ServiceNow SIR Action Type Missing from Detection Configuration

The recent update to Elastic 7.12 included a new Connector for ServiceNow SIR creation. I setup the connector and proceeded to implement it as an Action for one of the SIEM Detection rules. However, when I go to select the Action type, the ServiceNow SIR Action is not available.

Is there an extra step that I need to do for this or is it missing from the update?

Thanks everyone!

Hi @BrianD,

The ServiceNow SIR connector is only supported at the moment by Cases. It is in our roadmap to support the connector for Detections and Alerts.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.