To map Carbon Black Cloud alert fields to ServiceNow ITSM Incident fields, perform the following procedure.

Continue after Step 6 of Configure Alert Aggregation for ITSM and SecOps Apps (Optional).

All alert fields are available for data mapping except Updated by, Effective Number, Created by, Number, or Risk Change.

Note: To change this configuration after the initial setup, go to VMware Carbon Black Cloud > Configurations and click Field Mapping.

Prerequisites

Create a ServiceNow Configuration Profile

Procedure

  1. To get suggestions for data mapping, click Apply Defaults.
  2. Review the default values.
  3. To change the mappings, configure custom mappings. You can select Incident fields from the dropdown list.
  4. Drag the Carbon Black Cloud alert field and drop it into the desired Incident field in Input Expression.
  5. Select Incident or Security Incident (for ITSM and SecOps Apps respectively) fields from the dropdown list.

    Select Incident or Security Incident fields

  6. Enter input expression values into the text field.
  7. Add or remove incident fields by clicking the + or - buttons, respectively.
  8. Click Next.

What to do next

Configure Scheduling for ITSM and SecOps Apps