ServiceNow v2

IT service management. Cortex interfaces with ServiceNow to help streamline security-related service management and IT operations. For example, you can use the ServiceNow integration in order to:

• View, create, update or delete a ServiceNow ticket directly from the Cortex CLI, and enrich it with Cortex data.
• View, create, update and delete records from any ServiceNow table.
• Query ServiceNow data with the ServiceNow query syntax.
• Manage Security Incident Response (SIR) tickets with Cortex, update tickets and enrich them with data.

Please refer to ServiceNow documentation for additional information. We especially recommend the Operators available for filters and queries page.

This integration was integrated and tested with the Xanadu version of ServiceNow.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Use cases

1. Get, update, create, and delete ServiceNow tickets, as well as add links and comments, or upload files to the tickets.
2. Fetch newly created incidents.
3. Get, update, create, delete records from any ServiceNow table.

Required Permissions

To use ServiceNow on Cortex, ensure your user account has the snc_platform_rest_api_access role.
This role is required to make API calls.
Also add to your user account the specific tables that you want to have access to.
However, these permissions may not suffice for managing records in some tables. Make sure you have the correct role so you have permissions to work with the relevant table.

Wrapper Scripts

There are 3 scripts that serve as examples for wrapping the following generic commands:
servicenow-query-table - ServiceNowQueryIncident
servicenow-create-record - ServiceNowCreateIncident
servicenow-update-record - ServiceNowUpdateIncident

You can use these scripts if you want to wrap these commands around a ServiceNow table of your choice.
These scripts are wrapped around the incident table, so to wrap them around another table simply copy the scripts and edit the code, arguments and outputs accordingly.

Configure ServiceNow v2 on Cortex

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for ServiceNow v2.
3. Click Add instance to create and configure a new integration instance.
4. To ensure that mirroring works:
   1. Select the Fetches incidents radio button.
   2. Under Classifier, select ServiceNow Classifier.
   3. Under Mapper (incoming), select ServiceNow - Incoming Mapper.
   4. Under Mapper (outgoing), select ServiceNow - Outgoing Mapper.
   5. To enable mirroring to close a ticket in Cortex XSOAR, under the Mirrored XSOAR Ticket closure method dropdown, select the ticket closing method,
      or set the Mirrored XSOAR Ticket custom close resolution code or Mirrored XSOAR Ticket custom close state code parameter, in order to override the default closure method with a custom close code or custom state.
      In order to use Mirrored XSOAR Ticket custom close resolution code or Mirrored XSOAR Ticket custom close state code parameter, it must follow this format: “custom_state_code1=custom_label1,custom_state_code2=custom_label2,…”,
      for example: “10=Design,11=Development,12=Testing”.
      Also, a matching user-defined list of customized incident close reasons must be configured as a “Server configuration” in Cortex XSOAR. (Meaning each Service Now custom state label will have a matching Cortex XSOAR custom close reason with the same name). Not following this format will result in a server error!
      For more information about Customize Incident Close Reasons, see Cortex XSOAR 6.13 or Cortex XSOAR 8 Cloud or Cortex XSOAR 8.7 On-prem.
      

   6. To enable mirroring to close an incident in ServiceNow, under the Mirrored ServiceNow Ticket closure method dropdown, select the ticket closing method,
      or set the Mirrored ServiceNow Ticket custom close state code parameter, in order to override the default closure method with a custom state.

      

Instance Creation Flow

This integration supports three types of authorization:

1. Basic authorization using username and password.
2. OAuth 2.0 authorization
3. JWT authentication.

OAuth 2.0 Authorization

To use OAuth 2.0 authorization follow the next steps:

1. Login to your ServiceNow instance and create an endpoint for XSOAR to access your instance (please see Snow OAuth for more information).
2. Copy the Client Id and Client Secret (click the lock next to the client secret to reveal it) that were automatically generated when creating the endpoint into the Client ID and Client Secret fields of the integration instance configuration.
3. (Recommended) Enter the ServiceNow account Username and Password in the integration instance configuration. When provided, the integration automatically performs the initial OAuth login on first use. It also automatically renews the refresh token when it expires.
4. Select the Use OAuth Login checkbox and click Done.
5. If you did not provide the Username and Password in step 3, run the command !servicenow-oauth-login from the Cortex XSOAR CLI and fill in the ServiceNow user’s User ID (admin or a dedicated integration username) and corresponding password of the ServiceNow integration instance. This step generates an access token to the ServiceNow integration instance and is required only the first time after configuring a new integration instance in Cortex XSOAR. If you provided Username and Password, this step is handled automatically.
6. (Optional) Test the created integration instance by running the !servicenow-oauth-test command.

Notes:

1. When running the !servicenow-oauth-login command, a refresh token is generated and will be used to produce new access tokens after the current access token has expired.
2. If the Username and Password fields are configured, the integration will automatically perform the initial login and renew the refresh token when it expires — no manual commands are needed. Otherwise, you will have to run the servicenow-oauth-login command for the initial login and again each time the refresh token expires.
3. The grant type used to get an access token is Resource owner password credentials. See the Snow documentation for more information.

JWT Authentication

Prerequisites in order to support JWT

1. Create a Java Key Store and upload it to the instance by accessing from the upper menu: All > System Definition > Certificates. The private key will be used as an integration parameter.
2. Configure a JWT signing key by accessing: All→System OAuth→JWT Keys using the keystore from above and keep the Key ID as it will be used as kid integration parameter.
3. Create a JWT provider with a JWT signing key by accessing: All→System OAuth→JWT providers. Claim Name sub in Standard Claims has to be existing non-admin servicenow user with all necessary roles.
4. Connect to an OAuth provider and create an OAuth application registry by accessing All→System OAuth→Application Registry:
   1. aud in JWT provider has to be equal to Client ID from OAuth JWT application - update JWT provider If necessary.
   2. The value of kid in JWT Verifier Maps has to be the same as Key Id in JWT signing key.
      The value can be updated if necessary.
5. Create API Access Policy or add Authentication profile to existing Policy by accessing: All→System Web Services→API Access Policies→Rest API Access Policies

IMPORTANT:

1. The Standard Authentication Profile of type Oauth should be already present in ServiceNow and has to be added to the Policy.
   API Access Policy should be configured as global in order to cover all available resources and not just now/table
2. Granting JWT to admin is not allowed.
   You should have a non-admin user with all necessary roles (only non-admin roles) in addition to the existing role snc_platform_rest_api_access that is required to make API calls.

Using Multi-Factor Authentication (MFA)

MFA can be used both when using basic authorization and when using OAuth 2.0 authorization, however we strongly recommend using OAuth 2.0 when using MFA.
If MFA is enabled for your user, follow the next steps:

1. Open the Google Authenticator application on your mobile device and make note of the number. The number refreshes every 30 seconds.
2. Enter your username and password, and append the One Time Password (OTP) that you currently see on your mobile device to your password without any extra spaces. For example, if your password is 12345 and the current OTP code is 424 058, enter 12345424058.

Notes:

1. When using basic authorization, you will have to update your password with the current OTP every time the current code expires (30 seconds), hence we recommend using OAuth 2.0 authorization.
2. For using OAuth 2.0 see the above instructions. The OTP code should be appended to the password parameter in the !servicenow-oauth-login command.

1. Click Test to validate the URLs, token, and connection.
2. Click Done.

Fetch Incidents

The integration fetches newly created tickets according to the following parameters,
which you define in the instance configuration: ticket_type, query, and limit.
For the first fetch, the integration will fetch incidents that were created 10 minutes earlier.
After that, the integration will fetch incidents created after the timestamp of the last fetch.

look-back parameter note:
In case the look-back parameter is initialized with a certain value and during a time that incidents were fetched, if changing
the look back to a number that is greater than the previous value, then in the initial incident fetching there will be incidents duplications.
If the integration was already set with look back > 0, and the look-back is not being increased at any point of time, then those incident duplications would not occur.
Note that using a look-back value that is very large (more than an hour) can lead to an increase in the memory usage of the system in some cases, and it is highly unrecommended.
If there is a need to fetch incidents that require a long look-back to get fetched (for tracking issues, for example), use the mirroring feature and filter the results using the relevant tags instead of using the look-back feature. You can create a custom mapper and track the relevant fields.

Configure Incident Mirroring

This feature is compliant with XSOAR version 6.0 and above.
When mirroring incidents, you can make changes in ServiceNow that will be reflected in Cortex XSOAR, or vice versa.
You can also attach files from either of the systems which will then be available in the other system.

The following instructions include steps for configuring the integration and incoming and outgoing mappers. However, they do not cover every option available in the integration nor classification and mapping features.
For information about classification and mapping see Classification and Mapping (Cortex XSOAR 6.13) or Classification and Mapping (Cortex XSOAR 8 Cloud) or Classification and Mapping (Cortex XSOAR 8.7 On-prem).

Note:

• For Cortex XSOAR version 6.1 only, the final source of truth for an incident are the values in Cortex XSOAR. For example, if you change the severity in Cortex XSOAR and then change it back in ServiceNow, the final value that will be presented is the one in Cortex XSOAR. For versions 6.2 and later, if mirroring is in both directions then the latest update is the source of truth.
• The mirroring settings apply only for incidents that are fetched after applying the settings. Pre-existing comments or work notes are not fetched/mirrored at the time of incident creation.
• To use a custom mapper, you must first duplicate the mapper and edit the field in the copy of the mapper. If you detach the out of the box mapper and make changes to it, the pack does not automatically get updates.

To set up incident mirroring you need to:

1. Configure the ServiceNow Service Account roles.
2. Configure mirroring for ServiceNow trigger incidents or configure mirroring for other trigger incidents.

Configure the ServiceNow Service Account Roles

To use ServiceNow on Cortex XSOAR, ensure your service account has the following roles required to make API calls:

• Rest_api_explorer
• Snc_platform_rest_api_access
• itil (optional)

Note:
If you choose to give permissions only for specific tables, you then need to add to your user account the specific tables you want to have access to. Make sure you have the correct role so you have permissions to work with the relevant table. Keep in mind that these permissions may not suffice for managing records in some tables.

• Read access to sys_journal_field (this is an elevated privilege) for accessing comments and work notes and for incoming mirroring. This is not required if you have Use Display Value enabled with Instance Date Format defined.

Note:
See this ServiceNow community link for giving elevated read access and potential risks.

Configure Incident Mirroring When the Trigger Incident is ServiceNow

When the trigger incident is ServiceNow, you use the ServiceNow Classifier and leave the Incident type as N/A, with either the default incoming and outgoing mappers or optional custom mappers.

STEP 1 - Configure the ServiceNow v2 Integration Instance for Mirroring

1. Navigate to Integrations and search for ServiceNow v2.
2. Click Add instance.
3. Select Fetches incidents.

4. Under Classifier, select ServiceNow Classifier.
   Note:
   You define either the Classifier or the Incident type (not both). It is recommended to define the Classifier and leave Incident type N/A to enable labeling custom incident types under the ServiceNow Classifier.

5. Under Mapper (incoming), for default mapping select ServiceNow - Incoming Mapper. For custom mapping, follow the instructions in STEP 2 and then select the custom mapper name.
6. Under Mapper (outgoing), for default mapping select ServiceNow - Outgoing Mapper. For
   custom mapping, follow the instructions in STEP 3 and then select the custom mapper name.

1. Enter the connection parameters.
   • Confirm whether your organization uses basic authorization or OAuth authorization (most use basic) and enter the relevant authorization details.
   • Leave ServiceNow API Version empty since ServiceNow typically automatically provides the appropriate version.
2. Under The query to use when fetching incidents, the default query is to filter for new incidents: stateNOT IN6,7, where 6= resolved incidents and 7= closed incidents. For a different query, ask your ServiceNow representative to provide the exact states and their numbers.
3. Select Get incident attachments to retrieve attachments from ServiceNow incident creation in Cortex XSOAR.
4. Select the Incident Mirroring Direction:
   • In - Mirrors changes on the ServiceNow ticket in to the Cortex XSOAR ticket.
   • Out - Mirrors changes on the Cortex XSOAR ticket to the ServiceNow ticket.
   • Both - Mirrors changes both in and out on both tickets.
5. Enable the checkbox for Use Display Value if you want to fetch comments and work notes without using sys_journal_field table which required an elevated read only permission.
6. If Use Display Value is enabled, Instance Date Format needs to be set to the date format that matches the date format used in ServiceNow by the user account used to configure the instance.

1. Set the Timestamp field to query as part of the mirroring flow. This defines the ticket_last_update - the epoch timestamp when the ServiceNow incident was last updated. The default is sys_updated_on.
2. Enter the relevant Comment Entry Tag, Work Note Entry Tag, File Entry Tag To ServiceNow and File Entry Tag From ServiceNow values.
   These values are mapped to the dbotMirrorTags incident field in Cortex XSOAR, which defines how Cortex XSOAR handles comments when you tag them in the War Room.
   Note:
   These tags work only for mirroring comments, work notes, and files from Cortex XSOAR to ServiceNow.

1. Configure any Custom Fields to Mirror. These must start with “u_”. This is available for ServiceNow v2 version 2.2.10 and later.
   Note:
   To enable mirroring custom fields, make a copy of the incoming and outgoing mappers and add the custom fields to the copies (see STEP 2 and STEP 3). Select these copies in the integration instance Mapper (incoming) and Mapper (outgoing) settings.
2. To enable mirroring when closing an incident or ticket in Cortex XSOAR and ServiceNow, select the closed option from the Mirrored XSOAR Ticket closure method dropdown and Mirrored ServiceNow Ticket closure method respectively.
3. Click Done.

STEP 2 (Optional) Configure the Incoming Mapper by Incident Type for Custom Fields

Note:
Any modifications require that the mappers be cloned before any changes can be applied.

1. Navigate to Classification and Mapping and for Incidents search for the ServiceNow - Incoming Mapper.
2. Select it and click Duplicate.
3. Under the Incident Type dropdown, select ServiceNow Create Ticket and Mirror.

4. Verify the mapper has these fields mapped. They will pull the values configured on the integration instance settings at the time of ingestion.

   

   • dbotMirrorId - dbotMirrorId - the field used by the third-party integration to identify the ticket. This should be the sys_id of the ServiceNow ticket. The value is mapped to incident.servicenowticketid.
   • dbotMirrorDirection - determines whether mirroring is incoming, outgoing, or both. Default is Both. This should match the instance configuration.
   • dbotMirrorInstance - determines the ServiceNow instance with which to mirror. This should match the instance configuration.
   • dbotMirrorLastSync - determines the field by which to indicate the last time that the systems synchronized.
   • dbotMirrorTags - determines the tags that you need to add in Cortex XSOAR for entries to be pushed to ServiceNow. They should be copied from the tags in the instance configuration. These are also the tags that must be put on the War Room record in order for it to sync.
     • To mirror files, use the ForServiceNow tag.
     • To mirror general notes, use the comments tag.
     • To mirror private notes that can be read only by users with the necessary permissions, use the work_notes tag.
   • Configure any custom fields you want mapped to Cortex XSOAR. Custom fields start with “u_” and are available for ServiceNow v2 version 2.2.10 and later. These must be added to the integration instance Custom Fields to Mirror setting.

STEP 3 - Modify the Outgoing Mapper

Note:
Any modifications require that the mappers be cloned before any changes can be applied.

1. Navigate to Classification and Mapping, and for Incidents search for the ServiceNow - Outgoing Mapper.
2. Select it and click Duplicate.
   The left side of the screen shows the ServiceNow fields to which to map and the right side of the
   screen shows the Cortex XSOAR fields by which you are mapping.
3. Under the Incident Type dropdown, select the relevant incident type (for example ServiceNow Ticket).
4. Under Schema Type, select incident. The Schema Type represents the ServiceNow entity that
   you are mapping to. In our example it is an incident, but it can also be any other kind of ticket that
   ServiceNow supports.
5. On the right side of the screen, under Incident, select the incident based on which you want to
   match.
6. Change the mapping according to your needs, including any fields you want mapped outward to ServiceNow and any custom fields. Make sure the custom fields you want mirrored are added to the integration instance settings.
7. Save your changes.

STEP 4 - Create an Incident in ServiceNow

For purposes of this use case, it can be a simple incident. The new ticket will be ingested in Cortex XSOAR in approximately one minute.

STEP 5 - Add a Note to the Incident in Cortex XSOAR

In the example below, we have written A comment from Cortex XSOAR to ServiceNow.

1. Click Actions > Tags and add the comments tag.
2. Add a file to the incident and mark it with the ForServiceNow tag.

1. Navigate back to the incident in ServiceNow and within approximately one minute, the changes will be reflected there, too.
   You can make additional changes like closing the incident or changing severity and those will be reflected in both systems.

Configure Incident Mirroring When the Trigger Incident is Not ServiceNow

You can set up any source integration to create a ServiceNow ticket based on a fetched incident and mirror the ticket in Cortex XSOAR. To do this you need to:

• Configure the ServiceNow v2 integration to map the appropriate fields from the ServiceNow Create Ticket and Mirror incident type to the relevant trigger incident type (for example, Phishing Custom).
• Set up the source integration to create a ServiceNow ticket and start mirroring.

STEP 1 - Configure the ServiceNow v2 Integration Instance for Mirroring

1. Navigate to Classification and Mapping. For Incidents, search for ServiceNow - Incoming Mapper and ServiceNow - Outgoing Mapper.
2. For each mapper, click Duplicate.
   Your copied mappers will be called ServiceNow - Incoming Mapper_copy and ServiceNow - Outgoing Mapper_copy, you can rename them. The copied mappers appear in the drop down for the Mapper (incoming) and Mapper (outgoing) integration instance settings fields.
3. Navigate to Integrations and search for ServiceNow v2.
4. Click Add instance.
5. Select Do not Fetch.

6. Under Classifier, select ServiceNow Classifier.
   Note:
   You define either the Classifier or the Incident type (not both). It is recommended to define the Classifier and leave Incident type N/A to enable labeling custom incident types under the ServiceNow Classifier.

7. Under Mapper (incoming), select ServiceNow - Incoming Mapper_copy (or whatever you renamed it).
8. Under Mapper (outgoing), select ServiceNow - Outgoing Mapper_copy (or whatever you renamed it).
9. Enter the connection parameters.
   • Confirm whether your organization uses basic authorization or OAuth authorization (most use basic) and enter the relevant authorization details.
   • Leave ServiceNow API Version empty since ServiceNow typically automatically provides the appropriate version.
10. Under The query to use when fetching incidents, the default query is to filter for new incidents: stateNOT IN6,7, where 6= resolved incidents and 7= closed incidents. For a different query, ask your ServiceNow representative to provide the exact states and their numbers.
11. Select Get incident attachments to retrieve attachments from ServiceNow incident creation in Cortex XSOAR.
12. Select the Incident Mirroring Direction:
    • In - Mirrors changes on the ServiceNow ticket in to the Cortex XSOAR ticket.
    • Out - Mirrors changes on the Cortex XSOAR ticket to the ServiceNow ticket.
    • Both - Mirrors changes both in and out on both tickets.
13. Enable the checkbox for Use Display Value if you want to fetch comments and work notes without using sys_journal_field table which required an elevated read only permission.
14. If Use Display Value is enabled, Instance Date Format needs to be set to the date format that matches the date format used in ServiceNow by the user account used to configure the instance.

1. Set the Timestamp field to query as part of the mirroring flow. This defines the ticket_last_update - the epoch timestamp when the ServiceNow incident was last updated. The default is sys_updated_on.
2. Enter the relevant Comment Entry Tag, Work Note Entry Tag, File Entry Tag To ServiceNow and File Entry Tag From ServiceNow values.
   These values are mapped to the dbotMirrorTags incident field in Cortex XSOAR, which defines how Cortex XSOAR handles comments when you tag them in the War Room.
   Note:
   These tags work only for mirroring comments from Cortex XSOAR to ServiceNow.

1. Configure any Custom Fields to Mirror. These must start with “u_”. This is available for ServiceNow v2 version 2.2.10 and later.
   Note:
   To enable mirroring custom fields, make a copy of the incoming and outgoing mappers and add the custom fields to the copies (see STEP 2 and STEP 3). Select these copies in the integration instance Mapper (incoming) and Mapper (outgoing) settings.
2. To enable mirroring when closing an incident or ticket in Cortex XSOAR and ServiceNow, select the closed option from the Mirrored XSOAR Ticket closure method dropdown and Mirrored ServiceNow Ticket closure method respectively.
3. Click Done.

STEP 2 (Optional) Configure the Incoming Mapper by Incident Type for Custom Fields

Note:
Any modifications require that the mappers be cloned before any changes can be applied.

1. Navigate to Classification and Mapping and for Incidents search for the ServiceNow - Incoming Mapper_copy (or whatever you renamed it).
2. Under the Incident Type dropdown, select the relevant triggering incident type, for example Phishing.

3. Verify the mapper has these fields mapped. They will pull the values configured on the integration instance settings at the time of ingestion.

   

   • dbotMirrorId - dbotMirrorId - the field used by the third-party integration to identify the ticket. This should be the sys_id of the ServiceNow ticket. The value is mapped to incident.servicenowticketid.
   • dbotMirrorDirection - determines whether mirroring is incoming, outgoing, or both. Default is Both. This should match the instance configuration.
   • dbotMirrorInstance - determines the ServiceNow instance with which to mirror. This should match the instance configuration.
   • dbotMirrorLastSync - determines the field by which to indicate the last time that the systems synchronized.
   • dbotMirrorTags - determines the tags that you need to add in Cortex XSOAR for entries to be pushed to ServiceNow. They should be copied from the tags in the instance configuration. These are also the tags that must be put on the War Room record in order for it to sync.
     • To mirror files from XSOAR to ServiceNow, use the ForServiceNow tag.
     • Mirrored files from ServiceNow to XSOAR will be tagged by default with the FromServiceNow tag.
     • To mirror general notes, use the comments tag.
     • To mirror private notes that can be read only by users with the necessary permissions, use the work_notes tag.
   • Configure any custom fields you want mapped to Cortex XSOAR. Custom fields start with “u_” and are available for ServiceNow v2 version 2.2.10 and later. These must be added to the integration instance Custom Fields to Mirror setting.
4. Save your changes.

STEP 3 - Modify the Outgoing Mapper for Custom Fields

Note:
Any modifications require that the mappers be cloned before any changes can be applied.

1. Navigate to Classification and Mapping, and for Incidents search for the ServiceNow - Outgoing Mapper_copy (or whatever you renamed it).
2. Under the Incident Type dropdown, select the relevant incident type (for example ServiceNow Ticket).
3. Under Schema Type, select incident. The Schema Type represents the ServiceNow entity that
   you are mapping to. In our example it is an incident, but it can also be any other kind of ticket that
   ServiceNow supports.
4. On the right side of the screen, under Incident, select the incident based on which you want to
   match.
   The left side of the screen shows the ServiceNow fields to which to map and the right side of the screen shows the Cortex XSOAR fields by which you are mapping.
5. Change the mapping according to your needs, including any fields you want mapped outward to ServiceNow and any custom fields. Make sure the custom fields you want mirrored are added to the integration instance settings.
6. Save your changes.

STEP 4 - Set up Your Source Integration

Set up your source integration so that after fetching a trigger incident a ServiceNow ticket is created and mirroring starts.

1. Fetch an incident with your chosen integration. For example, for Phishing using any email integration (Gmail, MSGraph, O365).
2. Classify and map the incident fields.
3. Create a task in the playbook that creates a ServiceNow ticket followed by a set incident task that starts the mirroring capability.

Example:
The following shows the Create New Record playbook task, which creates a ServiceNow ticket.

The Create New Record task is followed by the Set Mirroring Fields task, which starts the mirroring capability.

The new ServiceNow ticket will be ingested in Cortex XSOAR in approximately one minute.

STEP 5 - Add a Note to the Incident in Cortex XSOAR

In the example below, we have written A comment from Cortex XSOAR to ServiceNow.

1. Click Actions > Tags and add the comments tag.
2. Add a file to the incident and mark it with the ForServiceNow tag.

1. Navigate back to the incident in ServiceNow and within approximately one minute, the changes will be reflected there, too.
   You can make additional changes like closing the incident or changing severity and those will be reflected in both systems.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

All commands implement a retry mechanism for 401 (Unauthorized) error codes due to potential ServiceNow authorization issues. This mechanism attempts the request multiple times. If the issue persists, it likely indicates an authorization configuration problem.

servicenow-login

This function should be used once before running any command when using OAuth authentication.

Base Command

servicenow-login

Input

Context Output

There is no context output for this command.

Command Example

!servicenow-login username=username password=password

Context Example

{}

Human Readable Output

Logged in successfully

servicenow-test

Test the instance configuration when using OAuth authorization.

Base Command

servicenow-test

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

#### Context Example

```json
{}

Human Readable Output

Instance Configured Successfully

servicenow-get-ticket

Retrieves ticket information by ticket ID.

Base Command

servicenow-get-ticket

Input

Context Output

Command Example

!servicenow-get-ticket number=INC0000040

Context Example

{
    "ServiceNow": {
        "Ticket": {
            "Active": "true",
            "Assignee": "admin",
            "CreatedOn": "2020-01-26 00:43:54",
            "Creator": "admin",
            "ID": "id",
            "Number": "INC0000040",
            "OpenedAt": "2020-01-26 00:42:45",
            "OpenedBy": "admin",
            "Priority": "3 - Moderate",
            "State": "3",
            "Summary": "JavaScript error on hiring page of corporate website"
        }
    },
    "Ticket": {
        "Active": "true",
        "Assignee": "admin",
        "CreatedOn": "2020-01-26 00:43:54",
        "Creator": "admin",
        "ID": "id",
        "Number": "INC0000040",
        "OpenedAt": "2020-01-26 00:42:45",
        "OpenedBy": "admin",
        "Priority": "3 - Moderate",
        "State": "3",
        "Summary": "JavaScript error on hiring page of corporate website"
    }
}

Human Readable Output

ServiceNow ticket

System ID	Number	Impact	Urgency	Severity	Priority	State	Created On	Created By	Active	Description	Opened At	Short Description
id	INC0000040	2 - Medium	2 - Medium	3 - Low	3 - Moderate	3 - On Hold	2020-01-26 00:43:54	admin	true	Seeing JavaScript error message on hiring page on Explorer and Firefox.	2020-01-26 00:42:45	JavaScript error on hiring page of corporate website

servicenow-create-ticket

Creates new ServiceNow ticket.

Base Command

servicenow-create-ticket

Input

For more information regarding the input_display_value argument, see: https://docs.servicenow.com/bundle/xanadu-platform-administration/page/administer/exporting-data/concept/query-parameters-display-value.html

Context Output

Command Example

!servicenow-create-ticket active=true severity="2 - Medium" short_description="Ticket example"

Context Example

{
    "ServiceNow": {
        "Ticket": {
            "Active": "true",
            "CreatedOn": "2020-05-10 09:04:06",
            "Creator": "admin",
            "ID": "id",
            "Number": "INC0010002",
            "OpenedAt": "2020-05-10 09:04:06",
            "OpenedBy": "admin",
            "Priority": "5 - Planning",
            "State": "1",
            "Summary": "Ticket exmaple"
        }
    },
    "Ticket": {
        "Active": "true",
        "CreatedOn": "2020-05-10 09:04:06",
        "Creator": "admin",
        "ID": "id",
        "Number": "INC0010002",
        "OpenedAt": "2020-05-10 09:04:06",
        "OpenedBy": "admin",
        "Priority": "5 - Planning",
        "State": "1",
        "Summary": "Ticket example"
    }
}

Human Readable Output

ServiceNow ticket was created successfully

System ID	Number	Impact	Urgency	Severity	Priority	State	Created On	Created By	Active	Opened At	Short Description
id	INC0010002	3 - Low	3 - Low	2 - Medium	5 - Planning	1 - New	2020-05-10 09:04:06	admin	true	2020-05-10 09:04:06	Ticket example

servicenow-update-ticket

Updates the specified ticket.

Base Command

servicenow-update-ticket

Input

For more information regarding the input_display_value argument, see: https://docs.servicenow.com/bundle/xanadu-platform-administration/page/administer/exporting-data/concept/query-parameters-display-value.html

Context Output

There is no context output for this command.

Command Example

!servicenow-update-ticket id=id severity="2 - Medium"

Context Example

{
    "ServiceNow": {
        "Ticket": {
            "Active": "true",
            "Assignee": "admin",
            "CreatedOn": "2020-01-26 00:43:54",
            "Creator": "admin",
            "ID": "id",
            "Number": "INC0000040",
            "OpenedAt": "2020-01-26 00:42:45",
            "OpenedBy": "admin",
            "Priority": "3 - Moderate",
            "State": "3",
            "Summary": "JavaScript error on hiring page of corporate website"
        }
    }
}

Human Readable Output

ServiceNow ticket updated successfully

Ticket type: incident

Active	Created By	Created On	Description	Impact	Number	Opened At	Priority	Severity	Short Description	State	System ID	Urgency
true	admin	2020-01-26 00:43:54	Seeing JavaScript error message on hiring page on Explorer and Firefox.	2 - Medium	INC0000040	2020-01-26 00:42:45	3 - Moderate	2 - Medium	JavaScript error on hiring page of corporate website	3 - On Hold	471d4732a9fe198100affbf655e59172	2 - Medium

servicenow-delete-ticket

Deletes a ticket from ServiceNow.

Base Command

servicenow-delete-ticket

Input

Context Output

Command Example

!servicenow-delete-ticket id=existingId"

Human Readable Output

Ticket with ID id was successfully deleted from incident table.

Context Example

{
    "ServiceNow": {
        "Ticket": {
            "ID": "id",
            "DeleteMessage": "Ticket with ID id was successfully deleted from incident table.",
        }
    }
}

servicenow-query-tickets

Retrieves ticket information according to the supplied query.

Base Command

servicenow-query-tickets

Input

Context Output

Command Example

!servicenow-query-tickets limit="3" query="impact<2^short_descriptionISNOTEMPTY" ticket_type="incident"

Context Example

{
    "ServiceNow": {
        "Ticket": [
            {
                "Active": "false",
                "Assignee": "admin",
                "CloseCode": "Closed/Resolved by Caller",
                "CreatedOn": "2018-08-24 18:24:13",
                "Creator": "admin",
                "ID": "id",
                "Number": "INC0000001",
                "OpenedAt": "2020-01-23 23:09:51",
                "OpenedBy": "admin",
                "Priority": "1 - Critical",
                "ResolvedBy": "admin",
                "State": "7",
                "Summary": "Can't read email"
            },
            {
                "Active": "true",
                "Assignee": "admin",
                "CreatedOn": "2018-08-13 22:30:06",
                "Creator": "admin",
                "ID": "id",
                "Number": "INC0000002",
                "OpenedAt": "2020-01-17 23:07:12",
                "OpenedBy": "admin",
                "Priority": "1 - Critical",
                "State": "3",
                "Summary": "Network file shares access issue"
            },
            {
                "Active": "true",
                "Assignee": "admin",
                "CreatedOn": "2018-08-28 14:41:46",
                "Creator": "admin",
                "ID": "id",
                "Number": "INC0000003",
                "OpenedAt": "2020-01-24 23:07:30",
                "OpenedBy": "admin",
                "Priority": "1 - Critical",
                "State": "2",
                "Summary": "Wireless access is down in my area"
            }
        ]
    },
    "Ticket": [
        {
            "Active": "false",
            "Assignee": "admin",
            "CloseCode": "Closed/Resolved by Caller",
            "CreatedOn": "2018-08-24 18:24:13",
            "Creator": "admin",
            "ID": "id",
            "Number": "INC0000001",
            "OpenedAt": "2020-01-23 23:09:51",
            "OpenedBy": "admin",
            "Priority": "1 - Critical",
            "ResolvedBy": "admin",
            "State": "7",
            "Summary": "Can't read email"
        },
        {
            "Active": "true",
            "Assignee": "admin",
            "CreatedOn": "2018-08-13 22:30:06",
            "Creator": "admin",
            "ID": "id",
            "Number": "INC0000002",
            "OpenedAt": "2020-01-17 23:07:12",
            "OpenedBy": "admin",
            "Priority": "1 - Critical",
            "State": "3",
            "Summary": "Network file shares access issue"
        },
        {
            "Active": "true",
            "Assignee": "admin",
            "CreatedOn": "2018-08-28 14:41:46",
            "Creator": "admin",
            "ID": "id",
            "Number": "INC0000003",
            "OpenedAt": "2020-01-24 23:07:30",
            "OpenedBy": "admin",
            "Priority": "1 - Critical",
            "State": "2",
            "Summary": "Wireless access is down in my area"
        }
    ]
}

Human Readable Output

ServiceNow tickets

System ID	Number	Impact	Urgency	Severity	Priority	State	Created On	Created By	Active	Close Notes	Close Code	Description	Opened At	Resolved By	Resolved At	Short Description
id	INC0000001	1 - High	1 - High	1 - High	1 - Critical	7 - Closed	2018-08-24 18:24:13	pat	false	Closed before close notes were made mandatory	Closed/Resolved by Caller	User can’t access email on mail.company.com.	2020-01-23 23:09:51	admin	2020-04-24 19:56:12	Can’t read email
id	INC0000002	1 - High	1 - High	1 - High	1 - Critical	3 - On Hold	2018-08-13 22:30:06	pat	true			User can’t get to any of his files on the file server.	2020-01-17 23:07:12			Network file shares access issue
id	INC0000003	1 - High	1 - High	1 - High	1 - Critical	2 - In Progress	2018-08-28 14:41:46	admin	true			I just moved from floor 2 to floor 3 and my laptop cannot connect to any wireless network.	2020-01-24 23:07:30			Wireless access is down in my area

servicenow-add-link

Adds a link to the specified ticket.

Base Command

servicenow-add-link

Input

Context Output

There is no context output for this command.

Command Example

!servicenow-add-link id=id link="http://www.demisto.com" text=demsito_link

Context Example

{}

Human Readable Output

Link successfully added to ServiceNow ticket

System ID	Number	Impact	Urgency	Severity	Priority	State	Created On	Created By	Active	Description	Opened At	Short Description
id	INC0000040	2 - Medium	2 - Medium	2 - Medium	3 - Moderate	3 - On Hold	2020-01-26 00:43:54	admin	true	Seeing JavaScript error message on hiring page on Explorer and Firefox.	2020-01-26 00:42:45	JavaScript error on hiring page of corporate website

servicenow-add-comment

Adds a comment to the specified ticket, by ticket ID.

Base Command

servicenow-add-comment

Input

Context Output

There is no context output for this command.

Command Example

!servicenow-add-comment id=id comment="Nice work!"

Context Example

{}

Human Readable Output

Comment successfully added to ServiceNow ticket

System ID	Number	Impact	Urgency	Severity	Priority	State	Created On	Created By	Active	Description	Opened At	Short Description
id	INC0000040	2 - Medium	2 - Medium	2 - Medium	3 - Moderate	3 - On Hold	2020-01-26 00:43:54	admin	true	Seeing JavaScript error message on hiring page on Explorer and Firefox.	2020-01-26 00:42:45	JavaScript error on hiring page of corporate website

servicenow-upload-file

Uploads a file to the specified ticket.

Base Command

servicenow-upload-file

Input

Context Output

Command Example

!servicenow-upload-file id="{TicketID}" ticket_type="incident" file_id="123@456"

Context Example

{
    "ServiceNow": {
        "Ticket": {
            "File": {
                "Filename": "test.txt",
                "Link": "https://{ServerURL}/api/now/attachment/{SystemID}/file",
                "SystemID": "{SystemID}"
            },
            "ID": "{TicketID}"
        }
    },
    "Ticket": {
        "File": {
            "Filename": "test.txt",
            "Link": "https://{TicketID}/api/now/attachment/{SystemID}/file",
            "SystemID": "{SystemID}"
        },
        "ID": "{TicketID}"
    }
}

Human Readable Output

File uploaded successfully to ticket {TICKET ID}

Download link	Filename	System ID
https://{ServerURL}/api/now/attachment/{SystemID}/file	test.txt	{SystemID}

servicenow-delete-file

Delete an attachment from a ticket.

Base Command

servicenow-delete-file

Input

Context Output

There is no context output for this command.

Command example

!servicenow-delete-file file_sys_id=1234

Human Readable Output

Attachment with Sys ID 1234 was successfully deleted.

servicenow-get-record

Retrieves record information, by record ID.

Base Command

servicenow-get-record

Input

Context Output

Command Example

!servicenow-get-record table_name=alm_asset id=id fields=asset_tag,sys_updated_by,display_name

Context Example

{
    "ServiceNow": {
        "Record": {
            "ID": "id",
            "asset_tag": "P1000807",
            "display_name": "P1000807 - Apple MacBook Pro 17\"",
            "sys_updated_by": "system"
        }
    }
}

Human Readable Output

ServiceNow record

ID	asset_tag	display_name	sys_updated_by
id	P1000807	P1000807 - Apple MacBook Pro 17”	system

servicenow-query-table

Queries the specified table in ServiceNow.

Base Command

servicenow-query-table

Input

Context Output

Command Example

!servicenow-query-table table_name=alm_asset fields=asset_tag,sys_updated_by,display_name query=display_nameCONTAINSMacBook limit=4
!servicenow-query-table table_name=sys_journal_field query=element_id=<SYS_ID>^ORDERBYsys_created_on limit=10 fields=value,name,element,sys_created_by,sys_created_on

Context Example

{
    "ServiceNow": {
        "Record": [
            {
                "ID": "id",
                "asset_tag": "P1000637",
                "display_name": "P1000637 - Apple MacBook Air 13\"",
                "sys_updated_by": "system"
            },
            {
                "ID": "id",
                "asset_tag": "P1000412",
                "display_name": "P1000412 - Apple MacBook Pro 17\"",
                "sys_updated_by": "system"
            },
            {
                "ID": "id",
                "asset_tag": "P1000563",
                "display_name": "P1000563 - Apple MacBook Pro 15\"",
                "sys_updated_by": "system"
            },
            {
                "ID": "id",
                "asset_tag": "P1000626",
                "display_name": "P1000626 - Apple MacBook Air 13\"",
                "sys_updated_by": "system"
            }
        ]
    }
}

Human Readable Output

ServiceNow records

ID	asset_tag	display_name	sys_updated_by
id	P1000637	P1000637 - Apple MacBook Air 13”	system
id	P1000412	P1000412 - Apple MacBook Pro 17”	system
id	P1000563	P1000563 - Apple MacBook Pro 15”	system
id	P1000626	P1000626 - Apple MacBook Air 13”	system

servicenow-create-record

Creates a new record in the specified ServiceNow table.

Base Command

servicenow-create-record

Input

For more information regarding the input_display_value argument, see: https://docs.servicenow.com/bundle/xanadu-platform-administration/page/administer/exporting-data/concept/query-parameters-display-value.html

Context Output

Command Example

!servicenow-create-record table_name=alm_asset fields="asset_tag=P1000807"

Context Example

{
    "ServiceNow": {
        "Record": {
            "CreatedAt": "2020-05-10 09:04:27",
            "CreatedBy": "admin",
            "ID": "id",
            "UpdatedAt": "2020-05-10 09:04:27",
            "UpdatedBy": "admin"
        }
    }
}

Human Readable Output

ServiceNow record created successfully

CreatedAt	CreatedBy	ID	UpdatedAt	UpdatedBy
2020-05-10 09:04:27	admin	id	2020-05-10 09:04:27	admin

servicenow-update-record

Updates a record in the specified ServiceNow table.

Base Command

servicenow-update-record

Input

For more information regarding the input_display_value argument, see: https://docs.servicenow.com/bundle/xanadu-platform-administration/page/administer/exporting-data/concept/query-parameters-display-value.html

Context Output

Command Example

!servicenow-update-record table_name=alm_asset id=id custom_fields="display_name=test4"

Context Example

{
    "ServiceNow": {
        "Record": {
            "CreatedAt": "2019-07-16 08:14:09",
            "CreatedBy": "admin",
            "ID": "id",
            "UpdatedAt": "2020-05-09 19:08:42",
            "UpdatedBy": "system"
        }
    }
}

Human Readable Output

ServiceNow record with ID 01a92c0d3790200044e0bfc8bcbe5d36 updated successfully

CreatedAt	CreatedBy	ID	UpdatedAt	UpdatedBy
2019-07-16 08:14:09	admin	id	2020-05-09 19:08:42	system

servicenow-delete-record

Deletes a record in the specified ServiceNow table.

Base Command

servicenow-delete-record

Input

Context Output

There is no context output for this command.

Command Example

!servicenow-delete-record table_name=alm_asset id=id

Context Example

{}

Human Readable Output

ServiceNow record with ID id was successfully deleted.

servicenow-list-table-fields

Lists API fields for the specified ServiceNow table.

Base Command

servicenow-list-table-fields

Input

Context Output

Command Example

!servicenow-list-table-fields table_name=alm_asset

Context Example

{
    "ServiceNow": {
        "Field": [
            {
                "Name": "parent"
            },
            {
                "Name": "skip_sync"
            },
            {
                "Name": "residual_date"
            },
            {
                "Name": "residual"
            },
            {
                "Name": "sys_updated_on"
            },
            {
                "Name": "request_line"
            },
            {
                "Name": "sys_updated_by"
            },
            {
                "Name": "due_in"
            },
            {
                "Name": "model_category"
            },
            {
                "Name": "sys_created_on"
            },
            {
                "Name": "sys_domain"
            },
            {
                "Name": "disposal_reason"
            },
            {
                "Name": "model"
            },
            {
                "Name": "install_date"
            },
            {
                "Name": "gl_account"
            },
            {
                "Name": "invoice_number"
            },
            {
                "Name": "sys_created_by"
            },
            {
                "Name": "warranty_expiration"
            },
            {
                "Name": "depreciated_amount"
            },
            {
                "Name": "substatus"
            },
            {
                "Name": "pre_allocated"
            },
            {
                "Name": "owned_by"
            },
            {
                "Name": "checked_out"
            },
            {
                "Name": "display_name"
            },
            {
                "Name": "sys_domain_path"
            },
            {
                "Name": "delivery_date"
            },
            {
                "Name": "retirement_date"
            },
            {
                "Name": "beneficiary"
            },
            {
                "Name": "install_status"
            },
            {
                "Name": "cost_center"
            },
            {
                "Name": "supported_by"
            },
            {
                "Name": "assigned"
            },
            {
                "Name": "purchase_date"
            },
            {
                "Name": "work_notes"
            },
            {
                "Name": "managed_by"
            },
            {
                "Name": "sys_class_name"
            },
            {
                "Name": "sys_id"
            },
            {
                "Name": "po_number"
            },
            {
                "Name": "stockroom"
            },
            {
                "Name": "checked_in"
            },
            {
                "Name": "resale_price"
            },
            {
                "Name": "vendor"
            },
            {
                "Name": "company"
            },
            {
                "Name": "retired"
            },
            {
                "Name": "justification"
            },
            {
                "Name": "department"
            },
            {
                "Name": "expenditure_type"
            },
            {
                "Name": "depreciation"
            },
            {
                "Name": "assigned_to"
            },
            {
                "Name": "depreciation_date"
            },
            {
                "Name": "old_status"
            },
            {
                "Name": "comments"
            },
            {
                "Name": "cost"
            },
            {
                "Name": "quantity"
            },
            {
                "Name": "acquisition_method"
            },
            {
                "Name": "ci"
            },
            {
                "Name": "sys_mod_count"
            },
            {
                "Name": "old_substatus"
            },
            {
                "Name": "sys_tags"
            },
            {
                "Name": "order_date"
            },
            {
                "Name": "support_group"
            },
            {
                "Name": "reserved_for"
            },
            {
                "Name": "due"
            },
            {
                "Name": "location"
            },
            {
                "Name": "lease_id"
            },
            {
                "Name": "salvage_value"
            }
        ]
    }
}

Human Readable Output

ServiceNow Table fields - alm_asset

Name
parent
skip_sync
residual_date
residual
sys_updated_on
request_line
sys_updated_by
due_in
model_category
sys_created_on
sys_domain
disposal_reason
model
install_date
gl_account
invoice_number
sys_created_by
warranty_expiration
depreciated_amount
substatus
pre_allocated
owned_by
checked_out
display_name
sys_domain_path
delivery_date
retirement_date
beneficiary
install_status
cost_center
supported_by
assigned
purchase_date
work_notes
managed_by
sys_class_name
sys_id
po_number
stockroom
checked_in
resale_price
vendor
company
retired
justification
department
expenditure_type
depreciation
assigned_to
depreciation_date
old_status
comments
cost
quantity
acquisition_method
ci
sys_mod_count
old_substatus
sys_tags
order_date
support_group
reserved_for
due
location
lease_id
salvage_value

servicenow-query-computers

Queries the cmdb_ci_computer table in ServiceNow.

Base Command

servicenow-query-computers

Input

Context Output

Command Example

!servicenow-query-computers asset_tag=P1000412

Context Example

{
    "ServiceNow": {
        "Computer": {
            "AssetTag": "P1000412",
            "AssignedTo": "admin",
            "Company": "admin",
            "Cost": "2499.99 USD",
            "DisplayName": "P1000412 - MacBook Pro 17\"",
            "ID": "id",
            "Name": "MacBook Pro 17\"",
            "OperatingSystem": "Mac OS 10 (OS/X)",
            "State": "In use"
        }
    }
}

Human Readable Output

ServiceNow Computers

ID	Asset Tag	Name	Display Name	Operating System	Company	Assigned To	State	Cost
id	P1000412	MacBook Pro 17”	P1000412 - MacBook Pro 17”	Mac OS 10 (OS/X)	admin	admin	In use	2499.99 USD

servicenow-query-groups

Queries the sys_user_group table in ServiceNow.

Base Command

servicenow-query-groups

Input

Context Output

Command Example

!servicenow-query-groups group_name=test1

Context Example

{}

Human Readable Output

No groups found.

servicenow-query-users

Queries the sys_user table in ServiceNow.

Base Command

servicenow-query-users

Input

Context Output

Command Example

!servicenow-query-users user_name=sean.bonnet

Context Example

{
    "ServiceNow": {
        "User": {
            "Created": "2012-02-18 03:04:50",
            "Email": "sean.bonnet@example.com",
            "ID": "id",
            "Name": "Sean Testman",
            "Updated": "2020-04-25 19:01:46",
            "UserName": "sean.bonnet"
        }
    }
}

Human Readable Output

ServiceNow Users

ID	Name	User Name	Email	Created	Updated
id	Sean Testman	sean.bonnet	sean.bonnet@example.com	2012-02-18 03:04:50	2020-04-25 19:01:46

servicenow-get-table-name

Gets table names by a label to use in commands.

Base Command

servicenow-get-table-name

Input

Context Output

Command Example

!servicenow-get-table-name label=ACE

Context Example

{
    "ServiceNow": {
        "Table": {
            "ID": "id",
            "Name": "cmdb_ci_lb_ace",
            "SystemName": "CMDB CI Lb Ace"
        }
    }
}

Human Readable Output

ServiceNow Tables for label - ACE

ID	Name	System Name
id	cmdb_ci_lb_ace	CMDB CI Lb Ace

servicenow-get-ticket-notes

Gets notes from the specified ServiceNow ticket. Notes can be retrieved either by granting Read permissions for the sys_journal_field table, or by setting the use_display_value parameter to true.

Base Command

servicenow-get-ticket-notes

Input

Context Output

Command Example

!servicenow-get-ticket-notes id=id

Context Example

{
    "ServiceNow": {
        "Ticket": {
            "ID": "id",
            "Note": [
                {
                    "CreatedBy": "admin",
                    "CreatedOn": "2020-01-26 00:43:54",
                    "Type": "Comment",
                    "Value": "JavaScript error (line 202) on the home page. Not sure what is\n\t\t\tgoing on, does not happen on my Windows machine!\n\t\t"
                },
                {
                    "CreatedBy": "admin",
                    "CreatedOn": "2020-04-17 23:12:43",
                    "Type": "Comment",
                    "Value": "Added an attachment"
                },
                {
                    "CreatedBy": "admin",
                    "CreatedOn": "2020-05-10 09:04:15",
                    "Type": "Work Note",
                    "Value": "[code]<a class=\"web\" target=\"_blank\" href=\"http://www.demisto.com\" >demsito_link</a>[/code]"
                },
                {
                    "CreatedBy": "admin",
                    "CreatedOn": "2020-05-10 09:04:18",
                    "Type": "Work Note",
                    "Value": "Nice work!"
                }
            ]
        }
    }
}

Human Readable Output

ServiceNow notes for ticket 471d4732a9fe198100affbf655e59172

Value	Created On	Created By	Type
JavaScript error (line 202) on the home page. Not sure what is going on, does not happen on my Windows machine!	2020-01-26 00:43:54	admin	Comment
Added an attachment	2020-04-17 23:12:43	admin	Comment
[code]demsito_link[/code]	2020-05-10 09:04:15	admin	Work Note
Nice work!	2020-05-10 09:04:18	admin	Work Note

servicenow-add-tag

Adds a tag to a ticket. The tag will be visible in the label_entry table and can be retrieved using the “!servicenow-query-table table_name=label_entry fields=title,table,sys_id,id_display,id_type” command.

Base Command

servicenow-add-tag

Input

Context Output

servicenow-query-items

Queries the sc_cat_item table in ServiceNow.

Base Command

servicenow-query-items

Input

Context Output

Command Example

!servicenow-query-items name=laptop limit=2

Context Example

{
    "ServiceNow": {
        "CatalogItem": [
            {
                "Description": "Lenovo - Carbon x1",
                "ID": "id",
                "Name": "Standard Laptop",
                "Price": "1100"
            },
            {
                "Description": "Dell XPS 13",
                "ID": "id",
                "Name": "Development Laptop (PC)",
                "Price": "1100"
            }
        ]
    }
}

Human Readable Output

ServiceNow Catalog Items

ID	Name	Price	Description
id	Standard Laptop	1100	Lenovo - Carbon x1
id	Development Laptop (PC)	1100	Dell XPS 13

servicenow-get-item-details

Retrieves item details by system ID.

Base Command

servicenow-get-item-details

Input

Context Output

Command Example

!servicenow-get-item-details id=id

Context Example

{
    "ServiceNow": {
        "CatalogItem": {
            "Description": "Dell XPS 13",
            "ID": "id",
            "Name": "Development Laptop (PC)",
            "Price": "$1,000.00",
            "Variables": [
                {
                    "Mandatory": false,
                    "Name": "hard_drive",
                    "Question": "What size solid state drive do you want?",
                    "Type": "Multiple Choice"
                },
                {
                    "Mandatory": false,
                    "Name": "requested_os",
                    "Question": "Please specify an operating system",
                    "Type": "Multiple Choice"
                }
            ]
        }
    }
}

Human Readable Output

ServiceNow Catalog Item

ID	Name	Description
id	Development Laptop (PC)	Dell XPS 13

Item Variables

Question	Type	Name	Mandatory
What size solid state drive do you want?	Multiple Choice	hard_drive	false
Please specify an operating system	Multiple Choice	requested_os	false

servicenow-create-item-order

Orders the specified catalog item.

Base Command

servicenow-create-item-order

Input

Context Output

Command Example

!servicenow-create-item-order id=id quantity=1 variables="hard_drive=16GB;requested_os=linux"

Context Example

{
    "ServiceNow": {
        "OrderRequest": {
            "ID": "id",
            "RequestNumber": "REQ0010004"
        }
    }
}

Human Readable Output

ServiceNow Order Request

ID	Request Number
id	REQ0010004

servicenow-document-route-to-queue

Documents a route to a queue. Requires an installation of the Advanced Work Assignments plugin. An active queue and service channel to the designated table.

Base Command

servicenow-document-route-to-queue

Input

Context Output

get-mapping-fields

Returns the list of fields for an incident type. This command is for debugging purposes.

Base Command

get-mapping-fields

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

get-remote-data

Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

Base Command

get-remote-data

Input

Context Output

There is no context output for this command.

servicenow-get-tasks-for-co

gets the tasks associated to change request

Base Command

servicenow-get-tasks-for-co

Input

Context Output

Command example

!servicenow-get-tasks-for-co id="1234"

Context Example

{
    "ServiceNow": {
        "Tasks": {
            "ServiceNow.Tasks(val.ID===obj.ID)": [
                {
                    "Description": "test",
                    "ID": "1234",
                    "Name": "CTASK0010007",
                    "State": "1 - New"
                }
            ]
        }
    }
}

Human Readable Output

ServiceNow Catalog Items

ID	Name	State	Description
1234	CTASK0010007	1 - New	test

servicenow-create-co-from-template

Create a change request from a template.

Base Command

servicenow-create-co-from-template

Input

Context Output

Command example

!servicenow-create-co-from-template template=1234

Context Example

{
    "ServiceNow": {
        "Ticket": {
            "ServiceNow.Ticket(val.ID===obj.ID)": {
                "Active": {
                    "display_value": "true",
                    "value": true
                },
                "AdditionalComments": {
                    "display_value": "",
                    "value": ""
                },
                "CloseCode": {
                    "display_value": "",
                    "value": ""
                },
                "CreatedOn": {
                    "display_value": "03/05/2022 08:17:00",
                    "display_value_internal": "2022-05-03 08:17:00",
                    "value": "2022-05-03 15:17:00"
                },
                "Creator": "1234",
                "ID": {
                    "display_value": "1234",
                    "value": "1234"
                },
                "Number": {
                    "display_value": "CHG001234",
                    "value": "CHG001234"
                },
                "OpenedAt": {
                    "display_value": "03/05/2022 08:17:00",
                    "display_value_internal": "2022-05-03 08:17:00",
                    "value": "2022-05-03 15:17:00"
                },
                "OpenedBy": "1234",
                "Priority": [
                    "4 - Low"
                ],
                "State": {
                    "display_value": "New",
                    "value": -5
                },
                "Summary": {
                    "display_value": "Add network switch to cabinet",
                    "value": "Add network switch to cabinet"
                }
            },
            "Ticket(val.ID===obj.ID)": {
                "Active": {
                    "display_value": "true",
                    "value": true
                },
                "AdditionalComments": {
                    "display_value": "",
                    "value": ""
                },
                "CloseCode": {
                    "display_value": "",
                    "value": ""
                },
                "CreatedOn": {
                    "display_value": "03/05/2022 08:17:00",
                    "display_value_internal": "2022-05-03 08:17:00",
                    "value": "2022-05-03 15:17:00"
                },
                "Creator": "1234",
                "ID": {
                    "display_value": "1234",
                    "value": "1234"
                },
                "Number": {
                    "display_value": "CHG001234",
                    "value": "CHG001234"
                },
                "OpenedAt": {
                    "display_value": "03/05/2022 08:17:00",
                    "display_value_internal": "2022-05-03 08:17:00",
                    "value": "2022-05-03 15:17:00"
                },
                "OpenedBy": "6b0e49021b158150042611b4bd4bcb5e",
                "Priority": [
                    "4 - Low"
                ],
                "State": {
                    "display_value": "New",
                    "value": -5
                },
                "Summary": {
                    "display_value": "Add network switch to cabinet",
                    "value": "Add network switch to cabinet"
                }
            }
        }
    }
}

Human Readable Output

ServiceNow ticket was created successfully

System ID	Number	Impact	Urgency	Priority	State	Created On	Created By	Active	Description	Opened At	Short Description
1234	CHG001234	3 - Ministry	3 - Low	4 - Low	-5 - New	2022-05-03 15:17:00	admin_cnt_test_Jan2022-01	true	This standard change template describes adding a new network switch to a datacenter cabinet	2022-05-03 15:17:00	Add network switch to cabinet

servicenow-generic-api-call

Generic call to ServiceNow api

Base Command

servicenow-generic-api-call

Input

Context Output

Command example

!servicenow-generic-api-call method=GET path="/table/sn_cmdb_workspace_cmdb_ci_demo"

Context Example

{
    "ServiceNow": {
        "Generic": {
            "Response": {
                "result": [
                    {
                        "sys_created_by": "admin_test_Nov2020-01",
                        "sys_created_on": "2021-02-13 13:36:55",
                        "sys_id": "1234",
                        "sys_mod_count": "0",
                        "sys_tags": "",
                        "sys_updated_by": "admin_test_Nov2020-01",
                        "sys_updated_on": "2021-02-13 13:36:55"
                    }
                ]
            }
        }
    }
}

Human Readable Output

Request for GET method is successful

servicenow-get-ticket-attachments

Retrieve file attachments from tickets.

Base Command

servicenow-get-ticket-attachments

Input

Context Output

There is no context output for this command.

Human Readable Output

Successfully retrieved attachments for ticket with sys id 111

Troubleshooting

The following are tips for handling issues with mirroring incidents between ServiceNow and Cortex XSOAR.