IBM Support

QRadar SOAR: ServiceNow returning HTTP 500 for sn_si_incident

Troubleshooting


Problem

Some clients need to set specific and unique permissions in ServiceNow for some features of ServiceNow Functions for IBM SOAR to work properly.

Symptom

During initial set up of the application, ServiceNow returned the following error.
2024-02-22 17:00:46,796 DEBUG [connectionpool] [Thread-23] https://*******.service-now.com:443 "POST /api/x_ibmrt_resilient/api/create HTTP/1.1" 500 None
2024-02-22 17:00:46,798 DEBUG [requests_common] [Thread-23] 500
2024-02-22 17:00:46,798 DEBUG [requests_common] [Thread-23] b'{"error":{"message":"com.glide.script.fencing.access.ScopeAccessNotGrantedException: create access to sn_si_incident not granted","detail":""},"status":"failure"}'
2024-02-22 17:00:46,798 ERROR [requests_common] [Thread-23] 500 

Cause

By default, the application sets a suite of permissions but some optional features such as integrating with Security Incident Response (SIR) requires permissions that need to be added manually should clients decide to use these features.

Diagnosing The Problem

The application logs showing the HTTP 500 returned by ServiceNow was shared with the ServiceNow administrators. Their own investigation identified that additional permissions needed to be granted to allow the application to interact with the sn_si_incident table.

Resolving The Problem

In this particular client's case, their ServiceNow administrators created the following permissions.
snow permissions

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSA230","label":"IBM Security QRadar SOAR"},"ARM Category":[{"code":"a8m0z000000cwJgAAI","label":"Integrations->ServiceNow"}],"ARM Case Number":"TS016284249","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSTDPP","label":"IBM Cloud Pak for Security"},"ARM Category":[{"code":"a8m0z0000001h8pAAA","label":"Support->Cases"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSL2BV","label":"IBM Security QRadar Suite - SOAR"},"ARM Category":[{"code":"a8m0z000000cvqKAAQ","label":"Integrations"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
05 June 2024

UID

ibm17156534