Unauthorized Change Detection - ServiceNow Integration - Tech Talks #93

Tanium and ServiceNow can alert you when someone changes a critical server outside a change window. Is it legit? Is it a threat actor? Track these changes and find out.

In this Tech Talk, host Ashley McGlone welcomes field CIO Saqib Khan to discuss this recent addition to the Tanium integration partnership with ServiceNow and the role of the Tanium Integrity Monitor module compliance and security.

Key takeaways

• This integration uses Tanium Integrity Monitor module to monitor file and registry changes on critical servers and report them to ServiceNow based on compliance requirements.
• ServiceNow can alert the relevant teams when changes occur outside of expected parameters or change windows and create incidents or security incidents based on the watch list behavior configured by the user.
• The integration helps in auditing, ensuring changes are authorized, and providing analytics for better decision-making regarding system security.
• The integration is flexible and customizable, allowing the user to define watch lists, filters, exclusions, and workflows according to their needs and preferences.
• The integration is easy to set up and use, with guided steps, documentation, and examples provided by Tanium and ServiceNow.

Additional resources

Tanium & ServiceNow partnership spotlight

Technical documentation and runbook

Integration announcement blog post