The original post: /r/cybersecurity by /u/tc2k on 2024-10-07 18:44:09.
I've been recently tasked with reconciling an authorization ticket if a new user is created in a server, automatically.
Whenever a new user is added to a server, I want to be able to reconcile it automatically to a ServiceNow ticket. So far I have the data coming in from Splunk with the ID and the origin server.
How would I be able to reconcile these two together using Python?
I am able to ingest the data already from Splunk but my main concern is finding this data in ServiceNow. Is this best approached through an API call or a report generated daily/weekly?
Or if there is another avenue to reconcile the authorization ticket, I am open to suggestions.