SOLVED

Azure Sentinel Playbook "User authentication failure" for Service Now integration

%3CLINGO-SUB%20id%3D%22lingo-sub-2947099%22%20slang%3D%22en-US%22%3EAzure%20Sentinel%20Playbook%20%22User%20authentication%20failure%22%20for%20Service%20Now%20integration%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2947099%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20using%20basic%20Logicapp%20to%20create%20incidents%20in%20Service%20Now.%20I%20have%20applied%20the%20correct%20username%20and%20password%20and%20getting%20the%20error%20below.%20If%20however%2C%20i%20directly%20visit%20the%20service%20now%20URL%20using%20the%20credentials%2C%20its%20logging%20in%20successfully.%20Any%20idea%20%2C%20why%20the%20error%20is%20occurring%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22FahadAhmed_0-1636539178192.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F325943i9585D472E74E9829%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22FahadAhmed_0-1636539178192.png%22%20alt%3D%22FahadAhmed_0-1636539178192.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3EFahad.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2947533%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20Playbook%20%22User%20authentication%20failure%22%20for%20Service%20Now%20integration%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2947533%22%20slang%3D%22en-US%22%3EService%20Now%20has%20an%20add-in%20that%20allows%20for%20incidents%20to%20be%20created%20directly%20from%20Microsoft%20Sentinel%20without%20the%20need%20for%20a%20logic%20app%20now.%20May%20be%20worth%20looking%20into%20that.%3C%2FLINGO-BODY%3E
Contributor

Hello,

 

I am using basic Logicapp to create incidents in Service Now. I have applied the correct username and password and getting the error below. If however, i directly visit the service now URL using the credentials, its logging in successfully. Any idea , why the error is occurring?

 

FahadAhmed_0-1636539178192.png

 

Thanks

Fahad.

 

4 Replies
best response confirmed by FahadAhmed (Contributor)
Solution
Service Now has an add-in that allows for incidents to be created directly from Microsoft Sentinel without the need for a logic app now. May be worth looking into that.
@Gary Thanks for the prompt response, can you share the link for the Service Now addin, as I am unable to find it. Most blogs are on logicapp connectivity of sentinel through service now, it would be great if we could use the Service Now addin as you mentioned. Any pointers will be helpful.

Thanks
Ok I found it, sharing the link below for the benefit of all.

https://docs.servicenow.com/bundle/rome-security-management/page/product/secops-integration-sir/seco...

Thanks gary for the help though.

Thanks
Fahad.
By the way the customer doesnt want to install the Service Now addon and wishes to use Logicapp, I got pass through the authentication error that was posted earlier, but now i am getting the below error.

Please check your account info and/or permissions and try again. Details: Non-json response More diagnostic information: x-ms-client-request-id is 'A09524C0-90E3-43A4-95AF-A3D493AACD2F'

Any reason why this is happening?