We have a scenario where in we have alert scoped playbook which has a ServiceNow Integration (https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/servicenow) up and running fine.
Now we are migrating to a case scoped playbook and want to have one on one parity of GSO case and a Snow Incident.
When we try to invoke the same action as part of the case scoped playbook , I’m getting the following error.
"Error executing action ServiceNow - Create Incident. Reason: Cannot set alert context property in Case Playbook without specifying a valid alert_group Identifier"
Now we have checked with both “create Incident” and “create alert Incident” Actions and the same issue exists.
Has someone faced the same issue and know of any resolutions or work around.
We have checked the Python Integration script and a custom connector by simply commenting the “setAlertContext” method call , gets the issue fixed.
Can someone from the Google Secops Connectors/Integrations Team take a look at this and provide a OOTB fix as part of the connector version updates ?
Regards,
Venkatesh M S
