Security Incident "Severity" and "Priority" calculation method

[Saravanan Kris1]

Dear All,

When we push the offense from QRadar to ServiceNow "Severity" and "Priority" fields are auto-populated. I would like to know how is it done within QRadar including logic for systemic process & manual and then followed by what happens on ServiceNow side. 

Can anyone help me on this.

Regards

Saravanan K

[amaradiswamy · Accepted solution]

Hi Sarvanan,

We can define the field mappings when we are configuring QRadar custom application in servicenow.

https://docs.servicenow.com/bundle/istanbul-security-management/page/product/qradar-integration/task...

For the security incidents, severity will be calculated if we define any matching severity calculators.

https://docs.servicenow.com/bundle/geneva-security-management/page/product/planning_and_policy/conce...