Service Desk Console
...
Configuring Security Operation...
Connecting Neurons for SOM to ADO
4 min
Perform the following procedures to connect Neurons for SOM to your ADO instance.
- Log into ITSM as an Administrator and open the Ticket Sharing and Synchronization (TSS) workspace.
- Select New Ticket Sharing and Synchronization.
- Enter the Integration Name (example: ADO).
- Select Incident from the Business Object Name menu.
- Select Enabled from the Status menu.
- In the Service Name field, find and select ADO.
- Save.
Four new tabs now appear after the Credentials tab: Filters, Field Mapping, Data Mapping, and Data Rules.
- The Credentials tab now contains three additional fields:
- Service URL: Relevant ADO instance URL (example: https://dev.azure.com/YourCompany).
- Username: Jira account username (example: [email protected]).
- Auth Token: Token provided by ADO (example: Token1232323232323).
- Click Save.
- In the Filters tab, click New Connector Service Filters.
- In the New Connector Service Filters dialog, select Summary from the Incident/ivnt_SecurityIncident Field Name menu.
- In the Incident/ivnt_SecurityIncident Field Name field, enter Trojan. Depending on environment and criteria, choosing the Security Incident’s Category field (with, for example “Data Breach” as Field Value) might be more appropriate or practical.
- Operation with next Filter determines how filtering works with other filters. Select the appropriate operator (AND or OR) (example: add a “Ransomware Detected” filter).
- When all appropriate filters have been added, Save.
- In the Field Mapping tab, click New Connector Service Field Mapping.
- In the New Connector Service Field Mapping dialog, select Summary for the Incident/ivnt_SecurityIncident Field Name.
- Enter System.Title for the ADO Field Name.
- Enter System.Title for the Service Field Depth.
- Select Poll this field for any changes.
- Save.
- Click New Connector Service Field Mapping.
- In the New Connector Service Field Mapping dialog, select Status for the Incident/ivnt_SecurityIncident Field Name.
- Enter System.State for the ADO Field Name . This field is in lowercase in Jira.
- Enter System.State for the Service Field Depth.
- Select Poll this field for any changes.
- Save.
- Click New Connector Service Field Mapping.
- In the New Connector Service Field Mapping dialog, select Description for the Incident/ivnt_SecurityIncident Field Name.
- Enter System.Description for the ADO Field Name.
- Enter System.Description for the Service Field Depth.
- Select Poll this field for any changes.
- Save.
- Click New Connector Service Field Mapping.
- In the New Connector Service Field Mapping dialog, select Provide default value (to switch field mapping from ADO to ISM).
- Enter project for the ADO Field Name.
- Enter the name of the ADO project for the Default Value.
- Click Save.
- In the Data Mapping tab, click New Connector Service Data Mapping.
- In the New Connector Service Field Mapping dialog, select Incident/ivnt_SecurityIncident)=Status :: ADO=System.State for the Connector Service Field.
- Enter Resolved for the Incident/ivnt_SecurityIncident Field Value.
- Enter Resolved for the ADO Field Value.
- Save.
- Click New Connector Service Data Mapping.
- Select Incident/ivnt_SecurityIncident=Status :: ADO=System.State for the Connector Service Field.
- Enter Logged for the Incident/ivnt_SecurityIncident Field Value.
- Enter Committed for the ADO Field Value.
- Save.
- Click New Connector Service Data Mapping.
- Select IIncident/ivnt_SecurityIncident=Status :: ADO=System.State for the Connector Service Field.
- Enter Active for the Incident/ivnt_SecurityIncident Field Value .
- Enter New for the ADO Field Value.
- Save.
- Click New Connector Service Data Mapping.
- Select ncident/ivnt_SecurityIncident=Status :: ADO=System.State for the Connector Service Field.
- Enter Closed for the Incident/ivnt_SecurityIncident Field Value..
- Enter Done for the ADO Field Value.
- Save.
- In the Data Rules tab, select New Connector Service Field Constraint..
- In the Field Mapping Value menu, select Incident/ivnt_SecurityIncident=Status :: ADO=System.State[Resolved,Resolved].
- In the Business Object Field Name menu, select CauseCode.
- Enter Vulnerability for the Business Object Field Value. This is an example; you need to match whatever cause codes you have set up in your Incident or Security Incident objects.
- Save.
- Click New Connector Service Field Constraint.
- In the Field Mapping Value menu, select Incident/ivnt_SecurityIncident=Status :: ADO=System.State[Resolved,Resolved].
- In the Business Object Field Name menu, select Resolution.
- Enter Data Rules Resolution for the Business Object Field Value. This is an example; you need to match whatever resolution values you have set up in your Incident or Security Incident objects.
- Click Save.
- Click the Additional Operations tab. If the tab is not visible, you may have to refresh or go to List View and select your TSS again.
- Select the following options:
- Push Comments added in HEAT to ADO
- Pull Comments added in ADO to HEAT
- Push Attachments added in HEAT to ADO
- Pull Attachments added in ADO to HEAT
- In the Comment Business Object menu, select Journal#Notes.
- Click Save.
- Click the Comment Field Mapping tab. If the tab is not visible, you may have to refresh or go to List View and select your TSS again.
- Click New Comment Field Mapping.
- In the Incident/ivnt_SecurityIncident Field Name menu, select Notes.
- Enter Description for the ADO Field Name.
- Click Save.
- Click New Comment Field Mapping.
- In the Incident Field Name menu, select Subject.
- Enter Summary for the Jira Field Name.
- Click Save.