Resolving Sentinel Incident Import Limit IssueIssue The Sentinel Incident Import process is hitting the default daily creation limit, preventing new incidents from being imported. SymptomsUnder "Azure Sentinel Incident Imports" imported Sentinel Incident IDs are not being assigned a target record and being ignored with the comment "Row transform ignored by onBefore script". This commend incorrectly suggests that imported Sentinel Incidents are being ignored for matching the filtering conditions for the Azure Sentinel profile's transform map's onBefore script.ReleaseAll versions. CauseAs shown in System log; using filter"created_by=sn_sec_sentinel": SI daily limit of 1000.0 reach Which refers to system property sn_sec_sentinel.max_si_per_day, whose default value is 1000.ResolutionTo resolve this issue, we recommend increasing the 'sn_sec_sentinel.max_si_per_day' system property value from 1000 to 2500. This adjustment will accommodate the higher volume of incidents being ingested. Here are the steps to implement this change: 1. Navigate to the System Properties page in your ServiceNow instance. 2. Locate the property 'sn_sec_sentinel.max_si_per_day'. 3. Change the value from 1000 to 2500. 4. Save the changes. Related LinksReview the Microsoft Azure Sentinel integration settingshttps://www.servicenow.com/docs/csh?topicname=sentinel-integration-settings.html&version=latestSecurity Incident Response Integration with Microsoft Azure Sentinel SR - SIR - Microsoft Azure Sentinel Integration - Feb 2025 TOI Key Configurationshttps://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1797460