[Security Solution] ServiceNow SIR Connector

[shimonmodi]

Describe the feature:
This feature is a connector integration with ServiceNow Security Incident Response (SIR) application. Enterprise cybersecurity operation teams often use ServiceNow's SIR application to track, prioritize and respond to security incidents. This feature will allow users to:

• create a ServiceNow SIR connector
• create ServiceNow SIR connector UI form

Populate following Incident fields for SIR

• Category - retrieve possible values from ServiceNow instance & allow user to select before sending
• Priority - retrieve possible values from ServiceNow instance & allow user to select before sending
• Short Description - map directly from Description case field
• Description - add Timeline URLs or Detection Alert URLs attached to the case (if available)
• Affected resource - allow user to fill before sending (fill automatically from signals index if available)
• Source IP - allow user to fill before sending (fill automatically from signals index if available)
• Destination IP - allow user to fill before sending (fill automatically from signals index if available)
• Malware URL - allow user to fill before sending (fill automatically from signals index if available)
• Malware Hash - allow user to fill before sending (fill automatically from signals index if available)

More information about Security Incident here

More information Creating Security Incidents from events

Describe a specific use case for the feature:
SOC analysts and investigators using Elastic Security need a way to coordinate their investigative work with work being done by Incident Responders & IT personnel. This connector will let cybersecurity analysts easily send the results of their triage and investigation work to team members who will take mitigation actions, and also enable automated response playbook capability available in ServiceNow SIR.

Specifically they want to be able to:

• Create a new SIR incident directly from Elastic Security based on a case they are investigating.
• Close case in Elastic Security when SIR incident is closed in ServiceNow.
• View stats about MTTR

[cnasikas]

Implemented by #88190