Incidents coming empty to ServiceNow from Prisma Strata Cloud Manager

[Wassif]

I am reaching out to seek assistance with an integration issue we are experiencing between Prisma Strata Cloud Manager and ServiceNow. We have successfully configured an integration between Prisma Strata Cloud Manager and our ServiceNow environment. During testing, we were able to create test incidents in Prisma Strata Cloud Manager and they were successfully transferred to our test ServiceNow environment. However, we have encountered an issue where real incidents are coming empty to our test ServiceNow environment.

We think Field mapping between Prisma Strata Cloud Manager and ServiceNow is the issue. We have been unable to identify the correct field mappings from Prisma to ServiceNow.

We tested every mapping possible and always the same issue of ticket coming empty.

For example this one (Prisma fields in the left) :

Incident ID -> u_incident_id

Code -> u_code

State -> u_status

Category -> u_category

Severity -> u_priority / u_severity

title -> u_short_description / u_title

Primary Impacted Objects -> u_prim_imp_objects *

Child Incidents -> u_child_incs

Parent Incidents -> u_parent_inc

Incident Opened Time -> u_opened

Thank you very much for your attention to this matter. We look forward to your prompt response and assistance. Best regards,

WG 

LINK OF DOCUMENTATION USED: Integrate ServiceNow with Prisma Access (paloaltonetworks.com)

Prisma Access Strata Cloud Manager Cortex Data Lake 

[RSenra]

Hi Wassif,

Based on your current explanation and with the PAN document that you provided, it looks like you have followed the correct steps on configurations. As for field mappings, I do have a list of them, but its gear more towards Prisma Cloud so I don't believe it would be relevant in SCM.

What I would recommend is to open a TAC case with the Prisma Access team in order to troubleshoot this issue as it's not working as expected due to the followed steps listed in Integrate ServiceNow with Prisma Access (paloaltonetworks.com)