Chapter 13: ServiceNow Integration for Alert and Case Management

Microsoft Sentinel is a powerful solution for gathering logs, enriching those logs with threat intelligence, and discovering threats across your environment. However, this is only part of the technology stack required to run a Security Operations Center (SOC). When a security alert is raised in Microsoft Sentinel, the SOC may need assistance from several other teams to investigate the issue, mitigate the threat, and remediate any impact caused. There also may be other security alert sources that do not flow through Sentinel and the SOC needs to correlate those alerts with Sentinel alerts before processing all the alerts in one location. Organizations require a solution to bridge these people and technologies together.

There are multiple solutions available for this bridging of SOC technologies and processes, with JIRA, ZenDesk, and ServiceNow being among the more commonly utilized solutions.

This chapter will...