Prisma Cloud and Service Now integration

[GVodenitcharov]

We are trying to integrate alerts from Prisma Cloud to Service Now, for example CSPM alerts for NIST 800-53r5 with high and critical severity. The challenge we are having is with configuring and tweaking the Service Now template in Prisma Cloud to have meaningful alert id, finding description, asset description and remediation steps. Does anyone have a default or pre-canned template we can use, instead of picking individual fields and trying to build your own. The challenge is that on Service Now not all fields are populated and having an incident without context is not very useful.

[LMegrelis]

Hello, 

You can view some example notification templates in our documentation on how to configure a SNOW notification template: 

https://docs.prismacloud.io/en/enterprise-edition/content-collections/administration/configure-exter...

Please let me know if you have any additional questions. 

Cheers, 

[GVodenitcharov]

Thanks so much for this article, we have been referring to it.

Our challenge is that building the description by picking fields is quite often hit and miss since it does not provide the full payload of the Alert as seen in Prisma. Is there a pre-canned notification template that we can use instead of having to generate our own? We are noticing that not all fields are populated in SNOW and it makes the integration challenging for a production use case.

[LMegrelis]

Hello, 

This is our Alert payload as an example. 

https://docs.prismacloud.io/en/enterprise-edition/content-collections/alerts/alert-payload