ServiceNow Securlet Not Populating User for Activity

Products

• CASB Securlet SAAS
• CASB Security Advanced
• CASB Security Premium

Issue/Introduction

ServiceNow Securlet is not consistently populating the actual ServiceNow user who performed the activity.  User is listed as "System".

Cause

Possible cause is that the user's domain was not included as a primary or secondary domain for the CloudSOC tenant.

Resolution

Add the user's domain to the tenant in the Cloud Management Portal.  Steps on how to do this can be found in the following article:

How to manage secondary domains in CloudSOC