Analyst1 for Security Incident Response
by Analyst1 Platform LLC dba Analyst1 LLC
Automatically enrich Security Incident Response observables with additional intelligence from Analyst1.
Install Trend
View Install Data
| Date | Install Count | Change |
|---|---|---|
| 2026-10-24 | 0 | - |
About
**Analyst1 for Security Incident Response** connects ServiceNow with the Analyst1 threat intelligence platform. When a Security Incident contains an observable of a supported type, the integration queries Analyst1 and, if there is a match, maps the Analyst1 Risk Score to a ServiceNow Threat Finding (Malicious, Suspicious, Clean, or Unknown) along with additional context, and links back to the matching indicator in Analyst1.
The following observable types are supported:
- IP address (V4)
- IP address (V6)
- Domain name
- URL
- Email address
- SHA256 hash
- SHA1 hash
- MD5 hash
Results appear as standard lookup records directly on the Security Incident, so analysts get the enrichment from Analyst1 without leaving ServiceNow.
Key Features
- Automatic threat lookups for Security Incident observables - IP addresses (V4/V6), URLs, domains, email addresses, and file hashes (MD5/SHA1/SHA256) - using Analyst1 threat intelligence
- Native SecOps Integration Framework Threat Lookup capability, configured in minutes from the Security Operations Integration Dashboard
- Findings (Malicious, Suspicious, Clean, Unknown) derived from Analyst1 risk scores and benign-entity intelligence, with the full API response preserved on each lookup result
- Admin-configurable finding overrides: 10 pre-defined mapping scenarios let security teams tune how Analyst1 verdicts map to ServiceNow findings without code
- Direct pivot from each lookup result to the matching indicator in the customer's Analyst1 tenant
- Built-in observable type filtering and duplicate-lookup suppression to conserve API usage