Microsoft Defender for Cloud
Cloud and workloadsCreate a Ticket in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn
In brief
The article updates wording, formatting, and step instructions, including clearer prerequisites, assignment fields, and supported ticket types. The assignment screenshot was also repositioned.
What Defender admins need to know
Administrators can use the clearer instructions when creating ServiceNow tickets; no configuration change is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Create a ticketTicket in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn
The integration between Defender for Cloud withand ServiceNow's IT Service Management (ITSM) module,module allows Defender for Cloud customers to create tickets in Defender for Cloud that connect to a ServiceNow account. ServiceNow tickets are then linked directly to recommendations in Defender for Cloud. When a ticket is connected to a recommendation, the two platforms can facilitate efficient incident management and resolution.
Prerequisites
Before you create tickets in ServiceNow, make sureensure you meet the following prerequisites are met:requirements:
Have anAn application registry in ServiceNow.EnableDefender Cloud Security Posture Management (CSPM) enabled on your Azure subscription.The following
roles are required:roles:- To create an assignment: Admin permissions to ServiceNow.
Create a new ticket based on a recommendation to ServiceNow
Security adminsadministrators can create and assign tickets directly from the Defender for Cloud portal.
Sign in to the Azure portal.
NavigateGo to Microsoft Defender for Cloud > Recommendations.Select a recommendation you want to create a ServiceNow ticket for, and assign an owner to.
Select View recommendation for all resources.
Expand the Affected resources section.
In Unhealthy
resources,resources, select the relevant resource, and then select Assign owner.
In theFor Typefield,, select ServiceNow.
Select the integration instance.
Select the ticket type.
Note
In ServiceNow, there are several types of tickets that you can
be useduse to manage and track different types of incidents, requests, and tasks.OnlyDefender for Cloud and ServiceNow ITSM integration supports only incident, change request, and problem tickettypes are supported with the Defender for Cloud and ServiceNow ITSM integration.Expand the
assignmentAssignment details section.Complete the following fields:
Assigned to:
ChooseSelect an owner for theowner whom you would like to assign the affected recommendation to.recommendation.Caller:
RepresentsSpecify the user defining the assignment.Description and Short Description: Enter a
description,description and short description.RemediationSet remediation timeframe: Select the remediation timeframe.Apply
Grace Periodgrace period: (Optional)applyApply a grace period.Set
Email Notificationsemail notifications: (Optional) You can send a reminder to the owners or theowner’owner's direct manager.
Select Create.
After you create the assignment is created,assignment, the Ticket ID assigned to this affected resource will appearappears next to the resource in the recommendation. The Ticket ID represents the ticket created in the ServiceNow portal. You can select the Ticket ID to navigatego to the newly created incident in the ServiceNow portal.
Note
\ No newline at end of file
When you delete the Defender for Cloud–ServiceNow integration instance is deleted,instance, all associated assignments are also deleted. Deletion can take up to 24 hrs.
\ No newline at end of filehours.
\ No newline at end of file
@@ -1,6 +1,6 @@ --- layout: Conceptual-title: Create a ticket in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn+title: Create a Ticket in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/azure/defender-for-cloud/create-ticket-servicenow breadcrumb_path: /azure/breadcrumb/defender-for-cloud/toc.json feedback_help_link_url: https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud@@ -39,58 +39,58 @@ spProducts: platformId: f63d2baf-df0e-73d0-3cbe-403e08ce6d5e --- -# Create a ticket in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn+# Create a Ticket in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn -The integration between Defender for Cloud with ServiceNow's IT Service Management (ITSM) module, allows Defender for Cloud customers to create tickets in Defender for Cloud that connect to a ServiceNow account. ServiceNow tickets are then linked directly to recommendations in Defender for Cloud. When a ticket is connected to a recommendation, the two platforms can facilitate efficient incident management and resolution.
+The integration between Defender for Cloud and ServiceNow's IT Service Management (ITSM) module allows Defender for Cloud customers to create tickets in Defender for Cloud that connect to a ServiceNow account. When a ticket is connected to a recommendation, the two platforms can facilitate efficient incident management and resolution.
## Prerequisites
-Before you create tickets in ServiceNow, make sure the following prerequisites are met:
+Before you create tickets in ServiceNow, ensure you meet the following requirements:
-- Have an [application registry in ServiceNow](https://www.opslogix.com/knowledgebase/servicenow/kb-create-a-servicenow-api-key-and-secret-for-the-scom-servicenow-incident-connector).
-- Enable [Defender Cloud Security Posture Management (CSPM)](tutorial-enable-cspm-plan) on your Azure subscription.
-- The following roles are required:
+- An [application registry in ServiceNow](https://www.opslogix.com/knowledgebase/servicenow/kb-create-a-servicenow-api-key-and-secret-for-the-scom-servicenow-incident-connector).
+- [Defender Cloud Security Posture Management (CSPM)](tutorial-enable-cspm-plan) enabled on your Azure subscription.
+- The following roles:
- To create an assignment: Admin permissions to ServiceNow.
## Create a new ticket based on a recommendation to ServiceNow
-Security admins can create and assign tickets directly from the Defender for Cloud portal.
+Security administrators can create and assign tickets directly from the Defender for Cloud portal.
1. Sign in to [the Azure portal](https://aka.ms/integrations).
-2. Navigate to **Microsoft Defender for Cloud** > **Recommendations**.
+2. Go to **Microsoft Defender for Cloud** > **Recommendations**.
3. Select a recommendation you want to create a ServiceNow ticket for, and assign an owner to.
4. Select **View recommendation for all resources**.
-5. Expand the Affected resources section.
-6. In Unhealthy resources, select the relevant resource, and then select **Assign owner**.
+5. Expand the **Affected resources** section.
+6. In **Unhealthy resources**, select the relevant resource, and then select **Assign owner**.
[](media/create-ticket-servicenow/create-assignment.png#lightbox)
-7. In the Type field, select **ServiceNow**.
+7. For **Type**, select **ServiceNow**.
8. Select the integration instance.
9. Select the ticket type.
- Note
+ 
- In ServiceNow, there are several types of tickets that can be used to manage and track different types of incidents, requests, and tasks. Only incident, change request, and problem ticket types are supported with the Defender for Cloud and ServiceNow ITSM integration.
+ Note
- 
-10. Expand the assignment details section.
+ In ServiceNow, there are several types of tickets that you can use to manage and track different types of incidents, requests, and tasks. Defender for Cloud and ServiceNow ITSM integration supports only incident, change request, and problem ticket types.
+10. Expand the **Assignment details** section.
11. Complete the following fields:
- - **Assigned to**: Choose the owner whom you would like to assign the affected recommendation to.
- - **Caller**: Represents the user defining the assignment.
- - **Description and Short Description**: Enter a description, and short description.
- - **Remediation timeframe**: Select the remediation timeframe.
- - **Apply Grace Period**: (Optional) apply a grace period.
- - **Set Email Notifications**: (Optional) You can send a reminder to the owners or the owner’s direct manager.
+ - **Assigned to**: Select an owner for the recommendation.
+ - **Caller**: Specify the user defining the assignment.
+ - **Description and Short Description**: Enter a description and short description.
+ - **Set remediation timeframe**: Select the remediation timeframe.
+ - **Apply grace period**: (Optional) Apply a grace period.
+ - **Set email notifications**: (Optional) You can send a reminder to the owners or the owner's direct manager.
12. Select **Create**.
-After the assignment is created, the Ticket ID assigned to this affected resource will appear next to the resource in the recommendation. The Ticket ID represents the ticket created in the ServiceNow portal. You can select the Ticket ID to navigate to the newly created incident in the ServiceNow portal.
+After you create the assignment, the Ticket ID assigned to this affected resource appears next to the resource in the recommendation. The Ticket ID represents the ticket created in the ServiceNow portal. You can select the Ticket ID to go to the newly created incident in the ServiceNow portal.
Note
-When the Defender for Cloud–ServiceNow integration instance is deleted, all associated assignments are also deleted. Deletion can take up to 24 hrs.\ No newline at end of file+When you delete the Defender for Cloud–ServiceNow integration instance, all associated assignments are deleted. Deletion can take up to 24 hours.\ No newline at end of file