ServiceNow Unauthorized Queries

Ankit Mehta@Secvyn

•updated Jun 15, 2026•3•0•9

This rule detects queries made within ServiceNow by accounts classified as 'Guest' or 'Unknown'. This could indicate unauthorized access or unusual activity from unprivileged or unidentifiable accounts attempting to query data within the ServiceNow environment.