AWS Security Hub ServiceNow integration fields mapping

Question

Hello guys,

Is it possible somehow to map AWS 'Account ID' to 'Assignment Group' in ServiceNow when we automatically create an Incident from AWS Security Hub?

So the idea is to use AWS Service Management Connector for ServiceNow and when some finding appears in AWS Security Hub it should create an incident in ServiceNow with predefined 'Assignment Group' mapped to 'Account ID' taken from particular AWS account:
![Enter image description here](/media/postImages/original/IMX7OZZt-MS966Y8dbnpN2Cw)

Here on the screenshot from ServiceNow instead of 'AWS Security Hub' group should be the name of the responsible group based on the  'Account ID' from which 'AWS Security Hub' finding comes from.

Thanks in advance

Answer

Hi there,

I understand that you would like to know whether it is possible to map AWS 'Account ID' to 'Assignment Group' in ServiceNow when automatically creating an Incident from AWS Security Hub.

I would like to kindly request you to create a Technical Support case with AWS Premium Support as this specific use-case would require some investigation on both ends - AWS Security Hub team and ServiceNow - so as to confirm the interaction/behavior of AWS Security Hub and ServiceNow with a predefined 'Assignment Group' mapped to 'Account ID'.

Please do also attach the relevant screenshots to your case for better visibility into your request.

Answer

Hello,

Yes it is possible to assign the assignment group automatically. 
1. Create a mapping table between Assignment Group (sys_user_group) and AWS Account ID in ServiceNow
2. When AWS Service Management Connector is creating an incident, you can create a business rule (onBefore or OnAfter) to lookup the mapping table and assign the Assignment Group to the incident based on the AWS Account ID.

Hope this helps !!

AWS Security Hub <--> ServiceNow integration fields mapping

Relevant content