Introduction

IriusRisk lets users integrate with some of the most popular issue trackers on the market.

This article aims to help integrate your application with your issue trackers.

Integrating with ServiceNow

Linking to issue trackers

1. Navigate to settings > issue trackers
   
2.  Configure general settings
   1. Sync interval – how often IriusRisk contacts the issue tracker to pull all details for that project/threat/countermeasure etc.
   2. Default profile – unless specified differently, what profile is set by default
   3. Weaknesses
      1. Create issue when test fail
      2. Close issues when test pass
         
3. Configure Issue Tracker Profile
   1. To add a new issue tracker configuration, please select ‘new
      
   2. Specify which issue tracker to configure
      
   3. Connection with ServiceNow
      1. Assign a name to the new issue tracker profile.
         
      2. Configure the url.
      3. Configure the username
      4. Configure the password
      5. If you are using a proxy, assign the proxy details
         
   4. Select 'get tables from ServiceNow'
   5. Select an  appropriate table to map to
      1. ensure you also have appropriate permissions 
      2. 
      3. Insert the issue fields and their associated values
         1. see below as an example:
            
      4. Validate the fields
      5. Save & test integration

   6. Mapping Guide

      You need to refresh the IriusRisk settings page in order to retrieve new columns created on ServiceNow

      You can use the following table to help you map ServiceNow tables/columns with IriusRisk settings.

      In the example column, you have some columns and values extracted from the Incident table, a built-in table of ServiceNow. However, you can use any table on ServiceNow, even a new one.

      Issue Definition	Required	Preferred Field Type	Description	Example
      Type	YES	Choice	The column from ServiceNow’s table to store the information for the Type of ticket	“category“
      Default type	YES		The value for the type of ticket (Bug, Task, User Story, etc)	“Network“
      State	YES	Choice	The column from ServiceNow’s table to store the information for the State of the ticket. You need to provide a default value at ServiceNow side	“state”
      Open Issue State	YES		The value/s in ServiceNow to identify a ticket as Open (can be chosen from the list of already available/used ones or we can add new value/s)	“New”, “On Hold”, “In Progress”
      Closed Issue State	YES		The value/s in ServiceNow to identify a ticket as Closed (can be chosen from the list of already available/used ones or we can add new value/s)	“Resolved”, “Closed”
      Rejected Issue State	YES		The value/s in ServiceNow to identify a ticket as Rejected (can be chosen from the list of already available/used ones or we can add new value/s)	“Canceled”
      Summary	YES	String	The column from ServiceNow’s table to store the information for the Summary of the ticket	“short_description”
      Description	YES	HTML	The column from ServiceNow’s table where we want to store the information for the Description of the ticket	“description”
      Priority	YES	Choice	The column from ServiceNow’s table where we want to store the information for the Priority of the ticket	“severity”
      Issue Weakness Priority	YES		The value in ServiceNow to identify the ticket’s priority (can be chosen from the list of already available/used one or we can add a new one)	“1 - High”
      Labels	NO	String	The column from ServiceNow’s table to store the information for the Labels of the ticket	“subcategory”
      Default Issue Labels	NO		Define default labels for the issues created from IriusRisk. If a comma is introduced in a label, then, after refresh on settings, IriusRisk will split the label using each comma as a delimiter creating more than one label. Example: this,is,a,label will result in four labels: THIS , IS , A , LABEL	“VPN”
      Comments	NO	Journal	The column from ServiceNow’s table to store the information for the Comments of the ticket. Note: If the user doesn’t map this field, then will still be able to create comments in IriusRisk but they won’t be synchronized with ServiceNow.	“work_notes”

       

      By default, IriusRisk will use the field “sys_id” to map the issue ID.

      It is worth considering that some fields in ServiceNow can be configured as read-only. In that case, if you map to one of them, IriusRisk won’t be able to set the field value.

      The following ServiceNow fields are not allowed to be mapped:

      • “sys_id”

      • “sys_created_on”

      • “sys_created_by”

      • “sys_mod_count”

      • “sys_updated_by”

      • “sys_updated_on”

       

      Best Practices

      When mapping particular fields, we should consider their behaviour before deciding on implementation. We’ve compiled a list of recommended best practices for these fields:

      State

      For optimal results, this field should be mapped to a Choice List with a provided default value. When creating an issue, the default value for its state can then be automatically managed by ServiceNow. If State is mapped to a string, the value will need to be manually raised in ServiceNow once the ticket is raised.

      Description

      This field should be mapped to an HTML field type.

      IriusRisk produces the description content rendered in a formatted, clear and structured way in the Issue Tracker client. In order to accomplish this, it uses HTML tags.

      Priority

      For optimal results, this field should be mapped to a Choice List with a provided default value.

      The priority of a ticket depends on whether the ticket was created from a countermeasure or a weakness:

      • Countermeasure: IriusRisk calculates the priority by taking the list of priorities available from a choice list, ordering it and comparing the position of each priority from the list against the risk assessed from the countermeasure. If IriusRisk doesn’t find a list of priorities, it will assign a value from the following list depending on the assessed risk:
        - "N/A"
        - "Very Low"
        - "Low"
        - "Medium"
        - "High"
        - "Critical"

      • Weakness: The priority will be taken from the value introduced in the Issue Weakness Priority mapping field.

      Comments

      When mapping comments with ServiceNow, we recommend mapping to a Journal field type. In this case, all the comments added to a countermeasure with a related issue will be propagated to ServiceNow, displayed by IriusRisk, however they won’t be stored in IriusRisk’s database.

      
      If you add comments to a countermeasure first and then create an issue from that countermeasure in ServiceNow, all the previous comments will be propagated to ServiceNow