Need help mapping MITRE Techniques from Azure Sentinel to map to SIR tactics and Technique

[Pooja P]

Hi Team,

We are building integration between Microsoft Azure sentinel to ServiceNow SIR record. Sentinel has MITRE Technique ID and we want to fetch that ID and map it to Tactics and techniques in SIR record fields.

Please be informed we have Threat Intelligence plugin active in our instance.

Any urgent response will help us.

Thanks,

Pooja

[andy_ojha]

Hi there -- apologies your config seems correct and aligned with the similar posts that folks have made recently.

As others suggested, unfortunately we will want to create a NOW Support Case for this.

You mentioned "Particular Domain" in your first response - did you mean NOW Platform Domain Separation?  I believe that should not be an issue, but worth mentioning on the Support Case you open.

[Pooja P]

@andy_ojha Andy we sorted this MITRE Attack issue by upgrading Integration plugin.

but we are facing one more issue is we want to fetch Site name from sentinel but after upgrade of plugin also we can not see site name in Incident raw even in azure profile mapping we can not see that filed . 

Finally we want to map site name from sentinel to Business Unit of SIR.

Can you please suggest on this .

Thanks,

Pooja

[AJ_UK]

Hi Pooja,

See if note I have put in this post helps. I have got it working without any extra coding:
https://www.servicenow.com/community/secops-forum/auto-technique-extraction-rule-for-azure-sentinel/...

AJ