ServiceNow Data Connector
The BigPanda Unified Data Connector (UDC) syncs data from ServiceNow to provide context and insights for AI Incident Assistant (Biggy), AI Incident Prevention, and AI Detection and Response. Ingested data is securely stored and made available in the IT Knowledge Graph, powering accurate answers, deep analytics, trend analysis, and advanced capabilities.
Not bi-directional and monitoring incident sync
The Data Connector does not enable incident sync and sharing from the BigPanda event monitoring incident feed. See the ServiceNow integration documentation for details on managing incidents with ServiceNow and BigPanda.
Authorization
Use either OAuth2 or basic HTTP auth to configure Unified Data Connector with ServiceNow. OAuth2 is recommended for production environments.
Create the required credentials for your chosen authorization method, then send them to your BigPanda account team who will finish the authorization process.
Time conversion
The Unified Data Connector will convert all date and time fields into UTC. This ensures consistent date handling across different environments and time zones.
The system also automatically combines the date format and time format for complete date/time parsing. (For example, YYYY-MM-DD HH:mm:ss)
Configure UDC with OAuth2
OAuth2 enhances security and ease of use, and won’t store user passwords and automatically refreshes expired tokens.
To get started, configure the application registry on your ServiceNow instance. The steps are the same as the Splunk instructions found on the ServiceNow site. The Client ID and Client Secret should be saved so that you can send these to your BigPanda account team.
Once you’ve completed that step, provide the following credentials to your BigPanda team.
Field | Description |
|---|---|
Instance | The name of your ServiceNow instance. (i.e. |
Client ID | Client ID copied from your ServiceNow application registry. |
Client secret | Client secret copied from your ServiceNow application registry. |
Time zone | Time zone of your ServiceNow instance. (Used for incremental filtering.) |
Configure UDC with HTTP basic auth
If you’re unable to use OAuth2, you can configure HTTP basic authentication to connect your data. We strongly recommend creating a unique user for BigPanda in ServiceNow to more clearly track activity and customize permissions.
Field | Description |
|---|---|
Instance | The name of your ServiceNow instance. (i.e. |
Username | Username of the account used to access ServiceNow. |
Password | Password of the account used to access ServiceNow. |
Timezone | Time zone of your ServiceNow instance. (Used for incremental filtering.) |
The BigPanda team will use your ServiceNow credential information to set up the data connector. Certain fields and options are customizable depending upon your organization’s preferences and requirements.
(Optional) Configure mutual TLS certification
The ServiceNow data connector supports Mutual TLS (mTLS) authentication, providing an additional layer of security for organizations that require client certificate verification. You can use this in combination with either OAuth2 or basic HTTP authentication.
To enable mTLS, you must provide the following information to your BigPanda account team:
Parameter | Description |
|---|---|
Certificate | Your client certificate in PEM format |
Key | Your client private key in PEM format |
Use the PEM format below when providing both the certificate and key. Certificates must include the -----BEGIN and -----END markers and each marker must be on its own line.
-----BEGIN CERTIFICATE----- MIIDXTCCAkWgAwIBAgIJAJC1HiIAZAiU... (base64 encoded certificate data) ...AQ8AMIIBCgKCAQEArXk -----END CERTIFICATE-----
Sync preferences
Provide the following information about your sync preferences to BigPanda:
Required Configuration
Option | Description |
|---|---|
Mode | Determine whether you’d like to set up an incremental or historical sync. Most organizations will need to use both modes. See the Streaming Modes section for more information. |
Optional Table-level Configuration
Option | Description |
|---|---|
Related Tables | For each table, you can choose to include a related table. For example, if an incident has CIs, you can include the task_ci related table to collect them along with the incident. See the Related Tables section below for a list of related tables and join fields. |
Filter | You can apply query filters to specific tables to granularly choose what data is extracted. Each table’s filter is applied independently. Tables without a filter will load all records. Filters use ServiceNow's encoded query syntax with ^ as AND and OR as OR. We recommend using ServiceNow's query builder to test filters before adding them to the configuration. See the ServiceNow documentation for more information. |
Fields | Determine which fields you’d like to include from each ServiceNow table. You can also choose to include all fields. |
Optional Pipeline Configuration
Option | Description |
|---|---|
Start Date | If you’re setting up a historical sync, provide the date of when you’d like the sync to begin. If no start date is provided, all data will be synced. We recommend syncing one year of data. |
End Date | Used for historical syncs only. Provide an end date to backfill historical syncs. |
Read Replica | ServiceNow supports read replicas through the If you’d like to set this up, provide your replica name. |
Batch size | The |
Timeout | The |
Performance-Related Configuration
Option | Description |
|---|---|
Query Limit | The maximum number of queries that can be sent per minute. The default is 60 queries per minute. |
Rate Limit Timeout (MS) | The timeout period in milliseconds after the query limit has been reached. The default is 1000 ms (1 second). |
Data requirements for ServiceNow UDC configuration
To leverage all of the BigPanda features that integrate with ServiceNow, you must ensure that your UDC configuration includes all required tables and fields. You can also configure additional custom tables and fields for added functionality and more robust contextual enrichment.
Required fields
All tables must include specific required fields to be ingested successfully. As long as these minimum requirements are met, you can include as many additional custom fields as you want.
Related tables
In every table, you can choose to include one or more related tables. (For example, if an incident has CIs, you can include the task_ci related table to collect them along with the incident.)
While many related tables are optional, AI Incident Assistant requires the change_task and task_ci related tables for successful ingestion.
See our documentation on Related Tables for a list of common related tables and their join fields.
Required fields
All ServiceNow tables connected to the Unified Data Connector must include these minimum required fields.
sys_id
sys_created_on
sys_updated_on
sys_created_by
sys_updated_by
Some tables may have additional required or recommended fields, including fields necessary for related tables.
Required tables for ServiceNow UDC configurations
Some features require more tables than others, but we strongly recommend including all of these core tables for all features. Broader datasets allow BigPanda to provide comprehensive context, better analysis, and more accurate answers.
ServiceNow table | Required fields | Required for feature |
|---|---|---|
change_request | sys_id sys_created_on sys_updated_on sys_created_by sys_updated_by number | AI Incident Assistant |
change_task | sys_id sys_created_on sys_updated_on sys_created_by sys_updated_by change_request | AI Incident Assistant (required as related table) |
cmdb_ci | sys_id sys_created_on sys_updated_on sys_created_by sys_updated_by name | AI Incident Assistant |
incident | affected_service assigned_to assignment_group brand_category business_duration business_impact caller_id category caused_by close_code close_notes cmdb_ci contact_type impact knowledge location made_sla number opened_by parent_incident priority problem_id reassignment_count reopen_count resolved_at resolved_by short_description state subcategory sys_created_by sys_created_on sys_id sys_updated_by sys_updated_on urgency work_notes x_bip_panda_bigpanda_id | AI Incident Assistant Service Desk Correlation Historical Incidents |
kb_knowledge | sys_id sys_created_on sys_updated_on sys_created_by sys_updated_by number | AI Incident Assistant |
problem | sys_id sys_created_on sys_updated_on sys_created_by sys_updated_by number | AI Incident Assistant |
task_ci | sys_id sys_created_on sys_updated_on sys_created_by sys_updated_by task | AI Incident Assistant Service Desk Correlation (required as related table) |
Recommended tables for ServiceNow UDC configurations
The following tables are not required for any basic functions, but are highly recommended for improving contextual functions.
ServiceNow table | Required fields |
|---|---|
sys_attachment | sys_id sys_created_on sys_updated_on sys_created_by sys_updated_by |
sys_attachment_doc | sys_id sys_created_on sys_updated_on sys_created_by sys_updated_by position |
task | sys_id sys_created_on sys_updated_on sys_created_by sys_updated_by number |
Custom tables in ServiceNow UDC configurations
Additional and custom tables can be connected to deepen the context and performance of BigPanda features.
Custom tables must include the minimum required fields:
sys_id
sys_created_on
sys_updated_on
sys_created_by
sys_updated_by