How to set an Incident to automatically assign to a specific support group

[Donna12]

I could be in the wrong topic, please let me know where I should be if that is the case.

I am not a developer:

Sentinel One creates an incident which automatically creates a ticket in SN and the ticket gets assigned to the Service Desk automatically.  We need it be assigned to our security support team instead.  How do I do that? 

Our current setup :When an Azure Sentinel incident is generated, the logic app will connect to ServiceNow and open an incident

Thank you

[Ankur Bawiskar · Accepted solution]

Hi,

you can use Assignment rule to set the group

1) navigate to sysrule_assignment.LIST

2) create new

3) set filter conditions

4) select table as incident

5) select the group in Applies to

Regards
Ankur

[FalguniN]

It works 🙂

[Saurav11]

Hello,

Do you have the admin role? If not it would be difficult to make changes.

But if you have you need to first check why is the assignment group set as Service Desk. Is it the default value or are they sending this value when creating on their end.

Once we have knowledge of that it would be easier to decide the approach on how we can do this.

Please mark answer correct/helpful based on Impact