[DOCS] Additional fields in ServiceNow ITSM and SecOps connectors (el…

…astic#195122)

docs/management/connectors/action-types/servicenow-sir.asciidoc

@@ -64,12 +64,28 @@ The username for HTTP basic authentication.
 You can test connectors as you're creating or editing the connector in {kib}. For example:
 
 [role="screenshot"]
-image::management/connectors/images/servicenow-sir-params-test.png[{sn-sir} params test]
+image::management/connectors/images/servicenow-sir-params-test.png[{sn-sir} params test, width=75%]
 
 {sn-sir} actions have the following configuration properties.
 
 Additional comments::
 Additional information for the client, such as how to troubleshoot the issue.
+Additional fields::
+An object that contains custom field identifiers and their values.
+These fields must exist in the Elastic ServiceNow application and must be specified in JSON format.
++
+--
+For example:
+[source,sh]
+----
+{
+    "u_cmdb_ci": "host-a",
+    "u_company": "My company",
+    "u_assignment_group": "Testing"
+}
+----
+Note that the default source field names in the Elastic ServiceNow application are prefixed with "u_".
+--
 Category::
 The category of the incident.
 Correlation display::

docs/management/connectors/action-types/servicenow.asciidoc

@@ -64,12 +64,28 @@ The username for HTTP basic authentication.
 When you create or edit a connector, use the *Test* tab to test its actions:
 
 [role="screenshot"]
-image::management/connectors/images/servicenow-params-test.png[ServiceNow params test]
+image::management/connectors/images/servicenow-params-test.png[ServiceNow params test, width=75%]
 
 {sn-itsm} actions have the following configuration properties.
 
 Additional comments::
 Additional information for the client, such as how to troubleshoot the issue.
+Additional fields::
+An object that contains custom field identifiers and their values.
++
+--
+These fields must exist in the Elastic ServiceNow application and must be specified in JSON format.
+For example:
+[source,sh]
+----
+{
+    "u_cmdb_ci": "host-a",
+    "u_company": "My company",
+    "u_assignment_group": "Testing"
+}
+----
+Note that the default source field names in the Elastic ServiceNow application are prefixed with "u_".
+--
 Category::
 The category of the incident.
 Correlation display::
@@ -86,6 +102,9 @@ NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that
 
 Description::
 The details about the incident.
+Event action::
+The type of action to test: resolve or trigger.
+When you test a resolve action, you must provide a correlation identifier.
 Impact::
 The effect an incident has on business.
 It can be measured by the number of affected users or by how critical it is to the business in question.
@@ -94,7 +113,7 @@ The severity of the incident.
 Short description::
 A short description for the incident, used for searching the contents of the knowledge base.
 Subcategory::
-The category of the incident.
+The subcategory of the incident.
 Urgency::
 The extent to which the incident resolution can delay.