Hi Guys,
Hope you all the doing good.
I have recently started to use Splunk ES and i am trying to create security incidents in ServiceNow for notables. I am using ServiceNow Security Operations Integration addon for this and i have created a workflow action to create incident. I am using below search in the workflow action but i am not able to create any incidents. Please let me know if i am missing any thing.
Thanks in advance.
| expandtoken rule_title rule_description drilldown_searches
| fields title rule_description src dest user file_path file_hash file_name _time source severity event_hash
| eval src=coalesce(src, src_ip), dest = coalesce(dest, dest_ip)
| fillnull value=N/A dvc src dest user file_path file_hash file_name
| eval external_link = xyz
| eval md5_hash = if(file_hash == "N/A", "N/A", if(len(file_hash) == 32, file_hash, "N/A"))
| eval sha256_hash = if(file_hash == "N/A", "N/A", if(len(file_hash) == 64, file_hash, "N/A"))
| eval snow_event_ts = strftime(_time, "%m-%d-%Y %H:%M:%S")
| eval severity = case(severity=="informational", 0, severity=="low", 4, severity=="medium", 3, severity=="high", 2, severity=="critical", 1)
| eval ticket_contents = "short_description \"".title."\""
| eval ticket_contents = ticket_contents." assignment_group \"ABC\""
| eval ticket_contents = ticket_contents." contact_type \"SIEM\""
| eval ticket_contents = ticket_contents." description \"".rule_description."\""
| eval ticket_contents = ticket_contents." source_ip \"".src."\""
| eval ticket_contents = ticket_contents." dest_ip \"".dest."\""
| eval ticket_contents = ticket_contents." u_offence_id \"".event_hash."\""
| eval ticket_contents = ticket_contents." u_source \"".src."\""
| eval ticket_contents = ticket_contents." u_destination \"".dest."\""
| eval ticket_contents = ticket_contents." u_md5_hash \"".md5_hash."\""
| eval ticket_contents = ticket_contents." u_sha256_hash \"".sha256_hash."\""
| eval ticket_contents = ticket_contents." u_event_timestamp \"".snow_event_ts."\""
| eval ticket_contents = ticket_contents." u_event_name \"".source."\""
| eval ticket_contents = ticket_contents." severity \"".severity."\""
| return $ticket_contents
