Bi-directional incidents sync between Microsoft Sentinel and ServiceNow

[bekfro]

I have installed the Microsoft Sentinel Bi-directional incidents sync between Microsoft Sentinel and ServiceNow.

A few things I'm having an issue with.

• Comments from Sentinel are not displaying in ServiceNow (however ServiceNow work notes are appearing in Sentinel).  I see a business rule with custom mappings, do we need to set comments up in this business rule?
• We have the default Incident filter set to so the tag of "snow" will filter in Incidents.  Not all Sentinel Incidents with this tag are coming into ServiceNow
  
  Here's an example that didn't filter into servcienow:
  
  

  Here's one that did:

  
  
  Any help would be greatly appreciated. 

[rabbanis]

Through this integration, are we creating only incidents in ServiceNow? or any other ITSM we can manage, such as change,request, and problem tickets? 

sorry I am new to this integration we need to implementing in our client environment so 

[iDNS]

@rabbanis , this is a configuration under 'Microsoft Azure Sentinel System Properties ->Table where the Azure Sentinel incidents will be created' but this would ideally be pointed to Incident or Security Incident based on the Integration & your subscription to Security Incident (SIR) Module. 

[rabbanis]

Hello All,

Hi  

we are planning to integarte sentenal to servicenow .

so i go through the above document and servicenow document both are different now 

Azure-Sentinel/Solutions/Servicenow/StoreApp/README.md at master · Azure/Azure-Sentinel · GitHub

https://docs.servicenow.com/bundle/xanadu-security-management/page/product/secops-integration-sir/se...

which document is latest and I ned to follow to complete integration?

so I am stucked in the configuration 

Here name,identity URL and azure resource manger I have doubt what I need to mentioned here

I am getting error once I filled all the details

could you please guide me on this 

Regards

Shaik.Rabbani