ServiceNow
Leak events are turned into ServiceNow incidents.
How it works
The connection uses a service account; either an access token (OAuth) or a username and password. What can be done is limited by the service account’s permissions.
If the same leak is seen again, no new record is opened; a note is added to the existing one.
A write is never retried automatically. If the connection times out the record may have been created; the result is marked “could not be confirmed” and no second record is opened.
Limits
Records are created and annotated; they are not closed or deleted.
The leaked value itself is not written to the record.
Turning the connection off stops record creation and deletes the credentials.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.