Add ServiceNow adapter documentation#267
Merged
Merged
Conversation
Documents the new servicenow USP adapter: polled REST Table API ingestion of sys_audit (default) plus configurable feeds for syslog_transaction, sysevent login events, etc. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Documents the reviewed checkpoint semantics (id ORDERBY tiebreaker, checkpoint_lag, capped-poll resume, at-least-once restart behavior) and the 401-stops / 403-feed-local split, drops the event_time_path mapping from the IaC example (the adapter already ships a parsed UTC timestamp), and adds ServiceNow to the adapter-types index page. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents the new
servicenowUSP adapter (refractionPOINT/usp-adapters#293): polling ingestion of ServiceNow audit and system logs via the REST Table API.docs/2-sensors-deployment/adapters/types/servicenow.mdmodeled on the ThreatLocker adapter page: overview of the collectable tables (sys_auditdefault;syslog_transaction,syseventlogin events,syslog,sys_outbound_http_logas configurable feeds), Basic-auth setup and required roles/ACLs, full config reference, checkpoint/pagination/dedup behavior, sample payload, CLI + IaC examples, and a sample D&R rule.mkdocs.ymlnav under Adapter Types → Collaboration (next to Zendesk/Atlassian).mkdocs build --strictpasses.Should land together with (or after) refractionPOINT/usp-adapters#293.
🤖 Generated with Claude Code