Hi all,
I am attempting to get the ServiceNow job “Sync Closed Incidents” between SecOps going.
However I am running into an issue where the secops job picks up a case is open, but doesn’t read the Ticket_ID value assigned during the playbook stage. In short, a ticket is being created in serviceNow off the back of a secops playbook, but SNOW isn’t picking up the serviceNow case has been closed. I have attached a log export below:
[2026-11-02,03:58:34,000 INFO] --------------- JOB STARTED ---------------
[2026-11-02,03:58:34,000 INFO] --- Start synchronize closure from Google SecOps to ServiceNow ---
[2026-11-02,03:58:34,000 INFO] Found 0 closed cases since 2026-11-02 03:58:01
[2026-11-02,03:58:34,000 INFO] --- Start synchronize closure from ServiceNow to Google SecOps ---
[2026-11-02,03:58:34,000 INFO] Found 1 open cases
[2026-11-02,03:58:34,000 INFO] No data found for property key: TICKET_ID
[2026-11-02,03:58:34,000 INFO] --- Finish synchronize closure from ServiceNow to Google SecOps ---
[2026-11-02,03:58:34,000 INFO] --------------- JOB FINISHED ---------------
I have a feeling it relates to “No data found for property key: TICKET_ID” but I am unsure how to resolve.
Any ideas or advice would be greatly appreciated.
Thanks,
