AWS Security Hub <--> ServiceNow integration fields mapping

Hi there,

I understand that you would like to know whether it is possible to map AWS 'Account ID' to 'Assignment Group' in ServiceNow when automatically creating an Incident from AWS Security Hub.

I would like to kindly request you to create a Technical Support case with AWS Premium Support as this specific use-case would require some investigation on both ends - AWS Security Hub team and ServiceNow - so as to confirm the interaction/behavior of AWS Security Hub and ServiceNow with a predefined 'Assignment Group' mapped to 'Account ID'.

Please do also attach the relevant screenshots to your case for better visibility into your request.

Hello,

Yes it is possible to assign the assignment group automatically.

1. Create a mapping table between Assignment Group (sys_user_group) and AWS Account ID in ServiceNow
2. When AWS Service Management Connector is creating an incident, you can create a business rule (onBefore or OnAfter) to lookup the mapping table and assign the Assignment Group to the incident based on the AWS Account ID.

Hope this helps !!