Microsoft 365 security center integation with ServiceNow

Brass Contributor

Hi All 

 

Has anyone done this integration yet? We have just completed the integration setup and are able to create (Manual) incidents, and share Secure score improvement tasks as Change requests from the M365 Security portal. (https://docs.microsoft.com/en-us/microsoft-365/security/mtp/tickets?view=o365-worldwide)

 

I appreciate this is in preview but hope to find more info:

  1. Where can I find the current limitations and roadmap for ServiceNow integration?
    • I.E I'm missing the ability to use an existing Security Portal Incident and associated info to create a ServiceNow Incident. 
    • I can create only a new incident with basic info and priority where I have to input all text manually 
  2. Any other documentation on this topic - Like How to's or what information you can expect to see in the ticket when creating a change record/incidents this way?
  3. Once tickets are created in ServiceNow (Via the security portal) I don't have the permissions to view the detail (in ServiceNow). I appreciate this is a SN issue but is there any knowledge on the appropriate permissions you need when using this integration to view these tickets?
    1. Only our SN Admin can view these tickets.
    2. I can see these tickets in the Security portal just fine..
  4. I am able to create a change ticket as explained in the "Create a task and share it to ServiceNow" section of the documentation in the link I posted above
    • Again I have not been able to view the detail of the Change ticket in ServiceNow in a bid to determine what info were extracted from the security portal and inserted into the change for the same permission issue.

Thanks in advance!

 

 

1 Reply

Hello @Christo De Lange 

 

seems sentinel <--> servicenow is the way forward.

 

the m365 defender --> servicenow is no longer available. were you able to find something further on this?

anuragydv_0-1691552537143.png