To have the ITSM App or SecOps App automatically create ServiceNow ITSM Incidents or ServiceNow Security Incidents when Alerts are ingested, you must configure a profile. The automatic incident creation is based on Incident Creation and Alert Aggregation settings.

See:

If the Apply Incident Creation checkbox is selected, the app automatically creates an Incident based on the specified Incident Creation and Alert Aggregation settings. If you have provided any conditions for Alert Aggregation, the app creates an Incident and links alerts in the Incident based on Alert Aggregation conditions.

Alert fields are mapped to Incident fields based on the saved profile in the Field Mapping of the Configuration Profile. See Configure Alert Field Mapping for ITSM and SecOps Apps.