Bi-directional incidents sync between Microsoft Sentinel and ServiceNow

[bekfro]

I have installed the Microsoft Sentinel Bi-directional incidents sync between Microsoft Sentinel and ServiceNow.

A few things I'm having an issue with.

• Comments from Sentinel are not displaying in ServiceNow (however ServiceNow work notes are appearing in Sentinel).  I see a business rule with custom mappings, do we need to set comments up in this business rule?
• We have the default Incident filter set to so the tag of "snow" will filter in Incidents.  Not all Sentinel Incidents with this tag are coming into ServiceNow
  
  Here's an example that didn't filter into servcienow:
  
  

  Here's one that did:

  
  
  Any help would be greatly appreciated. 

[Prabu Velayutha · Accepted solution]

@bekfro  

The application uses the following business rules:

• add_work_note_to_sentinel: sycnhronizes work notes to sentinel comments can you verify the configuration as shown in the screenshot below
• 

  information source: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-introducing-microsoft-sent... 

If my response helps to solve your issue kindly mark it as helpful & correct.

[bekfro]

Thanks, @Prabu Velayutha the ServiceNow work notes going to sentinel are working as they should with this business rule.  It's the comments in Sentinel not coming into ServiceNow that I'm having an issue with. 

[Mayuri12]

@bekfro  I am facing the same issue; did you find any solution on this?

[Devi]

Hi,

Can anyone please explain what are all the licenses/Applications needs to purchase for this integration as we are planning to develop the integration