Integrates ServiceNow Vulnerability Response with SpecterOps BloodHound to automate, correlate, and remediate Active Directory attack path risks.
KEY CAPABILITIES:
- Automated import of BloodHound Enterprise attack path findings
- Native Vulnerability Response framework integration
- Guided setup wizard for streamlined configuration
- Multi-environment support with configurable filtering
- Real-time synchronization with BloodHound API
- Graphical visualization in Vulnerability Manager Workspace
- Scheduled and on-demand data imports
BENEFITS:
- Reduce attack surface by identifying critical AD vulnerabilities
- Prioritize remediation based on exploitability
- Centralize security management within ServiceNow
- Automate vulnerability tracking and reporting
- Leverage industry-standard attack path analysis
REQUIREMENTS:
- ServiceNow Australia, Yokohama, or Zurich
- Vulnerability Response plugin
- Active SpecterOps BloodHound Enterprise subscription
- Network connectivity to BloodHound API endpoints
Complete installation and configuration guide included.
Integrates ServiceNow Vulnerability Response with SpecterOps BloodHound to automate, correlate, and remediate Active Directory attack path risks. Key capabilities include:
- Automated import of BloodHound attack path findings into ServiceNow
- Vulnerability Response framework integration for standardized monitoring
- Configurable environment and attack type filtering
- Real-time synchronization with BloodHound Enterprise API
- Graphical visualization through Vulnerability Manager Workspace
Version 1.3.0 - October 2026
New Features:
- The BloodHound Risk Mapping table stores one row per finding with the finding identifier and the mapped severity.
- Each row is marked Active when the finding is returned by the latest import.
- A finding missing from that import is marked Remediated. The vulnerable item stays open.
- Refresh Environment updates the finding-type filter from BloodHound, including types added or removed since the last refresh.
Enhancements:
- Optimized API communication with BloodHound Enterprise
- Improved data coalescing and deduplication
- Enhanced error handling and logging
Requirements:
- ServiceNow Australia, Yokohama, or Zurich
- Active SpecterOps BloodHound Enterprise subscription
- Vulnerability Response plugin (com.snc.vulnerability.response)
ServiceNow Instance:
- Minimum Release: Australia, Yokohama, or Zurich
- Required Plugin: Vulnerability Response (com.snc.vulnerability.response)
- User Roles: Administrator or equivalent permissions
External Dependencies:
- Active SpecterOps BloodHound Enterprise subscription
- BloodHound API access with valid token credentials
- Network connectivity: Outbound HTTPS (port 443) to BloodHound servers
Technical Requirements:
- Basic ServiceNow administration knowledge
- Familiarity with SpecterOps BloodHound platform
- Understanding of API integrations and security best practices