappears.

These features help us ensure that everything is under control, and when we discuss vulnerabilities, we can consolidate them into one central category, which means working on one vulnerability automatically resolves the rest, making it efficient with the features provided.

If we encounter challenges while deploying, we raise incidents. These incidents are categorized by priority: high, medium, and low. We assign an incident number and notify the relevant teams to address the issue. For instance, if we experience a problem with Cloud services or any other issue, we will raise an incident and suggest a course of action. Similarly, they are categorized into expedited, emergency, normal, and planned changes when raising change requests.

Every tool we are using, such as PNC, ServiceNow, Jira, and many others, is fine. 

I use ServiceNow for ticketing purposes. Specifically, I raise tickets between the support team. This is used by internal teams within the company for managing support-related tasks.

ServiceNow is a convenient platform to raise tickets, and the respective support team will contact us to resolve any issues. Although the platform is neither exceptional nor poor, it facilitates communication and organization within the support framework.

ServiceNow Security Operations is used for threat intelligence and managing issues, offences or incidents. 

The SOAR module of ServiceNow Security Operations is the most valuable feature and it can be managed easily. 

Customer awareness and understanding of ServiceNow's SecOps capabilities could be improved, as many clients may not fully utilize the platform's potential due to a lack of awareness or training.

I have been using ServiceNow Security Operations for 12 years. 

We use it on a daily basis. We received tickets in ServiceNow. We can connect with the user using the ServiceNow application. 

We can drop an email, use the top bar, create filters, see how many tickets we have, monitor daily usage, track received tickets, and manage follow-ups. We can also manage dependent tickets and the "Accredited Fine."

The "follow" feature is really good. If the user is not responding, there's an option to "follow". Just click on the button, and it will automatically trigger an email to the end user.

My primary use cases with this solution are focused on automation, particularly integrating security operations with pen-testing tools like Nessus, BurpSuite, and Kali Linux.

The platform has significantly improved my organization by automating process gaps, streamlining tasks such as notifications, and enhancing the workflow. Its SaaS-based cloud solution offers the flexibility to adapt to various organizational needs.

I used this solution for incident management for issues that take longer to resolve.

About 1,000 people were using this solution in my organization, including management and procurement.

I wasn't using the latest version. 

It's very slow. When you click a button or update a field, it takes forever to actually react.

It's not very user-friendly. You almost need a degree in IT management to be able to use it.

I would like it to have a more intuitive UI or at least better documentation.