Skip to main content

Suspicious Activity in the Nebula integration with ServiceNow

With the Malwarebytes Integration for ServiceNow you can perform actions to suspicious activity events when detected by Malwarebytes. This article describes how to perform actions on suspicious activity detections. 

Initiate Suspicious Activity Actions

The Malwarebytes - Suspicious Activities table displays all suspicious activity found on your endpoints and their severity levels: Low, Medium, or High. The administrator can select endpoints to action. Endpoints can receive actions with the following functions:

  • Open - Considers the process as suspicious and will continue to trigger additional detections.
  • Remediate - Treats the process as malicious and remediates the threat on the endpoint.
  • Close - Closes the suspicious activity incident with no further action. Most likely use in the case of a false positive.

To view Suspicious Activity and initiate actions:

  1. In ServiceNow, use the Filter navigator Search bar to find the Malwarebytes - Suspicious Activity table.
  2. This table shows all suspicious activity found on your endpoints. Check the box next to any detections you want to perform actions on.
    DOC-3240-20.png
  3. Click the Actions of selected rows... > select Malwarebytes Suspicious Activity action from the drop-down menu.
    DOC-3240-21.png
  4. In the Malwarebytes Suspicious Activity Action window, select the Action drop-down menu > select Remediate Suspicious Activity > click Start Action to initiate.
    DOC-3240-22.png
  5. View the action status under the Action Status column. The Action Status column always shows the last initiated action.
    DOC-3240-23.png

To create Security Incidents from high severity suspicious activities:

  1. In ServiceNow, use the Filter navigator Search bar to find the Malwarebytes - Suspicious Activity. This table shows all suspicious activity found on your endpoints.
  2. Check the box next to any detections you want to perform actions on.
  3. Click the Actions of selected rows... > select Escalate as ServiceNow Security Incident from the drop-down menu.
    Picture1.png
  4. In the Escalate as ServiceNow Security Incident window, select Create a Security Incident from the Action drop-down menu > click Start Action to initiate.
    Picture2.png
  5. Go to ServiceNow Security Incidents table to find the created ticket.
    3.png
  6. Open the ticket. The suspicious activity details are attached as work notes within the ticket.
    4.png

Note: If the user selects multiple suspicious activities for a single endpoint (hostname/configuration item), one security incident ticket is created with suspicious activities attached in the Activities section. If the user selects multiple suspicious activities across multiple endpoints, multiple tickets are created.

 

Return to the Nebula Integration with ServiceNow guide.

Related articles