Connect FortiSIEM with ServiceNow

Totaly new to FortiSIEM and system admin in ServiceNow I'm looking for a way to fill out fields in ServiceNow with data from FortiSIEM into OOTB fields in ServiceNow Incident.

I tried to edit the .xsl file called "ServiceNow-Incident-Insert.xsl" with:

<correlation_id><xsl:value-of select="incidentId"/></correlation_id>

hoping to get the IncidentId into the correlation_id column in ServiceNow, but nothing gets written into ServiceNow form field. The incidenId iw written into the work notes, but not into the form...

Anyone with any suggestion on what to do?