IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  SNOW Integration - Configuration Item Field Update

    Posted Wed March 20, 2024 03:51 PM

    Hi Team,

    We have setup SOAR-SNOW Integration using the package "ServiceNow Functions for IBM SOAR":
    https://exchange.xforce.ibmcloud.com/hub/extension/60d9d260cdbc40047309fc6132a57035

    We are able to create SIR record successfully with the help of function "SNOW: Create Record".

    Can we utilize below optional fields code to update "Configuration Item" field of SNOW record. If yes, please guide.

    inputs.sn_optional_fields = dumps({
    "short_description": f"RES-{incident.id,}: {incident.name}",
    "priority": sn_severity_map[incident.severity_code],
    "assignment_group": playbook.functions.results.assignment_group.get("sys_id"),
    "caller_id": playbook.functions.results.caller_id.get("sys_id")
    })

    Thanks in advance.



    ------------------------------
    Arpit Nama
    ------------------------------


  • 2.  RE: SNOW Integration - Configuration Item Field Update

    Posted Thu March 21, 2024 08:37 AM

    Hi Arpit -

    Yes, you can update any field in ServiceNow through the sn_optional_fields input option to the function "SNOW: Create Record".

    You'll need to find the API name of "Configuration Item" in ServiceNow and then add that in to the dictionary that you pasted in your question above.



    ------------------------------
    Bo Bleckel
    ------------------------------

    Original Message


  • 3.  RE: SNOW Integration - Configuration Item Field Update

    Posted Thu March 21, 2024 10:13 AM
    Edited by Arpit Nama Thu March 21, 2024 10:13 AM

    Yes, this is the expectation and tried below combinations but no luck.

    option 1: "cmdb_ci": "Hostname",

    option 2: "cmdb_ci": "sys id of hostname",

    Could you please guide further?



    ------------------------------
    Arpit Nama
    ------------------------------

    Original Message


  • 4.  RE: SNOW Integration - Configuration Item Field Update

    Posted Thu March 21, 2024 10:25 AM

    The most guidance I can give is that you can only set values of the incident by field api names, not generic values in ServiceNow. See https://ibmresilient.github.io/resilient-community-apps/fn_service_now/docs/customize_resilient_guide/README.html#function-snow-create-record (expand the inputs section) to get more details.



    ------------------------------
    Bo Bleckel
    ------------------------------

    Original Message


Related Content