ServiceNow Incidents - Advanced Customization
Advanced customization options are available in the ServiceNow Incidents integration.
ServiceNow field default values
Field | Default Value |
---|---|
description | Incident Summary: -------------------------------------------------------- Alert Summary:
-------------------------------------------------------- BigPanda Root Causes
-------------------------------------------------------- Incident Tags
--------------------------------------------------------
-------------------------------------------------------
|
short_description |
|
opened_at | BigPanda incident |
resolved_at | BigPanda incident |
comments | BigPanda comments, by default this value is mapped to the |
Custom short_description
Custom short descriptions for ServiceNow Incidents can be created without modifying the transform script for the short_description
field in the field map.
Create a composition tag with the alert tag values needed by defining bp_short_description. If this field exists, the short_description
will follow the same format and add a status or priority value to the end.
Additional Data Fields from BigPanda
The integration exposes these additional data fields from BigPanda in the default share from BigPanda. ServiceNow administrators can leverage these fields in the transform map to further enrich and customize the incident in ServiceNow.
Field | Description |
---|---|
| BigPanda Incident ID |
| BigPanda Incident status |
| Text printout of statuses of all alerts in incident |
| The count of all the alerts in the incident |
| The count of all non-resolved alerts in the incident |
| The BigPanda Environment from which the share originated |
| The BigPanda Environment ID |
| The email address of the user who performed the share If this was an auto-share, the email address will be |
| A string representation of the entire BigPanda Incident JSON Object |
| A link to the BigPanda incident |
| A link to the BigPanda incident timeline |
| A link to the preview of a BigPanda Incident |
| This defined the property to lookup on the defined primary alert tags for attempting to populate the ServiceNow Configuration Item field Default: |
| If any configuration options are passed through the Integration header or by customer success it will override any ServiceNow configurations set in the ServiceNow BigPanda App |
Sample Payload:
{ "incident":{ "id":"5f73d0f2xxxe10757e4xxxxx", "status":"Critical", "active":true, "severity":"Critical", "flapping":false, "resolved":false, "snooze":{ "snoozed":false, "wake":null, "autoCancel":false }, "startedOn":1601425650, "changedOn":1601425650, "updatedOn":1674881061, "endedOn":null, "alerts":[ { "id":"5f73d0f2xxxe10757e4xxxxx", "status":"Critical", "startedOn":1601425650, "endedOn":null, "changedOn":1601425650, "updatedOn":1601425650, "active":true, "primaryProperty":"host", "secondaryProperty":"ip_address", "sourceSystem":"api.testemailparser", "description":null, "tags":[ { "name":"ip_address", "value":"10.xxx.134.xxx" }, { "name":"system_name", "value":"Test system" }, { "name":"product_version_endpoint_security_platform", "value":"10.x.1.xxxx" }, { "name":"product_version_endpoint_security_threat_prevention", "value":"10.x.1.xxxx" }, { "name":"last_communication", "value":"9/2/20 7:39:01 AM CDT" }, { "name":"agent_version", "value":"5.x.5.xxx" }, { "name":"host", "value":"Test system" }, { "name":"amcore_content_version", "value":"0.5" } ] } ] }, "links":{ "landingPage":"http://bigp.io/xxx6e2c58xxxxxxx" }, "metadata":{ "sender":{ "name":"Test User", "email":"[email protected]" }, "environment":"All", "environment_id":"xxx6dde2bcxxxdaf7318xxxx", "event_types":[ { "event":"incident#new", "time":1674571309 }, { "event":"incident-tag#upserted", "time":1674571309 }, { "event":"incident-tag#upserted", "time":1674571309 } ] }, "config":{ } }
Custom Headers
BigPanda allows you to create Custom Headers to specify customized information with your integration. If you have not been granted Administrator access to the integration system, you can modify the integration through custom headers.
Custom header priority
Custom headers take priority over the fields you configure on the Integration page.
See the Custom Headers documentation for more details.
OAuth 2.0 Support
BigPanda supports OAuth 2.0 for ServiceNow incident creation. In order to add OAuth provider details within the BigPanda ServiceNow integration, add the following custom headers. Once OAuth details are added, any Basic Auth credentials are ignored when making requests to ServiceNow.
x-bp-config-oauthUrl
x-bp-config-oauthClientId
x-bp-config-oauthClientSecret
x-bp-config-oauthGrantType
(optional; required for
oauthGrantType
of password)x-bp-config-oauthPassword
(optional; required for
oauthGrantType
of password)x-bp-config-oauthUser
(optional)
x-bp-config-oauthScope
The recommended oauthGrantType is password
. The oauth user in ServiceNow needs to have the role of x_bip_panda_user assigned.
We only support grant types of password
and client_credentials
at present. OAuth support is only available for ticket creation via push mechanism and not when polling from ServiceNow.
Override URL
To support an intermediate custom implementation, add the below custom header to your ServiceNow integration. Such custom implementations are typically needed to support complex security requirements that are not supported by the standard integration.
x-bp-config-servicenowUrlOverride
Class: BigPandaUtility
A Script Include library of functions called BigPandaUtility has been created to make common tasks easier.
new BigPandaUtility(source)
source
ServiceNow source record (library may only be used when a source is defined)
The initialization function must be called before calling other library functions.
getIncident()
Returns the BigPanda Share payload
getIncidentTags()
Returns an array of Incident Tags (See example above for return schema)
getIncidentTag(tag_name)
tag_name Name of the Incident Tag to retrieve
Returns the value for the provided incident tag. Returns
null
if no match is found
getPriorityIncidentTag()
Returns the value for the provided priority Incident Tag. Returns null
if not found
getPrimaryAlert()
Returns Primary Alert object as determined by setPrimaryAlert
.
getPrimaryAlertStatus()
Returns a String
representing the Primary Alert status.
getPrimaryAlertValue(<field>)
Fields pull data from the parent primary alert object.
Example:
"id": "66bb727c231b20cf7a8e2555", "status": "Ok", "startedOn": 1723560565, "endedOn": 1723827972, "changedOn": 1723827972, "updatedOn": 1723827972, "active": false, "primaryProperty": "host", "secondaryProperty": "check", "sourceSystem": "api.app_mon", "description": "mongo-123 is reporting slowness in database transaction completion",
This command returns the value of the specified field within Primary Alert, or null
if it doesn't exist.
getPrimaryAlertTag(<tag>)
Tags pull data from the tags child object.
"tags": [{ "name": "host", "value": "ca-prod-monitoring-order-dist-6iu702" }, { "name": "instance", "value": ["nyc-snmo-ais97"] }
This command returns the value of the specified tag within Primary Alert, or null
if it does not exist.
getAlertStatusCounts()
Returns String
containing alert counts: X Critical, Y Warning, Z Resolved [U Unknown]
. The unknown value is present only when some alerts have no status.
getTimeByProperty(epochTime, property)
epochTime
epoch time used as fallback source valueproperty
field containing epochTime in source record to convert
Returns String
containing ServiceNow formatted time. Generated from field property
if it exists in source, otherwise, epochTime
is used.
getUserByProperty(userEmail, property)
userEmail
fallback value used for emailproperty
field containing user email in source record
Returns the ServiceNow system id for the provided user email. Generated from field property
if it exists in source, otherwise, userEmail
is used.
getUpdateFields()
Returns list of fields to be updated during an update event.
reopenIncident(incident)
incident
source record to determine reopening
Returns Boolean
whether the incident should be reopened. Returns true if Re-open Resolved
is checked in the Configuration UI and the time since the incident was resolved less than Re-open Window
minutes ago.