Presentation on integration between artic wolf and service now

[kushagra agarwa]

Hello,

Did anyone have presentation on integration between artic wolf and service now

[Mark Manders]

Maybe use AI to generate a presentation from this site: https://docs.arcticwolf.com/bundle/m_itsm_integrations/page/configure_servicenow_to_integrate_with_a...

[Vishal36]

Hi @kushagra agarwa, 

Artic Wolf and ServiceNow integrations are definitely gaining interest — especially for teams looking to streamline incident response, threat alerts, or ticket automation from a SOC (Security Operations Center) environment into ServiceNow. However, a few things to consider before you start:

• What type of alerts or incidents do you want to flow into ServiceNow — should it be based on type, severity, or certain playbooks? Are you using ServiceNow SecOps, or would this flow into ITSM or another module?
• Do you need one-way alerting, or should the integration allow for updates back to Arctic Wolf once an incident is resolved or escalated?
• Will the integration need to support attachments, comments, or analyst notes between the systems?

You may consider OpsHub Integration Manager (Atlassian Solutions and ServiceNow Partner)— a trusted integration platform used by teams needing real-time, bi-directional sync with ServiceNow. It helps preserve full context across systems (like alerts, comments, users, and status) and runs seamlessly, without requiring plugins or code changes to either tool.

Hope it helps!

[RMendoza]

Hello

I'd like that presentation as well if it's available.  Our agency is getting ready to do the integration.

[Dlam]

We have been testing it in our sub-prod instance since July but it is not been smooth.

Has any sites experienced the following when configuring ServiceNow and Arctic Wolf integration?

The attachment is not synced either way, from ServiceNow to AW or AW to ServiceNow, where The Error Message says "An internal Arctic Wolf error occurred".

After meeting both ServiceNow support and Arctic Wolf Engineers in one Zoom call, it was identified one of two Business Rules in the updated set provided by AW does not trigger any outbound call. Now Support case has been closed because this a third-party BR and AW has escalated it to their development team so no progress on attachment syncing so far.

I then identified another two ACLs which were created via the same update set to restrict read operation on sys_user_group and sys_user_group.* to the new role AWN Integration Role. As a result, any non-admin users do not see the assignment_group field on any of the task related forms: sc_req_item, incident, change_request etc.

There have been some initial validation issues too where it requires a new role snc_basic_auth_api_access, which was resolved with the assistance of Now support engineer.