1. Use the latest ServiceNow Trend Vision One connector (version 2.1.2 or above in ServiceNow Store), and follow the configuration in the help article: Configuring the Trend Vision One Case Management ticket profile
2. In Trend Vision One Connector Settings, only enable Case Management, but not Workbench, to avoid confusion.

   

   ^{Click the image to enlarge.}

3. In the Incident table of ServiceNow, when working on the incident ticket, make sure you see the case management tab with the "Case ID" in it. By updating the 'status', 'findings' and 'case priority' field in that tab, the value will be synchronized to the Trend Vision One case and associated workbench.

   

   ^{Click the image to enlarge.}

There will be duplicate tickets in the Incident table for a workbench alert. One is created by Workbench integration and the other is created by Case Management integration.

To enable automatic case creation and synchronization with ServiceNow:

1. Navigate to the Automated Response Playbook settings.

2. In the "Target Settings", select the option to "Open a Workbench Case".

3. Enable the playbook.

4. Once configured, the playbook will trigger a Workbench alert, automatically opening a case that will be synchronized with ServiceNow.

 

^{Click the image to enlarge.}

1. ServiceNow ITSM integration for Workbench is not 2-way synchronized. It periodically pulls the workbench alerts and creates tickets in ServiceNow. Trend Vision One for ServiceNow Ticketing System integration for Case Management creates tickets in ServiceNow in real-time and synchronizes bi-directionally. Updating the ticket in ServiceNow will update the Trend Vision One case and workbench alert.
2. ServiceNow ITSM integration inserts information in the Workbench Alert Information tab while Trend Vision One for ServiceNow Ticketing System integration inserts information in Case Management tab.

   

   ^{Click the image to enlarge.}

No. When a Workbench case is created in Trend Vision One, the alert model name or the insight name will be in the case name by default. When the case is synchronized to ServiceNow, the case name will be retained in the short description field, as well as the workbench ID in the associated items field. There will be no information lost.

^{Click the image to enlarge.}

^{Click the image to enlarge.}