id: Create ServiceNow Ticket version: -1 contentitemexportablefields: contentitemfields: {} name: Create ServiceNow Ticket description: "Create ServiceNow Ticket allows you to open new tickets as a task from a parent playbook.\nWhen creating the ticket, you can decide to update based on on the ticket's state, which will wait for the ticket to resolve or close with StatePolling. \nAlternatively, you can select to mirror the ServiceNow ticket and incident fields. To apply either of these options, set the SyncTicket value in the playbook inputs to one of the following options: \n1. StatePolling\n2. Mirror\n3. Leave Blank to use none." starttaskid: "0" tasks: "0": id: "0" taskid: a0382e94-db15-42d5-8555-1b9da12dbe02 type: start task: id: a0382e94-db15-42d5-8555-1b9da12dbe02 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "14" separatecontext: false view: |- { "position": { "x": 450, "y": 60 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: a90ee65d-6502-423e-8527-feb58987e15d type: title task: id: a90ee65d-6502-423e-8527-feb58987e15d version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 450, "y": 980 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: ccbdd637-fa6d-4c61-8c8f-5335843393b4 type: condition task: id: ccbdd637-fa6d-4c61-8c8f-5335843393b4 version: -1 name: Mirror or State Polling? description: Check for a playbook input to indicate which sync mode was selected. type: condition iscommand: false brand: "" nexttasks: '#default#': - "8" Mirror: - "11" State Polling: - "12" separatecontext: false conditions: - label: Mirror condition: - - operator: isEqualString left: value: complex: root: inputs.SyncTicket iscontext: true right: value: simple: Mirror - label: State Polling condition: - - operator: isEqualString left: value: complex: root: inputs.SyncTicket iscontext: true right: value: simple: StatePolling view: |- { "position": { "x": 450, "y": 580 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: e19b8ff2-09e8-4991-8b5b-fc0e9c3af1fd type: playbook task: id: e19b8ff2-09e8-4991-8b5b-fc0e9c3af1fd version: -1 name: Mirror ServiceNow Ticket description: |- Mirror ServiceNow Ticket is designed to serve as a sub-playbook, which enables ticket mirroring with ServiceNow. It enables you to manage ServiceNow tickets in Cortex xSOAR while data is continuously synced between ServiceNow and Cortex XSOAR, including ServiceNow schema, fields, comments, work notes, and attachments. To enable out-of-the-box mirroring, use the ServiceNow Create ticket - common mappers for incoming and outgoing mirroring. FieldPolling - You can set the FieldPolling value to true if you only want to be informed when the ticket is resolved or closed. If FieldPolling is set to true, the FieldPolling Playbook will poll for the state (ServiceNow State field) of the ServiceNow ticket until it is marked as either resolved or closed. In addition to the playbook, Palo Alto Networks recommends that you use the included layout for ServiceNow Ticket, which helps visualize ServiceNow ticket information in Cortex XSOAR. You can add the new layout as a tab to existing layouts using the Edit Layout page. playbookName: Mirror ServiceNow Ticket type: playbook iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: 'FieldPolling ': complex: root: inputs.FieldPolling FieldPollingInterval: complex: root: inputs.PollingInterval FieldPollingTimeout: complex: root: inputs.PollingTimeout IncidentID: complex: root: ServiceNow.Ticket accessor: ID MirrorCommentTags: complex: root: inputs.MirrorCommentTags MirrorDirection: complex: root: inputs.MirrorDirection MirrorInstanceName: complex: root: inputs.InstanceName separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 830, "y": 800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 1d87781e-ad25-4ba4-8b68-d4d803e85cf6 type: playbook task: id: 1d87781e-ad25-4ba4-8b68-d4d803e85cf6 version: -1 name: ServiceNow Ticket State Polling playbookName: ServiceNow Ticket State Polling type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "8" scriptarguments: AdditionalPollingCommandName: complex: root: inputs.AdditionalPollingCommandName InstanceName: complex: root: inputs.InstanceName Interval: complex: root: inputs.PollingInterval TicketNumber: complex: root: ServiceNow.Ticket accessor: Number Timeout: complex: root: inputs.PollingTimeout separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 70, "y": 800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: c5b89716-e739-462c-817d-29ad856a6034 type: regular task: id: c5b89716-e739-462c-817d-29ad856a6034 version: -1 name: Create ServiceNow ticket description: Creates a ServiceNow ticket. script: ServiceNow v2|||servicenow-create-ticket type: regular iscommand: true brand: ServiceNow v2 nexttasks: '#none#': - "9" scriptarguments: assignment_group: complex: root: inputs.AssignmentGroup caller_id: complex: root: ServiceNow.User accessor: ID category: complex: root: inputs.Category comments: complex: root: inputs.Comment impact: complex: root: inputs.Impact severity: complex: root: 'inputs.Severity ' short_description: complex: root: inputs.ShortDescription ticket_type: complex: root: inputs.TicketType urgency: complex: root: inputs.Urgency using: complex: root: inputs.InstanceName separatecontext: false view: |- { "position": { "x": 220, "y": 400 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 79b53716-fe00-4c51-842a-b767f499a498 type: condition task: id: 79b53716-fe00-4c51-842a-b767f499a498 version: -1 name: Is InstanceName empty? description: Check if there is a playbook input named InstanceName to use it as a ServiceNow instance for the task. type: condition iscommand: false brand: "" nexttasks: '#default#': - "13" "yes": - "15" separatecontext: false conditions: - label: "yes" condition: - - operator: isEmpty left: value: simple: inputs.InstanceName iscontext: true right: value: {} view: |- { "position": { "x": 450, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: 6d1433ef-9414-4cc5-8102-a26119a81bba type: regular task: id: 6d1433ef-9414-4cc5-8102-a26119a81bba version: -1 name: Create ServiceNow ticket (without using InstanceName) description: Creates a ServiceNow ticket without using InstanceName, directly to the default ServiceNow instance. script: ServiceNow v2|||servicenow-create-ticket type: regular iscommand: true brand: ServiceNow v2 nexttasks: '#none#': - "9" scriptarguments: assignment_group: complex: root: inputs.AssignmentGroup caller_id: complex: root: ServiceNow.User accessor: ID category: complex: root: inputs.Category comments: complex: root: inputs.Comment impact: complex: root: inputs.Impact severity: complex: root: 'inputs.Severity ' short_description: complex: root: inputs.ShortDescription ticket_type: complex: root: inputs.TicketType urgency: complex: root: inputs.Urgency separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 680, "y": 400 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": { "14_13_#default#": 0.52, "14_15_yes": 0.51, "9_11_Mirror": 0.52, "9_12_State Polling": 0.46, "9_8_#default#": 0.61 }, "paper": { "dimensions": { "height": 985, "width": 1140, "x": 70, "y": 60 } } } inputs: - key: Category value: {} required: false description: The category of the ServiceNow Ticket. playbookInputQuery: - key: AssignmentGroup value: {} required: false description: The group to which to assign the new ticket. playbookInputQuery: - key: ShortDescription value: {} required: false description: A short description of the ticket. playbookInputQuery: - key: Impact value: {} required: false description: The impact for the new ticket. Leave empty for ServiceNow default impact. playbookInputQuery: - key: Urgency value: {} required: false description: The urgency of the new ticket. Leave empty for ServiceNow default urgency. playbookInputQuery: - key: 'Severity ' value: {} required: false description: The severity of the new ticket. Leave empty for ServiceNow default severity. playbookInputQuery: - key: Comment value: {} required: false description: A comment for the created ticket. playbookInputQuery: - key: SyncTicket value: simple: Mirror required: false description: "The value of the desired sync method with ServiceNow Ticket. You can choose one of the following options:\n1. StatePolling\n2. Mirror \n3. Blank for none \n\nGenericPolling polls for the state of the ticket and runs until the ticket state is either resolved or closed. \n\nMirror - You can use the Mirror option to perform a full sync with the ServiceNow Ticket. The ticket data is synced automatically between ServiceNow and Cortex XSOAR with the ServiceNow mirror feature.\nIf this option is selected, FieldPolling is true by default." playbookInputQuery: - key: PollingInterval value: {} required: false description: |- The interval time (in minutes) for the polling to run. playbookInputQuery: - key: PollingTimeout value: {} required: false description: |- The amount of time (in minutes) to poll the status of the ticket before declaring a timeout and resuming the playbook. playbookInputQuery: - key: AdditionalPollingCommandName value: {} required: false description: "In this use case, additional polling commands are relevant when using StatePolling, and there is more than one ServiceNow instance. It will specify the polling command to use a specific instance to run on. \nIf so, add \"Using\" to the value. \nThe playbook will then take the instance name as the instance to use.\" the polling command to use a specific instance to run on. \nIf so, please add \"using\" to the value. \nThe playbook will then take the instance name as the instance to use." playbookInputQuery: - key: InstanceName value: simple: required: false description: | The ServiceNow instance that will be used for mirroring/running polling commands. playbookInputQuery: - key: MirrorDirection value: simple: Both required: false description: "The mirror direction. It should be one of the following: \n1. In\n2. Out\n3. Both" playbookInputQuery: - key: MirrorCommentTags value: simple: comments,work_notes,ForServiceNow required: false description: The tags for mirror comments and files to ServiceNow. playbookInputQuery: - key: FieldPolling value: {} required: false description: |- Set the value to true or false to determine if the playbook will execute the FieldPolling sub-playbook. It is useful when it is needed to wait for the ServiceNow ticket to be resolved and continue the parent playbook. FieldPolling will run until the ticket state is either resolved or closed. playbookInputQuery: - key: TicketType value: {} required: false description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident". playbookInputQuery: outputs: - contextPath: ServiceNow.Ticket.ID description: Ticket ID. type: string - contextPath: ServiceNow.Ticket.OpenedBy description: Ticket opener ID. type: string - contextPath: ServiceNow.Ticket.CreatedOn description: Ticket creation date. type: string - contextPath: ServiceNow.Ticket.Assignee description: Ticket assignee ID. type: string - contextPath: ServiceNow.Ticket.State description: Ticket state. type: string - contextPath: ServiceNow.Ticket.Summary description: Ticket short summary. type: string - contextPath: ServiceNow.Ticket.Number description: Ticket number. type: string - contextPath: ServiceNow.Ticket.Active description: Ticket active. type: string - contextPath: ServiceNow.Ticket.AdditionalComments description: Ticket comments. type: string - contextPath: ServiceNow.Ticket.Priority description: Ticket priority. type: string - contextPath: ServiceNow.Ticket.OpenedAt description: Ticket opening time. type: string - contextPath: ServiceNow.Ticket.ResolvedBy description: Ticket resolver ID. type: string - contextPath: ServiceNow.Ticket.CloseCode description: Ticket close code. type: string tests: - Create ServiceNow Ticket and Mirror Test - Create ServiceNow Ticket and State Polling Test fromversion: 6.0.0 supportedModules: - agentix - xsiam