We have integrated the Azure Sentinel with ServiceNow for Security Incident creation, and it also passes the Tactic and Technique information.
We have enabled the MITRE ATT&CK matrice (Enterprise) and the associated techniques, however, this is only working manually and we would like to populate this information automatically when a SIR is created. We understand that this auto extraction of this information is no longer supported via Incident Profile and we need to create a technique extraction rule. When I created a new extraction rule for Sentinel, we set the Import Table as "Azure Sentinel Incident Import" & Import field as "Incident Raw", Ideally as per the documentation this is good enough to auto populate the MITRE framework in a security incident. However, this is not working as I tried different combinations of import field. Does anybody have relevant experience with auto extracting the MITRE data from Sentinel to ServiceNow SIR?
P.S - I have unchecked the "Ignore auto extraction" option in the extraction rule and enabled auto rollup MITRE information from the alert rules to security incidents.
