Create a ticket in Defender for Cloud

The integration between Defender for Cloud and ServiceNow's IT Service Management (ITSM) module allows Defender for Cloud customers to create tickets in Defender for Cloud that connect to a ServiceNow account. When a ticket is connected to a recommendation, the two platforms can facilitate efficient incident management and resolution.

Prerequisites

Before you create tickets in ServiceNow, ensure you meet the following requirements:

• An application registry in ServiceNow.

• Defender Cloud Security Posture Management (CSPM) enabled on your Azure subscription.

• The following roles:

  • To create an assignment: Admin permissions to ServiceNow.

Create a new ticket based on a recommendation to ServiceNow

Security administrators can create and assign tickets directly from the Defender for Cloud portal.

1. Sign in to the Azure portal.

2. Go to Microsoft Defender for Cloud > Recommendations.

3. Select a recommendation you want to create a ServiceNow ticket for, and assign an owner to.

4. Select View recommendation for all resources.

5. Expand the Affected resources section.

6. In Unhealthy resources, select the relevant resource, and then select Assign owner.

   

7. For Type, select ServiceNow.

   

8. Select the integration instance.

9. Select the ticket type.

   

   Note

   In ServiceNow, there are several types of tickets that you can use to manage and track different types of incidents, requests, and tasks. Defender for Cloud and ServiceNow ITSM integration supports only incident, change request, and problem ticket types.

10. Expand the Assignment details section.

11. Complete the following fields:

    • Assigned to: Select an owner for the recommendation.

    • Caller: Specify the user defining the assignment.

    • Description and Short Description: Enter a description and short description.

    • Set remediation timeframe: Select the remediation timeframe.

    • Apply grace period: (Optional) Apply a grace period.

    • Set email notifications: (Optional) You can send a reminder to the owners or the owner's direct manager.

      

12. Select Create.

After you create the assignment, the Ticket ID assigned to this affected resource appears next to the resource in the recommendation. The Ticket ID represents the ticket created in the ServiceNow portal. You can select the Ticket ID to go to the newly created incident in the ServiceNow portal.

Next step