SecOps Module — Security Operations

اقرأ أولاً: ../MASTER_ALL_IN_ONE_SUMMARY.md · ../html/MASTER_ALL_IN_ONE_SUMMARY.html
الدليل الشامل: ../MASTER_ALL_IN_ONE.md · ../html/MASTER_ALL_IN_ONE.html
ممارسة الشاشات: ../html/MASTER_PRACTICE_GUIDE_ALL_TOPICS.html
Australia · Scope x_786686_hr_leave

Australia Instance — نسخة أستراليا

Direct Navigation URLs — روابط التنقل المباشرة

Platform target: ServiceNow Australia (Sep 2026) · next EA: Brazil
URLs: ../../SERVICENOW_DIRECT_URLS_CATALOG.md · 1-week: ../../SERVICENOW_ONE_WEEK_STUDY_DEPLOY_AUSTRALIA.md
HR Leave: Scope x_786686_hr_leave

وحدة SecOps — عمليات الأمن

Comprehensive guide for ServiceNow Security Operations (SIR + VR + TI + CTD)

دليل شامل لـ ServiceNow Security Operations: الاستجابة للحوادث الأمنية + إدارة الثغرات + ذكاء التهديدات + كشف الإختراق

§1 — Module Overview / نظرة عامة

ServiceNow Security Operations consists of four primary applications:

• SIR — Security Incident Response: incident lifecycle, MITRE ATT&CK, playbooks
• VR — Vulnerability Response: NVD/CVE scanning, prioritization, remediation
• TI — Threat Intelligence: IoC management, threat feeds, STIX/TAXII
• CTD — Configuration Compliance: CIS benchmarks, SCAP scanning — يتكوّن SecOps من 4 تطبيقات: استجابة الحوادث الأمنية (SIR)، إدارة الثغرات (VR)، ذكاء التهديدات (TI)، الالتزام بالإعدادات (CTD).

§2 — Architecture Overview / المعمارية

┌────────────────┐ CVE ┌────────────────┐ Asset ┌──────────────┐
│ Qualys/Tenable│──────▶│ VR (sn_vul_) │────────▶│ CMDB (CI) │
└────────────────┘ └────────────────┘ └──────────────┘
│ │ │
▼ ▼ ▼
┌────────────────┐ IoC ┌────────────────┐ Affected ┌──────────────┐
│ Splunk/QRadar │──────▶│ SIR (sn_si_) │──────────▶│ Service Maps │
└────────────────┘ └────────────────┘ └──────────────┘
│ ▲
▼ │
┌────────────────┐ Hunt ┌────────────────┐
│ Threat Feeds │────────▶│ TI (sn_ti_*) │
└────────────────┘ └────────────────┘

§3 — SIR: Security Incident Response

3.1 Lifecycle

Draft → Analysis → Contain → Eradicate → Recover → Review → Closed

3.2 Sources (incident creation)

3.3 MITRE ATT&CK alignment

Each incident is tagged with:
- Tactic (e.g., Initial Access)
- Technique (e.g., T1566 Phishing)
- Sub-technique (e.g., T1566.001 Spearphishing Attachment)

var SIRMitreTagger = Class.create();
SIRMitreTagger.prototype = {
 initialize: function {},

tagIncident: function (incidentSysId, techniqueId) {
var t = new GlideRecord(‘sn_si_mitre_technique’);
if (!t.get(‘technique_id’, techniqueId)) return false;

var link = new GlideRecord(‘sn_si_incident_mitre’);
link.initialize();
link.setValue(‘incident’, incidentSysId);
link.setValue(‘technique’, t.getUniqueValue());
link.setValue(‘tactic’, t.getValue(‘tactic’));
link.insert();
return true;
},

type: ‘SIRMitreTagger’
};

3.4 Playbooks (Process Automation Designer)

Pre-built playbooks ship with SIR:
- Malware investigation
- Phishing response
- Data leak / Insider threat
- Ransomware containment
- Unauthorized access
- Brute force

Each playbook has steps mapped to NIST 800-61r2:

3.5 Automated containment script

// Triggered when severity >= high → call EDR to isolate
(function (current, previous) {
 if (current.severity.changes() &&
 parseInt(current.getValue('severity'), 10) <= 2) {
 var affected = new GlideRecord('sn_si_m2m_ci_incident');
 affected.addQuery('incident', current.getUniqueValue());
 affected.query();
 while (affected.next()) {
 var ci = affected.getValue('configuration_item');
 new SIRContainer().isolateHost(ci);
 }
 }
})(current, previous);

var SIRContainer = Class.create();
SIRContainer.prototype = {
 initialize: function {},

isolateHost: function (ciSysId) {
var ci = new GlideRecord(‘cmdb_ci’);
if (!ci.get(ciSysId)) return false;
var hostName = ci.getValue(‘name’);

var rm = new sn_ws.RESTMessageV2(‘CrowdStrikeEDR’, ‘isolateHost’);
rm.setStringParameter(‘hostname’, hostName);
rm.setHttpTimeout(30000);
try {
var resp = rm.execute();
var status = resp.getStatusCode();
if (status >= 200 && status < 300) {
gs.eventQueue(‘x_sn_si.host.isolated’, ci, hostName);
return true;
}
gs.error(‘[SIR] Isolate failed for ’ + hostName + ’ status=’ + status);
} catch (e) {
gs.error(‘[SIR] Isolate exception: ’ + e.message);
}
return false;
},

type: ‘SIRContainer’
};

3.6 SIR Analyst Workspace

/now/sir/agent — provides:
- Incident inbox with priority filter
- MITRE ATT&CK heatmap
- IoC enrichment panel
- Playbook execution status
- Affected CIs map
- Timeline (forensic view)
- Tasks board

§4 — VR: Vulnerability Response

4.1 Data flow

Scanner (Qualys) → Import Set → Transform → sn_vul_vulnerability + sn_vul_vulnerable_item → CMDB CI link

4.2 Vulnerability prioritization

Default formula: CVSS × Asset Criticality × Exploit Availability × Business Impact

var VRPrioritizer = Class.create();
VRPrioritizer.prototype = {
 initialize: function {},

/* Computes priority 1 (Critical) to 5 (Info) /
prioritize: function (viSysId) {
var vi = new GlideRecord(‘sn_vul_vulnerable_item’);
if (!vi.get(viSysId)) return 5;
var cvss = parseFloat(vi.getValue(‘vulnerability.base_score’)) || 0;
var ciCrit = this._ciCriticality(vi.getValue(‘cmdb_ci’));
var exploit = this._exploitAvailable(vi.getValue(‘vulnerability.cve_id’));
var biz = this._businessImpact(vi.getValue(‘cmdb_ci’));

var score = (cvss * 0.4) + (ciCrit * 0.25) + (exploit * 0.2) + (biz * 0.15);
var prio = score >= 8 ? 1 : (score >= 6 ? 2 : (score >= 4 ? 3 :
(score >= 2 ? 4 : 5)));

vi.setValue(‘risk_score’, score.toFixed(1));
vi.setValue(‘priority’, prio);
vi.update();
return prio;
},

_ciCriticality: function (ciId) {
var c = new GlideRecord(‘cmdb_ci’);
if (!c.get(ciId)) return 5;
var bizCrit = c.getValue(‘business_criticality’);
var map = { ‘1 - most critical’: 10, ‘2 - somewhat critical’: 7,
‘3 - less critical’: 4, ‘4 - not critical’: 2 };
return map[bizCrit] || 5;
},

_exploitAvailable: function (cve) {
var fb = new GlideRecord(‘sn_vul_third_party_entry’);
fb.addQuery(‘cve_id’, cve);
fb.addQuery(‘exploit_status’, ‘available’);
fb.setLimit(1);
fb.query();
return fb.hasNext() ? 10 : 0;
},

_businessImpact: function (ciId) {
var s = new GlideAggregate(‘cmdb_ci_service_auto’);
s.addQuery(‘cmdb_ci_dependents’, ciId);
s.addAggregate(‘COUNT’);
s.query();
if (s.next()) {
var n = parseInt(s.getAggregate(‘COUNT’), 10);
return Math.min(10, n);
}
return 0;
},

type: ‘VRPrioritizer’
};

4.3 Auto-remediation workflows

4.4 SLA on remediation by priority

4.5 Patch group orchestration

// Group VIs by patch ID → bulk Change
(function bulkChange() {
 var agg = new GlideAggregate('sn_vul_vulnerable_item');
 agg.addQuery('state', 'open');
 agg.addQuery('priority', 'IN', '1,2');
 agg.addAggregate('COUNT');
 agg.groupBy('vulnerability.patch_id');
 agg.query();

while (agg.next()) {
var patchId = agg.getValue(‘vulnerability.patch_id’);
if (!patchId) continue;
var count = parseInt(agg.getAggregate(‘COUNT’), 10);
if (count >= 5) {
var chg = new GlideRecord(‘change_request’);
chg.initialize();
chg.setValue(‘short_description’, ‘Apply patch ’ + patchId +
’ to ’ + count + ’ affected systems’);
chg.setValue(‘category’, ‘security’);
chg.setValue(‘priority’, 2);
chg.setValue(‘risk’, ‘moderate’);
chg.insert();
}
}
})();

§5 — TI: Threat Intelligence

5.1 Sources (TAXII feeds)

5.2 Observable types

• IP, Domain, URL, Hash (MD5/SHA1/SHA256), Email, File path, Registry key, Mutex, User agent

5.3 IoC enrichment

var TIEnricher = Class.create();
TIEnricher.prototype = {
 initialize: function {},

enrich: function (observableValue, type) {
var results = {};
if (type === ‘ip’) {
results.geoip = this._geo(observableValue);
results.virustotal = this._vt(observableValue, ‘ip’);
results.greynoise = this._gn(observableValue);
} else if (type === ‘hash’) {
results.virustotal = this._vt(observableValue, ‘file’);
} else if (type === ‘url’) {
results.urlhaus = this._urlhaus(observableValue);
}
return results;
},

_vt: function (val, kind) {
var rm = new sn_ws.RESTMessageV2(‘VirusTotal’, kind === ‘ip’ ?
‘lookupIP’ : ‘lookupHash’);
rm.setStringParameter(‘ioc’, val);
var resp = rm.execute();
return JSON.parse(resp.getBody() || ‘{}’);
},

_geo: function (ip) { / maxmind / return {}; },
_gn: function (ip) { / greynoise / return {}; },
_urlhaus: function (u) { / urlhaus / return {}; },

type: ‘TIEnricher’
};

5.4 Threat hunt: IoC sweep across the estate

function huntIoC(observableValue, observableType) {
 var findings = [];

if (observableType === ‘ip’) {
// Search active sessions / firewall logs / SIEM
var siem = new sn_ws.RESTMessageV2(‘Splunk’, ‘searchIoC’);
siem.setStringParameter(‘ioc’, observableValue);
siem.setHttpTimeout(60000);
var resp = JSON.parse(siem.execute().getBody() || ‘{}’);
if (resp.results && resp.results.length > 0) {
resp.results.forEach(function (hit) {
findings.push({ source: ‘siem’, host: hit.host, time: hit.time });
});
}
} else if (observableType === ‘hash’) {
// Check EDR for file presence
var edr = new sn_ws.RESTMessageV2(‘CrowdStrikeEDR’, ‘searchHash’);
edr.setStringParameter(‘hash’, observableValue);
var edrResp = JSON.parse(edr.execute().getBody() || ‘{}’);
(edrResp.devices || []).forEach(function (d) {
findings.push({ source: ‘edr’, host: d.hostname, time: d.last_seen });
});
}

return findings;
}

§6 — CTD: Configuration Compliance

6.1 SCAP / CIS benchmarks

CTD imports SCAP results (OpenSCAP, Tenable Compliance Scan, Qualys PC):

Test → Result (pass|fail) → Vulnerability (per failing CI) → Remediation

6.2 Auto-remediation via Orchestration

Failing CIS test → run Ansible playbook (or Chef/Puppet) → re-test.

§7 — Integration Quick Reference

§8 — Reports & Dashboards

§17 — Power User Playbook (SecOps)

17.1 Personas

17.2 Day-in-Life — SOC Analyst T1

1. Open /now/sir/agent → My queue (severity sorted).
2. Pick highest-sev incident. Run “Enrich Observables” playbook.
3. Validate true/false positive (FP rate target < 30%).
4. If TP → escalate to T2 with notes, MITRE tag, affected CIs.
5. Track SLA (typically 15 min triage).

17.3 Top 15 SecOps Scripts

1. SIEM alert → SIR incident

// Scripted REST /api/x_sn_si/v1/incident
(function process(request, response) {
 var alert = request.body.data;
 var inc = new GlideRecord('sn_si_incident');
 inc.initialize();
 inc.setValue('short_description', alert.title);
 inc.setValue('description', alert.description);
 inc.setValue('severity', _mapSeverity(alert.severity));
 inc.setValue('source', alert.source || 'siem');
 inc.setValue('correlation_id', alert.alert_id);
 var sysId = inc.insert();

// Affected CIs
(alert.affected_hosts || []).forEach(function (host) {
var ci = new GlideRecord(‘cmdb_ci’);
ci.addQuery(‘name’, host);
ci.setLimit(1); ci.query();
if (ci.next()) {
var m = new GlideRecord(‘sn_si_m2m_ci_incident’);
m.initialize();
m.setValue(‘incident’, sysId);
m.setValue(‘configuration_item’, ci.getUniqueValue());
m.insert();
}
});

// IoCs
(alert.iocs || []).forEach(function (ioc) {
var ob = new GlideRecord(‘sn_ti_observable’);
ob.initialize();
ob.setValue(‘value’, ioc.value);
ob.setValue(‘finding’, ioc.type);
ob.setValue(‘source’, ‘incident_’ + inc.getValue(‘number’));
ob.insert();
});

response.setStatus(201);
return { incident_id: inc.getValue(‘number’) };

function _mapSeverity(sev) {
var m = { critical: 1, high: 2, medium: 3, low: 4, info: 5 };
return m[String(sev).toLowerCase()] || 3;
}
})(request, response);

2. Disable AD user containment

var SIRADIsolator = Class.create();
SIRADIsolator.prototype = {
 initialize: function {},

disable: function (userSysId, reason) {
var u = new GlideRecord(‘sys_user’);
if (!u.get(userSysId)) return false;

var rm = new sn_ws.RESTMessageV2(‘AzureAD’, ‘disableUser’);
rm.setStringParameter(‘userPrincipalName’, u.getValue(‘email’));
rm.setHttpTimeout(30000);
var resp = rm.execute();
if (resp.getStatusCode() >= 200 && resp.getStatusCode() < 300) {
u.setValue(‘active’, false);
u.setValue(‘locked_out’, true);
u.update();

// Audit
var a = new GlideRecord(‘sn_si_action_log’);
a.initialize();
a.setValue(‘action’, ‘disable_user’);
a.setValue(‘target’, u.getValue(‘email’));
a.setValue(‘reason’, reason);
a.insert();
return true;
}
return false;
},

type: ‘SIRADIsolator’
};

3. Block IP at firewall

function blockIP(ip, reason, ticketId) {
 var rm = new sn_ws.RESTMessageV2('PaloAltoFirewall', 'addBlocklist');
 rm.setStringParameter('ip', ip);
 rm.setStringParameter('note', 'SIR-' + ticketId + ': ' + reason);
 rm.setHttpTimeout(20000);
 try {
 var r = rm.execute();
 if (r.getStatusCode() >= 200 && r.getStatusCode() < 300) {
 gs.eventQueue('x_sn_si.ip.blocked', null, ip, ticketId);
 return true;
 }
 gs.error('[SIR] FW block failed: ' + r.getBody());
 } catch (e) {
 gs.error('[SIR] FW exception: ' + e.message);
 }
 return false;
}

4. Bulk-VI to bulk-Change — covered in §4.5 above.

5. Phishing email auto-triage — Inbound Email → parse URLs/attachments → enrich → create SIR if malicious.

6. Asset → Vulnerability count rollup — GlideAggregate on sn_vul_vulnerable_item grouped by cmdb_ci.

7. CVE exploitation watcher — daily check NVD + ExploitDB; update exploit_status on sn_vul_vulnerability.

8. Threat actor profile linker — incidents tagged with same actor → group view.

9. SLA breach forecaster — predict which VIs will breach SLA based on remediation pace.

10. Forensics evidence collector — capture EDR + SIEM logs into encrypted attachment.

11-15. Quick recipes

§18 — From-Scratch Implementation (Day 0 → Day 30)

18.1 Day-by-day

Day 0 — Strategy
- Threat model
- SOC operating model (24/7 vs follow-the-sun)
- Roles (T1/T2/T3, Hunter, IR Manager)
- Tools inventory (SIEM, EDR, FW, Scanner, AD)
- Runbook drafts (Phishing, Ransomware, Lost Laptop, Data Leak, Insider)

Day 1 — Plugins

- com.snc.threat (SecOps Foundation)
- com.snc.security_incident
- com.snc.vulnerability
- com.snc.vul_qualys / .tenable_io / .rapid7_insightvm
- com.snc.threat.intel
- com.snc.sn_vul_config_test
- com.sn_sec_cmn (Common Security)

Day 2-3 — CMDB readiness
- Hosts have IP, FQDN, OS, business criticality
- Service Maps for top 20 critical services
- Asset criticality tier (1-4)

Day 4-5 — Integration accounts
- SIEM API user
- EDR API key
- Scanner API
- AD service account
- Cloud accounts (AWS/Azure/GCP)
- IH spoke connections tested

Day 6 — SIR fundamentals
- Severity matrix (1=Critical → 5=Info)
- States + transitions
- Assignment groups (SOC-T1, SOC-T2, IR-Manager, Forensics)

Day 7-9 — Playbooks (PAD)
- Build/customize 6 core: Phishing, Malware, DLP, Ransomware, Brute Force, Privilege Misuse
- Each with steps mapped to NIST 800-61r2

Day 10 — MITRE ATT&CK tagging
- Import latest MITRE bundle
- Configure auto-tagging from alert type

Day 11 — SIR Workspace customization

Day 12 — Containment actions
- Isolate host (script #2 in §17.3)
- Block IP (script #3)
- Disable user (script #2 modified)

Day 13 — VR scanner integration
- Qualys/Tenable IH Spoke
- Import schedule (every 6h)
- Asset matching algorithm tuning

Day 14 — Vulnerability deduplication (IRE rules)

Day 15 — Prioritization formula (script in §4.2)

Day 16 — SLA on VIs

Day 17 — Remediation workflows (auto-Change, dev tickets)

Day 18 — Patch group orchestration (§4.5)

Day 19 — TI feeds onboarding
- TAXII connection to OTX (free start)
- MISP server (if available)
- Recorded Future (paid)
- IoC ingestion + dedup

Day 20-21 — IoC enrichment (script in §5.3)

Day 22 — Threat hunt baseline (script in §5.4)

Day 23 — CTD benchmark import
- CIS Level 1 Linux
- CIS Level 1 Windows Server
- CIS K8s

Day 24 — Compliance dashboards

Day 25 — Dashboards (SOC Manager + CISO)

Day 26 — Reports & PA
- MTTD / MTTR / Containment time
- Vulnerability remediation velocity
- IoC hit rate

Day 27 — ATF — 12 scenarios

Day 28 — Training
- T1 analysts (2 days)
- T2 analysts (3 days)
- IR manager (1 day)
- VR owners (½ day)

Day 29 — Tabletop exercise

Day 30 — Go-live + 24/7 SOC operational

18.2 KPIs Month 1

§19 — Sign-off Checklist

• [ ] CMDB readiness verified (criticality + service maps)
• [ ] All scanner integrations tested end-to-end
• [ ] SIR playbooks reviewed by IR manager
• [ ] MITRE ATT&CK current version imported
• [ ] Containment actions tested in pre-prod
• [ ] SLA matrix signed by CISO
• [ ] On-call rotation defined
• [ ] War-room runbook printed
• [ ] Disaster scenarios drilled (tabletop)
• [ ] Forensics evidence chain documented

§19 — CIS-VR / CIS-SIR Exam & Z-to-Hero Feature Labs (30 inline Q)

19.1 Z-to-Hero Feature Labs (12 labs)

19.2 30 SecOps Practice Questions

SIR (Q1-Q15)

1. SIR table: A. sn_si_incident | B. incident | C. sec_incident | D. None — Answer: A
2. Playbook engine: A. Workflow Studio (Process Automation) | B. Legacy WF | C. Flow Designer only | D. None — Answer: A
3. MITRE ATT&CK reference: A. sn_si_attack_technique table | B. Just notes | C. Random | D. None — Answer: A
4. SIR Priority calc: A. Impact × Urgency + business risk | B. Random | C. Cost | D. None — Answer: A
5. Containment action examples: A. Isolate host, block IP, reset password, revoke session | B. Just notify | C. None | D. Random — Answer: A
6. SIR ↔ Incident relationship: A. SIR can spawn ITIL Incident for IT impact | B. Same record | C. Independent | D. Random — Answer: A
7. Major Incident from SIR: A. Promote to Major Incident on impact threshold | B. Manual only | C. Random | D. None — Answer: A
8. SIR Workspace URL: A. /now/sir/workspace | B. /sir.do | C. Random | D. None — Answer: A
9. Phishing email submission: A. Outlook plugin → Inbound Email Action → SIR | B. Manual | C. Random | D. None — Answer: A
10. Threat Intel sources: A. STIX/TAXII feeds + Vendor APIs (Mandiant, Recorded Future) | B. Just news | C. Random | D. None — Answer: A
11. IoC types: A. IP, Domain, URL, Hash, Email | B. Just IP | C. Random | D. None — Answer: A
12. Threat Hunt: A. Proactive search using TI + endpoint data | B. Reactive only | C. Random | D. None — Answer: A
13. Tabletop exercise scope: A. Simulate breach end-to-end with stakeholders | B. Just docs | C. Random | D. None — Answer: A
14. SOAR integration: A. ServiceNow as SOAR with SIEM as detector | B. Same | C. Random | D. None — Answer: A
15. Evidence preservation: A. Forensic copy + chain of custody record | B. Just screenshot | C. Random | D. None — Answer: A

VR (Q16-Q30)

16. VR table: A. sn_vul_vulnerable_item (per asset per vuln) | B. sn_vul_vulnerability (master) | C. Both | D. None — Answer: C
17. Prioritization inputs: A. CVSS + asset criticality + exploit availability + business context | B. CVSS only | C. Random | D. None — Answer: A
18. CVSS v3.1 ranges: A. 0-3.9 Low / 4-6.9 Med / 7-8.9 High / 9-10 Critical | B. Different | C. Random | D. None — Answer: A
19. Vulnerability Group: A. Bundle VIs by host/app/business for collective remediation | B. Just sort | C. Random | D. None — Answer: A
20. Auto-CR creation: A. VG → Change Request workflow on threshold | B. Manual | C. Random | D. None — Answer: A
21. Patch deferral: A. Risk Owner approval + justification + re-eval date | B. Free pass | C. Random | D. None — Answer: A
22. VR sources: A. Qualys, Tenable, Rapid7, Crowdstrike, MS Defender | B. Just one | C. Random | D. None — Answer: A
23. Asset enrichment for VR: A. Owner, criticality, exposure (internet-facing) | B. Just name | C. Random | D. None — Answer: A
24. KEV catalog (CISA): A. Known Exploited Vulnerabilities — fast-track | B. Random | C. None | D. Just list — Answer: A
25. Threat-aware VR: A. Boost priority if active exploit in wild | B. Ignore | C. Random | D. None — Answer: A
26. Vulnerability lifecycle: A. Detected → Triaged → Assigned → Remediated → Verified → Closed | B. Just close | C. Random | D. None — Answer: A
27. SLA on vulnerabilities: A. Per severity (Critical=7d, High=30d, Med=90d typical) | B. Random | C. None | D. Always 30d — Answer: A
28. False positive workflow: A. Submit → review → confirm → close as FP + suppress | B. Just close | C. Random | D. None — Answer: A
29. VR + CMDB: A. VI links to CI via IRE | B. Manual only | C. Random | D. None — Answer: A
30. CTD (Configuration Compliance) scanners: A. Tenable.io CC, Qualys PC, custom | B. None | C. Random | D. Just one — Answer: A

19.3 What “Hero” looks like for SecOps

Operates a security operation: SIR + VR + TI + CTD integrated. Playbooks automate top 10 incident types. VR prioritization is risk-aware (CVSS + asset + exploit). Auto-CR for VG > threshold. Containment via EDR. Tabletop exercises quarterly. SOC dashboards live.

Hands-on Labs — مختبرات عملية

Step-by-step labs for PDI / Australia instance. Replace {BASE} with your instance URL.
مختبرات خطوة بخطوة — استبدل {BASE} برابط نسختك.

1. Lab 1 — SIR incident / حادث أمني — Create at {BASE}/sn_si_incident.do?sys_id=-1; tag MITRE technique.

2. Lab 2 — Playbook / مسار عمل — Run phishing playbook from {BASE}/now/workflow-studio/home.

3. Lab 3 — IoC enrichment / IoC — Add indicator at {BASE}/sn_ti_indicator_list.do; enrich incident.

4. Lab 4 — VR prioritization / أولوية ثغرة — Import sample CVE; score with asset criticality.

5. Lab 5 — Vulnerable Item / VI — Review VI list; assign remediation owner.

6. Lab 6 — Bulk remediation / إصلاح جماعي — Create Change from Vulnerability Group.

7. Lab 7 — Config compliance / امتثال إعداد — Run CIS benchmark scan; review failures.

8. Lab 8 — SIR Workspace / مساحة SIR — Triage queue at {BASE}/now/sir/workspace.

Best Practices — أفضل الممارسات

Deployment Checklist — قائمة النشر

Direct URLs Quick Reference