Press CTRL+K to open search

ServiceNow: Configuring the SaaS Posture Integration

  • Updated on Nov 1, 2026
  • 2 minute(s) read
Prev Next

Overview

SaaS Posture integrations provide visibility into the configuration and security posture of your connected SaaS applications. Cato continuously reviews the application settings and compares them to the recommended posture defined by Cato’s research team. This helps identify misconfigurations that can increase risk, such as authentication settings, third-party integrations, and data-sharing controls.

Posture data appears in the Cloud Apps Dashboard, where you can view posture scores and the highest-severity findings across connected applications. You can review each posture check from the Posture page, including the issue details, status, and remediation action required to pass the check.

For more information, see Reviewing the Security Posture of Your SaaS Applications.

To configure the SaaS Posture integration, you need to:

  1. Configure the required settings in the SaaS application

  2. Create the API connector in the CMA

A CASB license is required for SaaS Posture integrations.

Configuring the ServiceNow Integration

To configure the ServiceNow integration, create an OAuth API endpoint and a dedicated integration user.

Prerequisites

  • An administrator with the elevated security admin role

  • The OAuth 2.0 plugin (com.snc.platform.security.oauth) active on the instance

  • The OAuth password (ROPC) grant permitted on the instance. The glide.oauth.inbound.ropc.grant_type.disabled property must be false or absent. The ServiceNow default is false

Step 1: Configure the Integration in ServiceNow

Create the OAuth API endpoint and integration user, assign the required role, and confirm that the password grant is permitted.

To create the ServiceNow integration:

Create an OAuth API endpoint:

  1. Log in to your ServiceNow instance as an administrator.

  2. Navigate to System OAuth > Application Registry.

  3. Click New, then select Create an OAuth API endpoint for external clients.

  4. Enter a descriptive name, for example, Cato SaaS Posture, and click Submit.

  5. Open the new record and copy and save the Client ID so it can be entered into the CMA.

  6. Reveal the Client Secret, copy and save it so it can be entered into the CMA.

Create a dedicated user to authenticate the connector:

  1. Navigate to User Administration > Users and click New.

  2. Enter a User ID, for example, cato.posture, and an email address, and select Web service access only.

  3. Click Submit.

  4. Open the user record, click Set Password, then Generate Password.

  5. Copy and save the password so it can be entered into the CMA. Click Save Password.
    Note: ServiceNow does not store the password unless you click Save Password.

Assign the admin role to the integration user:

  1. On the user record, open the Roles tab and click Edit.

  2. Add the admin role and click Save.

The connector authenticates using the OAuth password (ROPC) grant.

To confirm that the password grant is permitted:

  1. Navigate to System Properties > All Properties (sys_properties_list.do).

  2. Search for glide.oauth.inbound.ropc.grant_type.disabled.

  3. Confirm that the property is false or absent.

Step 2: Create the API Connector in the CMA

After you have set up an integration with the required application, add the details in the CMA.

To create the API connector in the CMA:

  1. From the navigation menu, click Resources > Integrations.

  2. Click the Configured Integrations tab.

  3. Click New. The New Integration panel opens.

  4. Select the SaaS Application you want to add.

  5. In the Capability drop-down, select SaaS Posture.

  6. Add the details created during step one:

    • Instance URL: Your instance URL, for example, https://yourcompany.service-now.com

    • User Name: The integration user's User ID created in Step 1

    • Password: The generated integration user password saved in Step 1

    • Client ID: The OAuth client ID copied in Step 1

    • Client Secret: The OAuth client secret copied in Step 1

  7. Click Save.

The app is visible on the Integrated Apps table with a Connected status.

Related articles