I am using version 1.22 of the ServiceNow Security Operations app on Splunk 6.5.3. I want to use the snsecincident command in a search in order to customize some of the incident properties that can't be customized within the Create ServiceNow Security Incident Alert Action. Then I want to schedule that search as an Splunk Alert. However when I attempt to use either of the snsecevent or snsecincident manual search commands, I get the error This command must be the first command of a search.
Am I misunderstanding the documentation? Shouldn't I be able to pass the fields from a search to these commands?
Finally, if you have access, you could try script execution of the TA_ServiceNow_SecOps/bin/sn_sec_event.py per the commands.conf mapping. The relevant parameters are passed into a datamap and then to the SNOW REST API
NB: sn_sec_event_alert.py maps to the actions specified in the alert_actions.conf file, which aligns with the GUI fields in the Security Operations Integration add-on. Hope that helps.
Sorry, I never got to the bottom of this. I am limited to customizing the fields of the the custom alert actions that are built into the app. I don't recall what specific things I wanted to customize at the time I posted it.