> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate BloodHound Enterprise with ServiceNow Security Incident Response

> Learn how to install and configure the integration to automate the creation of security incidents based on attack path findings.

export const app_3 = "Security Incident Response Integration with SpecterOps BloodHound"

export const app_2 = "Security Incident Response Integration with SpecterOps BloodHound"

export const app_1 = "Security Incident Response Integration with SpecterOps BloodHound"

export const setup_0 = "Guided Setup"

export const app_0 = "Security Incident Response Integration with SpecterOps BloodHound"

export const role_0 = "x_spop_security_in.app_admin"

<img noZoom src="https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max&auto=format&n=tTIczgde9H07oLXf&q=85&s=b682a26b342bde12302ec829e265bdb6" alt="Applies to BloodHound Enterprise only" width="225" height="45" data-path="assets/enterprise-edition-pill-tag.svg" />

The [Security Incident Response (SIR)](https://store.servicenow.com/store/app/5400757f1b45a610a85b16db234bcb85) integration for BloodHound Enterprise supports the following use cases:

* Create SIR ticketing workflows for BloodHound Enterprise attack path findings
* Integrate BloodHound Enterprise attack path findings into existing ticketing workflows
* Monitor identity vulnerabilities over time

## Prerequisites

Before you begin the installation and configuration process, ensure the following prerequisites are met:

* Admin access to a ServiceNow instance with the [Security Incident Response (SIR) module](https://www.servicenow.com/docs/r/security-management/security-incident-response/install-and-configure-sir.html) installed and configured
* Access to the ServiceNow Store to install the BloodHound Enterprise app
* Admin access to a BloodHound Enterprise tenant
* A BloodHound Enterprise [non-personal API key/ID pair](/integrations/bloodhound-api/working-with-api#create-a-non-personal-api-key%2Fid-pair) with the **Auditor** role

## Install the application

Installing the BloodHound Enterprise app on ServiceNow involves the following steps:

<Steps>
  <Step title="Log in to ServiceNow">
    1. Log in to your ServiceNow instance as an admin.
    2. Click **System Applications** > **All Available Applications** > **All**.
  </Step>

  <Step title="Search the ServiceNow Store">
    1. In the search bar, enter *SpecterOps BloodHound* to find the app.
    2. Select the app from the search results.
  </Step>

  <Step title="Install the app">
    1. Click **Install** to install the app on your ServiceNow instance.
    2. Follow the prompts to complete the installation.
  </Step>
</Steps>

## Create an application user

The integration requires creating a user and assigning the **{role_0}** role.

<Steps>
  <Step title="Create a new user">
    The integration runs on behalf of the user account that you create in this step. It should be a dedicated service account associated with the non-personal API key/ID pair you created in BloodHound Enterprise.

    1. Click **All** > **User Administration** > **Users**.

    2. Click **New**.

    3. Enter required user details.

    4. Click **Submit**.
  </Step>

  <Step title="Assign the required role">
    The user must have the **{role_0}** role to perform necessary actions, such as creating and updating ServiceNow tickets.

    1. In the **Roles** related list, click **Edit**.

    2. In the **Collection** list, select the **{role_0}** role and click **Add**.

    3. Click **Save**.

           <Frame>
             {role_0 === 'x_spop_security_in.app_admin' && (
                 <img src="/images/integrations/service-now/sir/image30.png" alt="A view of the ServiceNow user interface showing the process of assigning the x_spop_security_in.app_admin role to a new service account user." />
               )}

             {role_0 !== 'x_spop_security_in.app_admin' && (
                 <img src="/images/integrations/service-now/vr/image2.png" alt="A view of the ServiceNow user interface showing the process of assigning the x_spop_specterops.app_admin role to a new service account user." />
               )}
           </Frame>
  </Step>
</Steps>

## Configure the application

The integration provides a guided setup experience to connect to BloodHound Enterprise, filter attack path types, configure field mapping, and set the import schedule. Follow the steps below to complete the configuration.

<Steps>
  <Step>
    ### Change application scope

    Before starting the configuration, change the application scope to *{app_0}* to ensure that you have access to all necessary components and configurations.

    1. Click the <Icon icon="globe" /> (globe) icon in the top-right corner and select **Application Scope**.

    2. In the search filter, enter *{app_0}* and select it.

           <Frame>
             {app_0 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                 <img src="/images/integrations/service-now/sir/image23.png" alt="A view of the ServiceNow user interface showing the process of changing the application scope to the SpecterOps BloodHound integration app." />
               )}

             {app_0 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                 <img src="/images/integrations/service-now/vr/image3.jpeg" alt="A view of the ServiceNow user interface showing the process of changing the application scope to the SpecterOps BloodHound integration app." />
               )}
           </Frame>
  </Step>

  <Step>
    ### Connect to BloodHound Enterprise

    The first step in the guided setup is to connect to your BloodHound Enterprise tenant by providing the tenant URL and API credentials.

    1. In the top-left corner of ServiceNow, click **All**.

    2. In the search box, enter *{app_1}* and select **{setup_0}**.

           <Frame>
             {app_1 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                      <img
                        src="/images/integrations/service-now/sir/image1.png"
                        alt="A view of the ServiceNow user interface showing the process of navigating to the Guided Setup page for the SpecterOps BloodHound integration app."
                      />
                  )}

             {app_1 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                      <img
                        src="/images/integrations/service-now/vr/image9.jpeg"
                        alt="A view of the ServiceNow user interface showing the process of navigating to the Guided Setup page for the SpecterOps BloodHound integration app."
                      />
                  )}
           </Frame>

    3. Click **Get Started** in the *Connect to SpecterOps BloodHound* section to start the configuration process.

           <Frame>
             {app_1 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image33.png"
                                         alt="A view of the ServiceNow user interface showing the guided setup for connecting to a BloodHound Enterprise tenant."
                                     />
                             )}

             {app_1 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image10.jpeg"
                                         alt="A view of the ServiceNow user interface showing the guided setup for connecting to a BloodHound Enterprise tenant."
                                     />
                             )}
           </Frame>

    4. Click **Configure**.

           <Frame>
             {app_1 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image35.png"
                                         alt="A view of the ServiceNow user interface showing the guided setup for connecting to a BloodHound Enterprise tenant."
                                     />
                             )}

             {app_1 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image11.png"
                                         alt="A view of the ServiceNow user interface showing the guided setup for connecting to a BloodHound Enterprise tenant."
                                     />
                             )}
           </Frame>

    5. Click **New** to add credentials.

           <Frame>
             {app_1 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image9.png"
                                         alt="A view of the ServiceNow user interface showing the process of adding a new set of credentials for connecting to a BloodHound Enterprise tenant."
                                     />
                             )}

             {app_1 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image12.png"
                                         alt="A view of the ServiceNow user interface showing the process of adding a new set of credentials for connecting to a BloodHound Enterprise tenant."
                                     />
                             )}
           </Frame>

    6. Enter your BloodHound Enterprise tenant URL, token key, and token ID and click **Submit**.

       The token key and ID refer to the non-personal API key/ID pair you created in BloodHound Enterprise. The tenant URL is the URL you use to access your BloodHound Enterprise tenant.

           <Frame>
             {app_1 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image26.png"
                                         alt="A view of the ServiceNow user interface showing the form for entering BloodHound Enterprise tenant URL and API credentials."
                                     />
                             )}

             {app_1 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image13.png"
                                         alt="A view of the ServiceNow user interface showing the form for entering BloodHound Enterprise tenant URL and API credentials."
                                     />
                             )}
           </Frame>

    7. Click the <Icon icon="close" /> (close) icon.

           <Frame>
             {app_1 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image18.png"
                                         alt="A view of the ServiceNow user interface showing the process of exiting the credentials form."
                                     />
                             )}

             {app_1 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image14.png"
                                         alt="A view of the ServiceNow user interface showing the process of exiting the credentials form."
                                     />
                             )}
           </Frame>

    8. Click **Mark as Complete** to proceed to the next configuration step.

           <Frame>
             {app_1 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image37.png"
                                         alt="A view of the ServiceNow user interface showing the process of marking the Connect to BloodHound Enterprise step as complete in the guided setup."
                                     />
                             )}

             {app_1 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image15.jpeg"
                                         alt="A view of the ServiceNow user interface showing the process of marking the Connect to BloodHound Enterprise step as complete in the guided setup."
                                     />
                             )}
           </Frame>
  </Step>

  <Step>
    ### Filter attack path types

    Next, configure filters to specify which attack path findings should create ServiceNow tickets. You can filter by environment and attack type to control the scope of findings that generate incidents.

    1. Click **Get Started** in the *Filter Attack Path Types* section.

           <Frame>
             {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image17.png"
                                         alt="A view of the ServiceNow user interface showing the guided setup for filtering attack path types for BloodHound Enterprise findings."
                                     />
                             )}

             {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image16.png"
                                         alt="A view of the ServiceNow user interface showing the guided setup for filtering attack path types for BloodHound Enterprise findings."
                                     />
                             )}
           </Frame>

    2. Click **Configure** to select environments.

           <Frame>
             {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image21.png"
                                         alt="A view of the ServiceNow user interface showing the process of configuring attack path type filters for BloodHound Enterprise findings."
                                     />
                             )}

             {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image17.png"
                                         alt="A view of the ServiceNow user interface showing the process of configuring attack path type filters for BloodHound Enterprise findings."
                                     />
                             )}
           </Frame>

    3. Click **New**.

           <Frame>
             {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image16.png"
                                         alt="A view of the ServiceNow user interface showing the process of adding a new attack path type filter for BloodHound Enterprise findings."
                                     />
                             )}

             {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image18.png"
                                         alt="A view of the ServiceNow user interface showing the process of adding a new attack path type filter for BloodHound Enterprise findings."
                                     />
                             )}
           </Frame>

    4. Click the <Icon icon="lock" /> (lock) icon to select a single environment.

           <Frame>
             {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image8.png"
                                         alt="A view of the ServiceNow user interface showing the process of selecting environments for attack path type filtering."
                                     />
                             )}

             {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image19.png"
                                         alt="A view of the ServiceNow user interface showing the process of selecting environments for attack path type filtering."
                                     />
                             )}
           </Frame>

       <Tip>Alternatively, click the **Select All Environments** checkbox to indiscriminately select *all* environments.</Tip>

    5. After clicking the <Icon icon="lock" /> (lock) icon, click the <Icon icon="search" /> (search) icon to display a list of available environments.

           <Frame>
             {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image4.png"
                                         alt="A view of the ServiceNow user interface showing the process of selecting an environment for attack path type filtering."
                                     />
                             )}

             {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image20.png"
                                         alt="A view of the ServiceNow user interface showing the process of selecting an environment for attack path type filtering."
                                     />
                             )}
           </Frame>

    6. Click an environment to select it.

       <Note>You must repeat steps 4-6 for each environment that you want to include.</Note>

    7. After selecting all required environments, click **Submit**.

           <Frame>
             {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image3.png"
                                         alt="A view of the ServiceNow user interface showing the process of submitting selected environments for attack path type filtering."
                                     />
                             )}

             {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image22.png"
                                         alt="A view of the ServiceNow user interface showing the process of submitting selected environments for attack path type filtering."
                                     />
                             )}
           </Frame>

    8. Click the <Icon icon="close" /> (close) icon.

    9. Click **Mark as Complete**.

    10. Scroll down the page to the *Filter Configuration* section and click **Configure**.

            <Frame>
              {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                      <img
                                          src="/images/integrations/service-now/sir/image29.png"
                                          alt="A view of the ServiceNow user interface showing the filter configuration options."
                                      />
                              )}

              {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                      <img
                                          src="/images/integrations/service-now/vr/image23.png"
                                          alt="A view of the ServiceNow user interface showing the filter configuration options."
                                      />
                              )}
            </Frame>

    11. Click an environment to update the default configuration.

            <Frame>
              {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                      <img
                                          src="/images/integrations/service-now/sir/image31.png"
                                          alt="A view of the ServiceNow user interface showing the process of updating filter configuration for selected environments."
                                      />
                              )}

              {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                      <img
                                          src="/images/integrations/service-now/vr/image24.png"
                                          alt="A view of the ServiceNow user interface showing the process of updating filter configuration for selected environments."
                                      />
                              )}
            </Frame>

    12. Edit the fields as required.

            <Frame>
              {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                      <img
                                          src="/images/integrations/service-now/sir/image5.png"
                                          alt="A view of the ServiceNow user interface showing the process of editing filter details."
                                      />
                              )}

              {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                      <img
                                          src="/images/integrations/service-now/vr/image25.png"
                                          alt="A view of the ServiceNow user interface showing the process of editing filter details."
                                      />
                              )}
            </Frame>

    13. Click the **Select All Attack Types** checkbox to update finding types.

            <Frame>
              {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                      <img
                                          src="/images/integrations/service-now/sir/image10.png"
                                          alt="A view of the ServiceNow user interface showing the process of selecting all attack types."
                                      />
                              )}

              {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                      <img
                                          src="/images/integrations/service-now/vr/image26.png"
                                          alt="A view of the ServiceNow user interface showing the process of selecting all attack types."
                                      />
                              )}
            </Frame>

    14. Click **Update** to save the configuration.

            <Frame>
              {app_2 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                      <img
                                          src="/images/integrations/service-now/sir/image20.png"
                                          alt="A view of the ServiceNow user interface showing the process of updating the filter configuration."
                                      />
                              )}

              {app_2 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                      <img
                                          src="/images/integrations/service-now/vr/image27.png"
                                          alt="A view of the ServiceNow user interface showing the process of updating the filter configuration."
                                      />
                              )}
            </Frame>

    15. Click the <Icon icon="close" /> (close) icon.

    16. Click **Mark as Complete**.
  </Step>

  <Step>
    ### Configure field mapping

    Field mapping allows you to specify how BloodHound Enterprise attack path finding fields map to ServiceNow SIR ticket fields. You can use the default mapping or customize it as needed.

    1. Click **Get Started** in the *SpecterOps to ServiceNow Field Mapping* section.

           <Frame>
             <img src="https://mintcdn.com/specterops/kdWektpXPZuKIVCU/images/integrations/service-now/sir/image12.png?fit=max&auto=format&n=kdWektpXPZuKIVCU&q=85&s=f81a39b5c46bb36860ebc9e29463faa7" alt="A view of the ServiceNow user interface showing the process of getting started with field mapping." width="1821" height="712" data-path="images/integrations/service-now/sir/image12.png" />
           </Frame>

    2. Click **Configure** to review the mapping. Update it if necessary, or use the default mapping.

           <Frame>
             <img src="https://mintcdn.com/specterops/kdWektpXPZuKIVCU/images/integrations/service-now/sir/image25.png?fit=max&auto=format&n=kdWektpXPZuKIVCU&q=85&s=5bc657064683bd09b0a9fdb3f8de68ab" alt="A view of the ServiceNow user interface showing the default field mapping." width="1816" height="666" data-path="images/integrations/service-now/sir/image25.png" />
           </Frame>

       The following table describes the default field mapping:

       | **SpecterOps BloodHound Fields** | **ServiceNow SIR Fields** |
       | -------------------------------- | ------------------------- |
       | id                               | correlation id            |
       | composite risk                   | risk score                |
       | description + remediation        | description               |
       | domain name + title + id         | short description         |
       | from principal                   | contact type              |
       | server url                       | external url              |

    3. Click the <Icon icon="close" /> (close) icon.

    4. Click **Mark as Complete**.
  </Step>

  <Step>
    ### Configure import schedule

    The final step in the guided setup is to configure the import schedule to specify how often the integration should fetch attack path findings from BloodHound Enterprise and create ServiceNow tickets.

    1. Click **Get Started** in the *Configure Import Schedule* section.

           <Frame>
             {app_3 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image32.png"
                                         alt="A view of the ServiceNow user interface showing the guided setup for configuring the import schedule for fetching attack path findings from BloodHound Enterprise."
                                     />
                             )}

             {app_3 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image28.jpeg"
                                         alt="A view of the ServiceNow user interface showing the guided setup for configuring the import schedule for fetching attack path findings from BloodHound Enterprise."
                                     />
                             )}
           </Frame>

    2. Click **Configure** to schedule an import.

           <Frame>
             {app_3 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image19.png"
                                         alt="A view of the ServiceNow user interface showing the process of configuring the import schedule for fetching attack path findings from BloodHound Enterprise."
                                     />
                             )}

             {app_3 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image29.jpeg"
                                         alt="A view of the ServiceNow user interface showing the process of configuring the import schedule for fetching attack path findings from BloodHound Enterprise."
                                     />
                             )}
           </Frame>

    3. Click the **Run** dropdown menu and select one of the available options.

           <Frame>
             {app_3 === 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/sir/image13.png"
                                         alt="A view of the ServiceNow user interface showing the process of configuring the import schedule for fetching attack path findings from BloodHound Enterprise."
                                     />
                             )}

             {app_3 !== 'Security Incident Response Integration with SpecterOps BloodHound' && (
                                     <img
                                         src="/images/integrations/service-now/vr/image30.jpeg"
                                         alt="A view of the ServiceNow user interface showing the process of configuring the import schedule for fetching attack path findings from BloodHound Enterprise."
                                     />
                             )}
           </Frame>

    4. Enter frequency details and click **Update**.

       <Tip>You can also click **Execute Now** to run the import immediately.</Tip>

    5. Click the <Icon icon="close" /> (close) icon.

    6. Click **Mark as Complete**.

    The configuration is now complete. The integration will start fetching attack path findings from BloodHound Enterprise based on the configured schedule and create ServiceNow tickets accordingly.
  </Step>
</Steps>

## Next steps

[View and manage](/integrations/service-now/security-incident-response/use) SIR tickets created from BloodHound Enterprise attack path findings in ServiceNow.