Creating a playbook to trigger a ticket in ServiceNow

We have already covered what an Azure Sentinel playbook is, and how to create one, in Chapter 11, Creating Playbooks and Logic Apps. As a quick refresher, a playbook is a set of logical steps that are taken to perform an action. These are also referred to as workflows in other applications. Playbooks use Azure Logic Apps technology; the only difference is that a playbook must use the Azure Sentinel connector's trigger. After that, you are able to use any of the many actions that are provided by Azure Logic Apps.

We are going to take this one step further in this section and explain how to use a playbook to create a ServiceNow Security Incident Response (SIR) incident. If you do not already have the SIR module loaded in your ServiceNow environment, follow the instructions located at https://docs.servicenow.com/csh?topicname=t_ActivateSecurityIncidentResponse.html&version=kingstonsecurity.

Note

While this section...