CODEWITHSUNDEEP
azureazure-logic-appsservicenowetagazure-sentinel
Louis Preston Thornton III
Louis Preston Thornton III

Reputation: 382

Integration issues with Microsoft Sentinel and ServiceNow and Get Etag

Working on the Microsoft Sentinel to ServiceNow integration as documented in Microsoft Azure to ServiceNow Article. I am running into an issue

 InvalidTemplate. Unable to process template language expressions in action 'GEt_incident_-_bring_fresh_Etag' inputs at line '0' and column '0': 'The template language expression 'body('Parse_JSON_2')?['value']?[0]['SubId']' cannot be evaluated because property 'SubId' cannot be selected. Please see https://aka.ms/logicexpressions for usage details.'.

I have been trying to break this down as to what the message is saying, particularly in this piece,

The template language expression 'body('Parse_JSON_2')?['value']?[0]['SubId']' cannot be evaluated because property 'SubId' cannot be selected. Or more so this, The template language expression XXX cannot be evaluated because property 'SubId' cannot be selected.

Is the "cannot be selected," indicating that there is a permission problem? I am using the system identity

enter image description here

enter image description here

Where the roles are assigned are

enter image description here

I am open to considering any thoughts or ideas.

Upvotes: 0

Views: 822

Answers (1)

Ken W - Zero Networks
Ken W - Zero Networks

Reputation: 3814

Did you see the post deployments steps on Github? The state you need to grant Sentinel Reader role to the managed identity.

https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Create-SNOW-record#post-deployment

Upvotes: 0

Related Questions