ServiceNow User

Users with access to the ServiceNow instance

Part of the ServiceNow inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Daily	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	Yes

Properties

Property	Type	Description	Automation placeholder
Key	String	Internal.	{{ServiceNowUser.ApiKeyEncrypted}}
Created On	DateTime	Date when the user was created.	{{ServiceNowUser.CreatedOn}}
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	{{ServiceNowUser.CreatedTime}}
Department	String	Department of the user.	{{ServiceNowUser.Department}}
Display Name	String		{{ServiceNowUser.DisplayName}}
Email	String	Email address of the user.	{{ServiceNowUser.Email}}
ID	String	Unique identifier of the user.	{{ServiceNowUser.Id}}
Instance	ServiceNow Instance	ServiceNow instance this user belongs to.	{{ServiceNowUser.Instance}}
Instance URL	String	Internal.	{{ServiceNowUser.InstanceUrl}}
Active	Boolean	Whether the user account is active.	{{ServiceNowUser.IsActive}}
Is External	Boolean	Whether the user is an external user.	{{ServiceNowUser.IsExternal}}
Locked Out	Boolean	Whether the user account is locked out.	{{ServiceNowUser.IsLockedOut}}
Last Login	DateTime	Date of last login.	{{ServiceNowUser.LastLogin}}
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	{{ServiceNowUser.LastModifiedTime}}
Risk Score	Int32	Stores risk score	{{ServiceNowUser.RiskScore}}
Risk Score Update	DateTime	Stores risk score update	{{ServiceNowUser.RiskScoreLastUpdate}}
Risk Score Value	String	Stores risk score value like Low_Low	{{ServiceNowUser.RiskScoreValue}}
Source	String	Identity source (e.g., LDAP, SAML, local).	{{ServiceNowUser.Source}}
Title	String	Job title of the user.	{{ServiceNowUser.Title}}
Username	String	Login username.	{{ServiceNowUser.UserName}}

Relations

Relation	Service	Description
ServiceNow AI Agent	ServiceNow	AI agents registered in ServiceNow AI Control Tower
ServiceNow Instance	ServiceNow	ServiceNow instances that are configured to be scanned
ServiceNow User Group	ServiceNow	User groups in ServiceNow
ServiceNow User Role	ServiceNow	Role assignments for ServiceNow users

Segments

Segment	Description
External ServiceNow Users	Shows ServiceNow users who are external users
Inactive ServiceNow Users	Shows ServiceNow user accounts that are deactivated
Locked Out ServiceNow Users	Shows ServiceNow user accounts that are locked out

Actions

• Deactivate User

Policies that check this object

Policy	Severity	Description
External ServiceNow users with privileged roles	High	Detects external users who hold role assignments in ServiceNow
Inactive ServiceNow users with assigned roles	High	Detects deactivated users that still have role assignments
ServiceNow external user is active and reachable	High	Active external users are externally-reachable identities and a more likely entry point for compromise
ServiceNow users not logged in for 180+ days	Medium	Detects active users who have not logged in for over 180 days
ServiceNow active user holds role assignments	Medium	Active users holding one or more roles are privileged, reachable identities and a more likely compromise vector