Sentinel MCP Incident to ServiceNow Case

Overview

This solution bridges Microsoft Sentinel incident detections into ServiceNow with rich, machine-assembled context. When a Sentinel incident at or above a configurable severity threshold is raised, the primary flow uses the Sentinel MCP (Preview) to assemble a human-readable case narrative and IOC list, opens a ServiceNow case with that context, links the two in a Dataverse mapping table, comments the case link back onto the Sentinel incident, and notifies the security Teams channel. A second scheduled flow keeps the ServiceNow case status synced back onto the Sentinel incident.

Why it matters: SOC analysts otherwise re-type incident context into the ITSM system. MCP-built narratives make ServiceNow cases complete and consistent from the moment they are opened, and the mapping + status-sync keeps both systems in agreement.

Tenant note: The standard Microsoft Sentinel connector (shared_azuresentinel) is not provisioned in this environment, so the incident trigger and incident-write operations are implemented with a built-in Request (HTTP) trigger (fired by a Sentinel automation rule) and Azure Resource Manager (ARM) REST calls. The Sentinel MCP (Preview) and Teams connectors are used connector-first.

Use Case

A SOC tracks investigations in ServiceNow and wants high-severity Sentinel incidents automatically cased — with a written narrative and IOC list — and wants the Sentinel incident to reflect the ServiceNow case status over time. Audience: IT Admins, Security Operations.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
MMicrosoft Sentinel MCP (Preview)	shared_sentinelmcp	invokemcpdataexploration
ServiceNow	shared_service-now	CreateRecord GetRecord
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord UpdateRecord ListRecords
Microsoft Teams	shared_teams

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Security Incident Response table

Set flowlibs_ServiceNowTable to sn_si_incident (instead of incident) if the Security Incident Response (SIR) module is licensed.

Severity threshold

Change flowlibs_SentinelSeverityThreshold (Informational/Low/Medium/High) to widen or narrow what gets cased.

MCP tool

Point flowlibs_SentinelMcpToolName at whichever hunting/knowledge tool the preview exposes in your tenant; the arguments are a KQL query over SecurityIncident.

Bi-directional close

Extend Flow B to also push a Sentinel status/close back when the ServiceNow case resolves (ARM PATCH on the incident).

Assignment group / urgency

Map Sentinel severity, tactics, or entities to ServiceNow assignment_group, urgency, and impact in Compose ServiceNow Body.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@greaterOrEquals(variables('varIncidentRank'), variables('varThresholdRank'))

@int(coalesce(json(variables('varSeverityMap'))?[toLower(coalesce(triggerBody()?['severity'],'informational'))],0))

concat('/subscriptions/', EnvVar_SubscriptionId, '/resourceGroups/', EnvVar_ResourceGroup, '/providers/Microsoft.OperationalInsights/workspaces/', EnvVar_WorkspaceName, '/providers/Microsoft.SecurityInsights/incidents/', coalesce(incidentName, string(incidentNumber)))

@{coalesce(outputs('Initialize_MCP_Session')?['headers']?['Mcp-Session-Id'],'')}

body('Create_ServiceNow_Case')?['result']?['sys_id']

concat(EnvVar_ArmBaseUrl, varIncidentArmId, '/comments/', guid(), '?api-version=2024-03-01')

@not(equals(coalesce(items('For_Each_Mapping')?['flowlibs_servicenowstate'],''), coalesce(string(body('Get_ServiceNow_Case')?['result']?['state']),'')))

Customize & download