Sentinel to ServiceNow work notes updates are not working

[Sofiya Perumal]

Hi Team,

I am inbetween integration microsoft sentinel with Servicenow. All working good except the work note part. The worknotes of Sentinel is not getting updated in ServiceNow. Do i need to customize anything in Scheduled job script. However, servicenow to sentinel updates are working fine.

Regards,

Sofiya

[Bhuvan]

@Sofiya Perumal 

Please check below thread 

https://www.servicenow.com/community/itsm-forum/bi-directional-incidents-sync-between-microsoft-sent...

In your Azure mapping, check work notes mapping is configured correctly and as per below documentation

https://www.servicenow.com/docs/bundle/zurich-security-management/page/product/secops-integration-si...

As per documentation, 'Synchronization of Microsoft Azure Sentinel incident comments with SIR Work notes' is supported out of box, check your configuration

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1209714

If this helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan

[kaushal_snow]

Hi @Sofiya Perumal ,

Ensure that the bi-directional integration between Microsoft Sentinel and ServiceNow is correctly configured. This includes confirming that the necessary roles and permissions are assigned, and that the integration settings are properly set up... and once completed review the business rules associated with the integration. Specifically, verify that the business rule responsible for synchronizing work notes from Sentinel to ServiceNow is active and correctly configured, try checking the conditions and actions defined within the rule....

If you found my response helpful, please mark it as ‘Accept as Solution’ and ‘Helpful’. This helps other community members find the right answer more easily and supports the community.