The scenario catches new users in ServiceNow and creates tags in MISP. Runs on its own, no manual copying.