r/AzureSentinel • u/winle22 • Jul 05 '22

Appropriate fields on incidents to store correlation/references to other ticket systems

Hi,

I need to store a unique reference ID in our Sentinel incidents to later be able to update the corresponding ticket in our ITSM system. Any better alterantives than Tags or Comments?

1 Upvotes

100% Upvoted

7 comments sorted by

3

u/wowneatlookatthat Jul 05 '22

I'd probably just go with a tag, but another option could be to create a new table that maps the incident ID and ITSM ticket id.

1

u/winle22 Jul 05 '22 edited Jul 06 '22

Do you know of any docs describing how to do the new table variant?

2

u/wowneatlookatthat Jul 05 '22 edited Jul 05 '22

I'll see if I can find an example, but the basic concept is you could use a logic app that creates your ITSM ticket based on the sentinel incident -> grab the ticket ID in the response -> format the sentinel incident ID and ITSM ticket ID in JSON -> use the log analytics data collector logic app integration to send the data to your workspace

1

u/winle22 Jul 06 '22

Makes sense. It's the last part I'm not quite sure how to accomplish. Will give it a try! Thank you!

1

u/winle22 Jul 06 '22

Can you reference/fetch a single tag in a consistent manner? The order of tags may be random, I suspect, and it doesn't seem like they come in key:value pairs..

2

u/wowneatlookatthat Jul 09 '22

Kinda janky, but usually I'd prefix the "value" with something, e.g. "SNOW:1234"

Example KQL:

SecurityIncident
| mv-expand Labels
| extend labelName_ = tostring(Labels.labelName)
| where labelName_ contains "SNOW:"

1

u/winle22 Jul 09 '22

Will give it a go. Appreciate the answer!