Create ServiceNow Ticket

id: Create ServiceNow Ticket
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Create ServiceNow Ticket
description: "Create ServiceNow Ticket allows you to open new tickets as a task from a parent playbook.\nWhen creating the ticket, you can decide to update based on on the ticket's state, which will wait for the ticket to resolve or close with StatePolling. \nAlternatively, you can select to mirror the ServiceNow ticket and incident fields. To apply either of these options, set the SyncTicket value in the playbook inputs to one of the following options: \n1. StatePolling\n2. Mirror\n3. Leave Blank to use none."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a0382e94-db15-42d5-8555-1b9da12dbe02
    type: start
    task:
      id: a0382e94-db15-42d5-8555-1b9da12dbe02
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: a90ee65d-6502-423e-8527-feb58987e15d
    type: title
    task:
      id: a90ee65d-6502-423e-8527-feb58987e15d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: ccbdd637-fa6d-4c61-8c8f-5335843393b4
    type: condition
    task:
      id: ccbdd637-fa6d-4c61-8c8f-5335843393b4
      version: -1
      name: Mirror or State Polling?
      description: Check for a playbook input to indicate which sync mode was selected.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      Mirror:
      - "11"
      State Polling:
      - "12"
    separatecontext: false
    conditions:
    - label: Mirror
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.SyncTicket
            iscontext: true
          right:
            value:
              simple: Mirror
    - label: State Polling
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.SyncTicket
            iscontext: true
          right:
            value:
              simple: StatePolling
    view: |-
      {
        "position": {
          "x": 450,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: e19b8ff2-09e8-4991-8b5b-fc0e9c3af1fd
    type: playbook
    task:
      id: e19b8ff2-09e8-4991-8b5b-fc0e9c3af1fd
      version: -1
      name: Mirror ServiceNow Ticket
      description: |-
        Mirror ServiceNow Ticket is designed to serve as a sub-playbook, which enables ticket mirroring with ServiceNow.
        It enables you to manage ServiceNow tickets in Cortex xSOAR while data is continuously synced between ServiceNow and Cortex XSOAR, including ServiceNow schema, fields, comments, work notes, and attachments.
        To enable out-of-the-box mirroring, use the ServiceNow Create ticket - common mappers for incoming and outgoing mirroring.

        FieldPolling - You can set the FieldPolling value to true if you only want to be informed when the ticket is resolved or closed. If FieldPolling is set to true, the FieldPolling Playbook will poll for the state (ServiceNow State field) of the ServiceNow ticket until it is marked as either resolved or closed.

        In addition to the playbook, Palo Alto Networks recommends that you use the included layout for ServiceNow Ticket, which helps visualize ServiceNow ticket information in Cortex XSOAR.
        You can add the new layout as a tab to existing layouts using the Edit Layout page.
      playbookName: Mirror ServiceNow Ticket
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      'FieldPolling ':
        complex:
          root: inputs.FieldPolling
      FieldPollingInterval:
        complex:
          root: inputs.PollingInterval
      FieldPollingTimeout:
        complex:
          root: inputs.PollingTimeout
      IncidentID:
        complex:
          root: ServiceNow.Ticket
          accessor: ID
      MirrorCommentTags:
        complex:
          root: inputs.MirrorCommentTags
      MirrorDirection:
        complex:
          root: inputs.MirrorDirection
      MirrorInstanceName:
        complex:
          root: inputs.InstanceName
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 830,
          "y": 800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 1d87781e-ad25-4ba4-8b68-d4d803e85cf6
    type: playbook
    task:
      id: 1d87781e-ad25-4ba4-8b68-d4d803e85cf6
      version: -1
      name: ServiceNow Ticket State Polling
      playbookName: ServiceNow Ticket State Polling
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      AdditionalPollingCommandName:
        complex:
          root: inputs.AdditionalPollingCommandName
      InstanceName:
        complex:
          root: inputs.InstanceName
      Interval:
        complex:
          root: inputs.PollingInterval
      TicketNumber:
        complex:
          root: ServiceNow.Ticket
          accessor: Number
      Timeout:
        complex:
          root: inputs.PollingTimeout
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 70,
          "y": 800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: c5b89716-e739-462c-817d-29ad856a6034
    type: regular
    task:
      id: c5b89716-e739-462c-817d-29ad856a6034
      version: -1
      name: Create ServiceNow ticket
      description: Creates a ServiceNow ticket.
      script: ServiceNow v2|||servicenow-create-ticket
      type: regular
      iscommand: true
      brand: ServiceNow v2
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      assignment_group:
        complex:
          root: inputs.AssignmentGroup
      caller_id:
        complex:
          root: ServiceNow.User
          accessor: ID
      category:
        complex:
          root: inputs.Category
      comments:
        complex:
          root: inputs.Comment
      impact:
        complex:
          root: inputs.Impact
      severity:
        complex:
          root: 'inputs.Severity '
      short_description:
        complex:
          root: inputs.ShortDescription
      ticket_type:
        complex:
          root: inputs.TicketType
      urgency:
        complex:
          root: inputs.Urgency
      using:
        complex:
          root: inputs.InstanceName
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 79b53716-fe00-4c51-842a-b767f499a498
    type: condition
    task:
      id: 79b53716-fe00-4c51-842a-b767f499a498
      version: -1
      name: Is InstanceName empty?
      description: Check if there is a playbook input named InstanceName to use it as a ServiceNow instance for the task.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEmpty
          left:
            value:
              simple: inputs.InstanceName
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 450,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 6d1433ef-9414-4cc5-8102-a26119a81bba
    type: regular
    task:
      id: 6d1433ef-9414-4cc5-8102-a26119a81bba
      version: -1
      name: Create ServiceNow ticket (without using InstanceName)
      description: Creates a ServiceNow ticket without using InstanceName, directly to the default ServiceNow instance.
      script: ServiceNow v2|||servicenow-create-ticket
      type: regular
      iscommand: true
      brand: ServiceNow v2
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      assignment_group:
        complex:
          root: inputs.AssignmentGroup
      caller_id:
        complex:
          root: ServiceNow.User
          accessor: ID
      category:
        complex:
          root: inputs.Category
      comments:
        complex:
          root: inputs.Comment
      impact:
        complex:
          root: inputs.Impact
      severity:
        complex:
          root: 'inputs.Severity '
      short_description:
        complex:
          root: inputs.ShortDescription
      ticket_type:
        complex:
          root: inputs.TicketType
      urgency:
        complex:
          root: inputs.Urgency
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 680,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "14_13_#default#": 0.52,
      "14_15_yes": 0.51,
      "9_11_Mirror": 0.52,
      "9_12_State Polling": 0.46,
      "9_8_#default#": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 985,
        "width": 1140,
        "x": 70,
        "y": 60
      }
    }
  }
inputs:
- key: Category
  value: {}
  required: false
  description: The category of the ServiceNow Ticket.
  playbookInputQuery:
- key: AssignmentGroup
  value: {}
  required: false
  description: The group to which to assign the new ticket.
  playbookInputQuery:
- key: ShortDescription
  value: {}
  required: false
  description: A short description of the ticket.
  playbookInputQuery:
- key: Impact
  value: {}
  required: false
  description: The impact for the new ticket. Leave empty for ServiceNow default impact.
  playbookInputQuery:
- key: Urgency
  value: {}
  required: false
  description: The urgency of the new ticket. Leave empty for ServiceNow default urgency.
  playbookInputQuery:
- key: 'Severity '
  value: {}
  required: false
  description: The severity of the new ticket. Leave empty for ServiceNow default severity.
  playbookInputQuery:
- key: Comment
  value: {}
  required: false
  description: A comment for the created ticket.
  playbookInputQuery:
- key: SyncTicket
  value:
    simple: Mirror
  required: false
  description: "The value of the desired sync method with ServiceNow Ticket. You can choose one of the following options:\n1. StatePolling\n2. Mirror \n3. Blank for none \n\nGenericPolling polls for the state of the ticket and runs until the ticket state is either resolved or closed. \n\nMirror - You can use the Mirror option to perform a full sync with the ServiceNow Ticket. The ticket data is synced automatically between ServiceNow and Cortex XSOAR with the ServiceNow mirror feature.\nIf this option is selected, FieldPolling is true by default."
  playbookInputQuery:
- key: PollingInterval
  value: {}
  required: false
  description: |-
    The interval time (in minutes) for the polling to run.
  playbookInputQuery:
- key: PollingTimeout
  value: {}
  required: false
  description: |-
    The amount of time (in minutes) to poll the status of the ticket before declaring a timeout and resuming the playbook.
  playbookInputQuery:
- key: AdditionalPollingCommandName
  value: {}
  required: false
  description: "In this use case, additional polling commands are relevant when using StatePolling, and there is more than one ServiceNow instance. It will specify the polling command to use a specific instance to run on. \nIf so, add \"Using\" to the value. \nThe playbook will then take the instance name as the instance to use.\"  the polling command to use a specific instance to run on. \nIf so, please add \"using\" to the value. \nThe playbook will then take the instance name as the instance to use."
  playbookInputQuery:
- key: InstanceName
  value:
    simple:
  required: false
  description: |
    The ServiceNow instance that will be used for mirroring/running polling commands.
  playbookInputQuery:
- key: MirrorDirection
  value:
    simple: Both
  required: false
  description: "The mirror direction. It should be one of the following: \n1. In\n2. Out\n3. Both"
  playbookInputQuery:
- key: MirrorCommentTags
  value:
    simple: comments,work_notes,ForServiceNow
  required: false
  description: The tags for mirror comments and files to ServiceNow.
  playbookInputQuery:
- key: FieldPolling
  value: {}
  required: false
  description: |-
    Set the value to true or false to determine if the playbook will execute the FieldPolling sub-playbook.
    It is useful when it is needed to wait for the ServiceNow ticket to be resolved and continue the parent playbook.
    FieldPolling will run until the ticket state is either resolved or closed.
  playbookInputQuery:
- key: TicketType
  value: {}
  required: false
  description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
  playbookInputQuery:
outputs:
- contextPath: ServiceNow.Ticket.ID
  description: Ticket ID.
  type: string
- contextPath: ServiceNow.Ticket.OpenedBy
  description: Ticket opener ID.
  type: string
- contextPath: ServiceNow.Ticket.CreatedOn
  description: Ticket creation date.
  type: string
- contextPath: ServiceNow.Ticket.Assignee
  description: Ticket assignee ID.
  type: string
- contextPath: ServiceNow.Ticket.State
  description: Ticket state.
  type: string
- contextPath: ServiceNow.Ticket.Summary
  description: Ticket short summary.
  type: string
- contextPath: ServiceNow.Ticket.Number
  description: Ticket number.
  type: string
- contextPath: ServiceNow.Ticket.Active
  description: Ticket active.
  type: string
- contextPath: ServiceNow.Ticket.AdditionalComments
  description: Ticket comments.
  type: string
- contextPath: ServiceNow.Ticket.Priority
  description: Ticket priority.
  type: string
- contextPath: ServiceNow.Ticket.OpenedAt
  description: Ticket opening time.
  type: string
- contextPath: ServiceNow.Ticket.ResolvedBy
  description: Ticket resolver ID.
  type: string
- contextPath: ServiceNow.Ticket.CloseCode
  description: Ticket close code.
  type: string
tests:
- Create ServiceNow Ticket and Mirror Test
- Create ServiceNow Ticket and State Polling Test
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam