ServiceNow Security Operations for IBM QRadar application generates multiple security incidents for the same QRadar alarm - Support and Troubleshooting

ServiceNow Security Operations for IBM QRadar application generates multiple security incidents for the same QRadar alarm Issue ServiceNow Security Operations for IBM QRadar application generates multiple security incidents for the same QRadar alarm. It creates every time when we update the company and assignment group. Release New York Patch 7. Cause Tenant access was not given to companies. Resolution Based on this description, you need to order Tenant access to Companies: xxxx and yyyy for user: QRADAR_IntegrationUser. QRADAR_IntegrationUser is the user that creates the Security Incidents from QRADAR, and that users do not have access (find) Security Incidents for those two Companies, that’s why it creates a new one.