question Re: Need help mapping MITRE Techniques from Azure Sentinel to map to SIR tactics and Technique in SecOps forum

Need help mapping MITRE Techniques from Azure Sentinel to map to SIR tactics and Technique

Pooja P — Wed, 12 Mar 2025 08:50:48 GMT

Hi Team,

We are building integration between Microsoft Azure sentinel to ServiceNow SIR record. Sentinel has MITRE Technique ID and we want to fetch that ID and map it to Tactics and techniques in SIR record fields.

Please be informed we have Threat Intelligence plugin active in our instance.

Any urgent response will help us.

Thanks,

Pooja

Re: Need help mapping MITRE Techniques from Azure Sentinel to map to SIR tactics and Technique

andy_ojha — Wed, 12 Mar 2025 12:10:47 GMT

Hi there.

By chance have you opened a ServiceNow Support Case for assistance?

The Store App integration available today, combined with Threat Intelligence (from SIR, not TISC) should do the trick, with a few configuration updates.

After you install the Azure Sentinel for SIR Store App, you may need to update a property that sets what version of the Azure Sentinel Incident API is used. This is because, the default version it is set to use, only pulls MITRE Tactics and not Techniques.

https://learn.microsoft.com/en-us/rest/api/securityinsights/api-versions
https://www.servicenow.com/docs/bundle/yokohama-security-management/page/product/secops-integration-sir/secops-integration-ms-azure-sentinel/task/sentinel-integration-settings.html
The Property in ServiceNow is called "sn_sec_sentinel.sentinel_security_incident_api_version"
- The Default Value is [2021-10-01]
- The Version that has both, MITRE Techniques and Tactics would be [2024-03-01] (or later)

Then you would ensure you have the MITRE Technique Exraction Rule feature setup for Azure Sentinel

https://www.servicenow.com/docs/bundle/yokohama-security-management/page/product/secops-integration-threat-security-center/task/mitre-extraction-rules.html
This will parse out the MITRE Tactics and Techniques from the raw import payload table (Sentinel) and incoming field we choose (e.g. properties(additionalData(tactics))).

Re: Need help mapping MITRE Techniques from Azure Sentinel to map to SIR tactics and Technique

Pooja P — Wed, 12 Mar 2025 13:01:02 GMT

Hi @andy_ojha ,

Thank you for the reply , we have already configured Integration between Sentinel and SIR in servicenow. Kindly correct me if my steps to be flowed for further is

1. Update the version of system property "sentinel_security_incident_api_version".

2. Create Extraction rule as attached in screenshot.

Please be informed our Integration configuration and Azure profiles are in Particular domain.

are these steps enough or do we need to write any BR to map technique and tactics?

Kindly suggest. Thanks in advance!

Regards,

Pooja

Re: Need help mapping MITRE Techniques from Azure Sentinel to map to SIR tactics and Technique

andy_ojha — Wed, 12 Mar 2025 13:48:31 GMT

Hey there - that should work.

You may need to test that Extraction Rule (SIEM, with that Field Incident Raw). Another object/field that may work (based on your testing) is -> `properties(additionalData(tactics))` ...if `IncidentRaw` does not work.

Re: Need help mapping MITRE Techniques from Azure Sentinel to map to SIR tactics and Technique

Pooja P — Mon, 17 Mar 2025 10:17:08 GMT

Hi @andy_ojha ,

After updating version below is the payload for technique and tactics

properties(additionalData(tactics))":{"value":"Persistence"},"properties(additionalData(techniques))":{"value":"T1078, T1098"},"

properties(additionalData(tactics))":{"value":"DefenseEvasion"},"properties(additionalData(techniques))":{"value":"T1562"}

But with extraction rule written as suggested are not updating SIR record field values for MITRE Technique and tactic.

Can you please suggest how can we update these SIR fields with provided payload.

Thanks in advance!

Pooja

Re: Need help mapping MITRE Techniques from Azure Sentinel to map to SIR tactics and Technique

andy_ojha — Thu, 20 Mar 2025 01:02:24 GMT

Hi there -- apologies your config seems correct and aligned with the similar posts that folks have made recently.

As others suggested, unfortunately we will want to create a NOW Support Case for this.

You mentioned "Particular Domain" in your first response - did you mean NOW Platform Domain Separation? I believe that should not be an issue, but worth mentioning on the Support Case you open.

Re: Need help mapping MITRE Techniques from Azure Sentinel to map to SIR tactics and Technique

Pooja P — Thu, 20 Mar 2025 11:19:03 GMT

@andy_ojha Andy we sorted this MITRE Attack issue by upgrading Integration plugin.

but we are facing one more issue is we want to fetch Site name from sentinel but after upgrade of plugin also we can not see site name in Incident raw even in azure profile mapping we can not see that filed .

Finally we want to map site name from sentinel to Business Unit of SIR.

Can you please suggest on this .

Thanks,

Pooja

Re: Need help mapping MITRE Techniques from Azure Sentinel to map to SIR tactics and Technique

AJ_UK — Fri, 02 May 2025 13:44:29 GMT

Hi Pooja,

See if note I have put in this post helps. I have got it working without any extra coding:
https://www.servicenow.com/community/secops-forum/auto-technique-extraction-rule-for-azure-sentinel/m-p/2843446/thread-id/11289