ServiceNow Integration (part 2)

 

To read part 1, please click here

Adding Dynamic Content

Now, to enter the values into the fields, we will add the dynamic content provided by the previous actions in the first stage. You can use the following table to fill the fields:

Field	Value
Short description	Text: Sentinel Incident #           Dynamic content: Number from the incident           Text: -           Dynamic content: Title from the incident
Description	Description from the incident
Secure notes	Entities from the alert

After filling those fields, the addition of the dynamic content will be completed.

Adding Static Content

Now you can fill the drop-down entries in ServiceNow by simply correcting the text to be passed through which always matches a value in the respective drop-down list. You can use the following values for filling the hardcode values while making sure the text entered matches exactly:

Field	Value
Priority	2 - High
Business impact	2 - High
Subcategory	Inbound Dos
Risk score override	True
Score	SIEM
Category	Denial of Service

 After filling these fields, the static content is ready to go.

Adding an Expression

Now you can also enter an expression and assuming that you have worked with Microsoft Excel formulas, you will be familiar with logic app expressions as they are almost same. Azure Logic Apps contains easy ways to create these formulas and the following steps can be used to complete the process:

• You can click on the Risk score or press the Expression tab for Dynamic content popup.
• If you want feed a dynamic value, you can readily move back to the Dynamic content tab and search as well as select the value, while you can switch back to the Expression tab to add more expressions.
• There is also an if statement embedded inside another if statement as well as two equal expressions.
• Lastly, you have to modify the Add comment to incident (V2) (Preview) rule in order to add the ServiceNow number to your Microsoft Sentinel incident. 

 Now your playbook is complete and you can allot it to an Microsoft Sentinel analytics scheduled rule.

To read part 1, please click here