Table of Contents
ServiceNow Incidents
Purpose
- This plugin creates, updates and resolves incidents in ServiceNow based on Collector alarms
- When an alarm is raised, an incident is created, when the alarm clears, the incident can be automatically resolved
Configuration
- From the plugin menu, select “ServiceNow Incidents” and click “Add”.
- Enabled: Enable or disable the plugin
- Name: Plugin display name
- Table Type:
INCIDENT(default),CSM_CASE, orCUSTOM(with custom API path) - ServiceNow Instance URL: The base URL of the ServiceNow instance
- User / Password: ServiceNow API credentials
- Assignment Group: (optional) Default assignment group
- CMDB CI Auto-Discovery: Automatically pushes SAP systems to the CMDB and links incidents to the correct CI
- Auto-close: Resolves the incident when the alarm clears
- Closed States: State codes considered as closed
- Dynamic Properties (JSON): Custom fields added to incidents, supports variables (see below)
- Chunk size: Max alarms processed per cycle
Severity mapping
| RedPeaks | Urgency | Impact | Priority |
|---|---|---|---|
| CRITICAL | 1 (High) | 1 (High) | P1 |
| MAJOR | 1 (High) | 2 (Medium) | P2 |
| MINOR | 2 (Medium) | 2 (Medium) | P3 |
| WARNING | 2 (Medium) | 3 (Low) | P4 |
| INFO | 3 (Low) | 3 (Low) | P5 |
Dynamic Properties
- The Dynamic Properties field accepts a JSON object. Each key/value pair is added as a field on the created incident.
- Values support placeholder variables that are replaced at runtime with alarm data.
- Example:
{"account": "%GROUP%", "product": "SAP Monitoring", "contact_type": "Alert"}
Available variables
| Variable | Description |
|---|---|
%ID% | Alarm ID |
%GROUP% | System group / company name |
%SID% | SAP System ID |
%CLIENT% | SAP Client number |
%INSTANCE% | SAP Instance |
%SEVERITY% | Severity label (CRITICAL, MAJOR, etc.) |
%SEVERITY_ID% | Severity numeric value |
%MESSAGE% | Alarm message |
%MODULE% | Monitoring module name |
%METRIC% | Metric type name |
%HOSTNAME% or %HOST% | Hostname |
%COMPONENT% | Component name |
%STACK% | Stack type |
%RULE_NAME% | Alarm rule name |
%RULE_DESCRIPTION% | Alarm rule description |
%TIMESTAMP% | Raise time (yyyy-MM-dd HH:mm:ss) |
%TIMESTAMP_UNIX% | Raise time (Unix timestamp) |
%TIMESTAMP_<TZ>% | Raise time in a specific timezone (e.g. %TIMESTAMP_Europe/Paris%) |
%ALARM_TAG% | Alarm tags |
%COUNT% | Alarm occurrence count |
%SAMPLE_RATE% | Sample rate in seconds |
%CONNECTOR.NAME% | Connector name |
%SYSTEM.NAME% | System description |
%AGENT% | Remote agent name |
Test Connection
- Use the test button (flask icon) to verify that the Collector can reach the ServiceNow instance with the provided credentials.