Working with Neurons for Security Operations Management
Role: Chief Information Security Officer, Security Administrator, Security Analyst, Security Manager
Minimum Version: 2020.3
With Ivanti Neurons for Security Operations Management (SOM) capabilities, security incidents of your organization such as theft, data breach, phishing, and policy violation are addressed in a structured manner with automated workflows. It also helps employees to easily report security incidents, and request for security services.
Ivanti Neurons for SOM converts an Event to a Group Business Object, and creates Network and Security Event types under the new Event Business Object. This gives you more flexibility in integrating an Event with other systems.
The software integrates with RiskSense and uses an API call to import Network and Security Events. You can also create new Network and Security Events. and create Incidents or Changes to help manage your events. Track unmanaged devices on a dashboard and integrate with Atlassian Jira Software and Azure DevOps to automatically create issues.
Installation and Configuration
This section explains the installation and configuration process for ITSM Enterprise in both cloud and on-premise environments, for new and existing customers.
New Customers - ITSM Cloud
Neurons for ITSM Enterprise Line of Business (LOB) is included with ITSM deployments for all new ITSM customers. No additional installation or manual upgrades are required. ITSM Enterprise license or Enterprise solution package are required to access ITSM Enterprise Workflows.
Contact Ivanti Operations to activate LOB content if upgrading licensing from standard ITSM to ITSM Enterprise.
Existing Customers - ITSM Cloud
Existing ITSM cloud customers who wish to activate Neurons for ITSM Enterprise will need to engage Ivanti Professional Services (PSO), Certified Ivanti Partner, or https://www.ivanti.com/en-gb/services/professional-servicesIvanti Operations in order to enable the additional content.
New Customers - ITSM On-premise
Neurons for ITSM Enterprise is included with new on-premises ITSM installations and can be activated for customers who have the required ITSM Enterprise licensing.
Contact Ivanti Professional Services or a Certified Ivanti Partner to enable the additional content.
Existing Customers - ITSM On-premise
Existing ITSM on-premises customers who wish to upgrade to Neurons for ITSM Enterprise will need to engage with Ivanti Professional Services or a Certified Ivanti Partner.
Features
The following scripts are included in the software:
- RiskSense - CIs by Security Event
- RiskSense - Create Security Events
- RiskSense - Security Event Details
- Risk-Based Vulnerability Management (RBVM) Integration Using Export API
These scripts have been updated for Neurons for SOM 2023.1. If you have already installed an older version of Neurons for SOM, the previous scripts (RiskSense Integration, RiskSense Integration -Get CIs, RiskSense Integration - Link CI to Ransomware Incident) will not be overwritten.
- RiskSense Integration Schedule: Set the start and end times to run the scripts above.
- Refer to Creating a Schedule in About the Schedule Entry and Scheduled Jobs Workspaces.
Refer to Creating a Scheduled Workflow in Using Workflows.
- Unmanaged Device Dashboard Special Part: Use this to track unmanaged devices on a dashboard. It isn't tied to a dashboard, so you can add it to any existing dashboard.
- Refer to Using Special Parts in Using the Dashboard Center.
- Integration with the Jira Service Desk Connector: The RiskSense integration works with the Jira Service Desk Connector (part of the Ticket Sharing and Synchronization package). The Jira Service Desk Connector is a separate package that you can find in the Ivanti Marketplace.
Important: Edit and read-only permissions for metadata components including fields, relationships, forms, lists, layouts, triggered actions, saved searches and pick lists are indicated by a green pencil 
or red dot 
icon in the Configuration console. Components indicating a green pencil icon can be edited; components indicating a red dot icon are read-only. Components with no icon displayed can be edited and deleted. You can duplicate a read-only component and then edit it. Metadata components marked with a yellow pencil 
icon indicate a soft lock, meaning they have limited edit permissions. For more information on Soft lock, see Modifying a Business Object with Soft lock.
If you're not currently using the Event Business Object, we recommend you delete the demo data from the package import before you use this software. This makes it easier to find events that you create or import. There are 2000+ demo records.
To delete demo data:
- Open the Event workspace.
- From the list view, change the Page Size to 100.
- Highlight all events on the page, and then select Delete.
- Repeat steps 2-3 for all pages.
User Roles
The following user roles are available in Neurons for SOM. Each user role has different capabilities, roles and responsibilities:
- Chief Information Security Officer
- Security Administrator
- Security Analyst
- Security Manager