Hi there.

By chance have you opened a ServiceNow Support Case for assistance?   

The Store App integration available today, combined with Threat Intelligence (from SIR, not TISC) should do the trick, with a few configuration updates.

After you install the Azure Sentinel for SIR Store App, you may need to update a property that sets what version of the Azure Sentinel Incident API is used.   This is because, the default version it is set to use, only pulls MITRE Tactics and not Techniques.

• https://learn.microsoft.com/en-us/rest/api/securityinsights/api-versions
• https://www.servicenow.com/docs/bundle/yokohama-security-management/page/product/secops-integration-...
• The Property in ServiceNow is called "sn_sec_sentinel.sentinel_security_incident_api_version"
  • The Default Value is [2021-10-01]
  • The Version that has both, MITRE Techniques and Tactics would be [2024-03-01] (or later)

Then you would ensure you have the MITRE Technique Exraction Rule feature setup for Azure Sentinel 

• https://www.servicenow.com/docs/bundle/yokohama-security-management/page/product/secops-integration-...
• This will parse out the MITRE Tactics and Techniques from the raw import payload table (Sentinel) and incoming field we choose (e.g. properties(additionalData(tactics))).