====== ServiceNow Incidents ======

==== Purpose ====
  * This plugin creates, updates and resolves incidents in ServiceNow based on Collector alarms
  * When an alarm is raised, an incident is created, when the alarm clears, the incident can be automatically resolved

==== Configuration ====
  * From the plugin menu, select "ServiceNow Incidents" and click "Add".
    * **Enabled:** Enable or disable the plugin
    * **Name:** Plugin display name
    * **Table Type:** ''INCIDENT'' (default), ''CSM_CASE'', or ''CUSTOM'' (with custom API path)
    * **ServiceNow Instance URL:** The base URL of the ServiceNow instance
    * **User / Password:** ServiceNow API credentials
    * **Assignment Group:** (optional) Default assignment group
    * **CMDB CI Auto-Discovery:** Automatically pushes SAP systems to the CMDB and links incidents to the correct CI
    * **Auto-close:** Resolves the incident when the alarm clears
    * **Closed States:** State codes considered as closed 
    * **Dynamic Properties (JSON):** Custom fields added to incidents, supports variables (see below)
    * **Chunk size:** Max alarms processed per cycle 

{{..:plugins:screenshot_52.png?700|}}

==== Severity mapping ====

^ RedPeaks ^ Urgency ^ Impact ^ Priority ^
| CRITICAL | 1 (High) | 1 (High) | P1 |
| MAJOR | 1 (High) | 2 (Medium) | P2 |
| MINOR | 2 (Medium) | 2 (Medium) | P3 |
| WARNING | 2 (Medium) | 3 (Low) | P4 |
| INFO | 3 (Low) | 3 (Low) | P5 |

==== Dynamic Properties ====
  * The Dynamic Properties field accepts a JSON object. Each key/value pair is added as a field on the created incident.
  * Values support placeholder variables that are replaced at runtime with alarm data.
  * Example:
  <code javascript>
  {"account": "%GROUP%", "product": "SAP Monitoring", "contact_type": "Alert"}
  </code>

=== Available variables ===
^ Variable ^ Description ^
| ''%ID%'' | Alarm ID |
| ''%GROUP%'' | System group / company name |
| ''%SID%'' | SAP System ID |
| ''%CLIENT%'' | SAP Client number |
| ''%INSTANCE%'' | SAP Instance |
| ''%SEVERITY%'' | Severity label (CRITICAL, MAJOR, etc.) |
| ''%SEVERITY_ID%'' | Severity numeric value |
| ''%MESSAGE%'' | Alarm message |
| ''%MODULE%'' | Monitoring module name |
| ''%METRIC%'' | Metric type name |
| ''%HOSTNAME%'' or ''%HOST%'' | Hostname |
| ''%COMPONENT%'' | Component name |
| ''%STACK%'' | Stack type |
| ''%RULE_NAME%'' | Alarm rule name |
| ''%RULE_DESCRIPTION%'' | Alarm rule description |
| ''%TIMESTAMP%'' | Raise time (yyyy-MM-dd HH:mm:ss) |
| ''%TIMESTAMP_UNIX%'' | Raise time (Unix timestamp) |
| ''%TIMESTAMP_<TZ>%'' | Raise time in a specific timezone (e.g. ''%TIMESTAMP_Europe/Paris%'') |
| ''%ALARM_TAG%'' | Alarm tags |
| ''%COUNT%'' | Alarm occurrence count |
| ''%SAMPLE_RATE%'' | Sample rate in seconds |
| ''%CONNECTOR.NAME%'' | Connector name |
| ''%SYSTEM.NAME%'' | System description |
| ''%AGENT%'' | Remote agent name |

==== Test Connection ====
  * Use the **test button** (flask icon) to verify that the Collector can reach the ServiceNow instance with the provided credentials.