Microsoft Sentinel 和 ServiceNow 以及 Get Etag 的集成问题

Question

Working on the Microsoft Sentinel to ServiceNow integration as documented in Microsoft Azure to ServiceNow Article . I am running into an issue

InvalidTemplate. Unable to process template language expressions in action 'GEt_incident_-_bring_fresh_Etag' inputs at line '0' and column '0': 'The template language expression 'body('Parse_JSON_2')?['value']?[0]['SubId']' cannot be evaluated because property 'SubId' cannot be selected. Please see https://aka.ms/logicexpressions for usage details.'.

I have been trying to break this down as to what the message is saying, particularly in this piece,

The template language expression 'body('Parse_JSON_2')?['value']?[0]['SubId']' cannot be evaluated because property 'SubId' cannot be selected. Or more so this, The template language expression XXX cannot be evaluated because property 'SubId' cannot be selected.

Is the "cannot be selected," indicating that there is a permission problem? I am using the system identity

Where the roles are assigned are

I am open to considering any thoughts or ideas.

Answer 1

Did you see the post deployments steps on Github? The state you need to grant Sentinel Reader role to the managed identity.

https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Create-SNOW-record#post-deployment