Try it free

ServiceNow Connector actions

  • Latest Dynatrace
  • Reference
  • 10-min read

Review the ServiceNow for Workflows ServiceNow Connector actions to see which IT Service Management (ITSM) and IT Operations Management (ITOM) tasks you can automate in a workflow. Depending on your ServiceNow setup, you can create, comment on, search, and resolve incidents, or send events to ServiceNow Event Management, and each action uses a connection to your ServiceNow instance.

This page describes the available actions and their inputs. To add an action to a workflow, see Add ServiceNow Connector actions.

ServiceNow Connector actions for ServiceNow IT Service Management (ITSM)

Your Dynatrace environment can integrate with a ServiceNow IT Service Management (ITSM) instance using the ServiceNow for Workflows ServiceNow Connector, enabling you to create incidents based on your monitoring data and events automatically. Furthermore, you can retrieve groups from ServiceNow and import them as Ownership teams.

The following workflow actions are available for the ServiceNow integration. Each action corresponds to an endpoint of the ServiceNow API.

ActionDescriptionServiceNow API endpoint

Comment on an Incident

Add a new comment to a ServiceNow incident record.

PUT /api/now/v2/table/incident/${sys_id}

Create a vulnerability item

Creates a vulnerability item in your ServiceNow instance.

POST /api/now/v2/table/sn_vul_vulnerable_item

Create Comment

Create a comment on an entry in your ServiceNow instance.

PUT /api/now/v2/table/${tableName}/${sysId}

Create Incident

Creates an incident in your ServiceNow instance. An incident represents a problem or an issue that needs to be addressed and resolved.

POST /api/now/v2/table/incident

Create Record

Create a new record in a specified ServiceNow table.

POST /api/now/v2/table/${tableName}

Get Groups

Get groups from your ServiceNow instance.

GET /api/now/v2/table/sys_user_group

Resolve Incident

Update a ServiceNow incident to mark it as resolved.

PUT /api/now/v2/table/incident/${sys_id}

Search

Generic search action that allows searching your ServiceNow instance.

GET /api/now/v2/table/${tableName}

Search Incidents

Query ServiceNow to retrieve a list of incidents matching specified criteria.

GET /api/now/v2/table/incident

Update Record

Update an existing record in a specified ServiceNow table.

PUT /api/now/v2/table/${tableName}/${sys_id}

For more details, see the official ServiceNow documentation.

Comment on an Incident

Add a new comment to a ServiceNow incident record. Identify the incident by its number.

Inputs

FieldDescriptionRequired

Incident Number

The number of the incident to comment on.

Required

Comment

The comment to create.

Required

Create a vulnerability item

Create a vulnerability item in your ServiceNow instance.

Inputs

FieldDescriptionRequired

External ID

ID which is associated with the vulnerable item.

Optional

Description

A detailed description of the vulnerability item.

Optional

Short description

A brief description of the vulnerability item.

Optional

Risk score

The risk score of the vulnerability item.

Optional

Risk rating

The risk rating of the vulnerability item.

Optional

Source

The source which detected the vulnerable item.

Optional

Source risk score

The risk score in the source system of the vulnerability item.

Optional

Configuration item

The affected entity.

Optional

First found

The date of the detection.

Optional

Priority

The priority of the vulnerability item.

Optional

Create Comment

Create a comment on an entry in your ServiceNow instance. Identify the entry by its table and sys_id.

Inputs

FieldDescriptionRequired

Table

The table name of the entry to comment on.

Required

Unique record identifier (sys_id)

The sys_id of the entry to comment on.

Required

Comment

The comment to create.

Required

Create Incident

Raise a ServiceNow incident in a workflow.

Inputs

FieldDescriptionRequired

Correlation ID

Unique identifier, usually the Dynatrace event ID.

Optional

Caller

The user who reports the incident.

Optional

Category

The category of the incident. Category options are derived by querying the sys_choice table with sysparm_query: 'name=incident^element=category^inactive=false'.

Required

Subcategory

The subcategory of the incident. Subcategory options are derived by querying the sys_choice table with sysparm_query: 'name=incident^element=subcategory^inactive=false^dependent_value=${category}'.

Required

Impact

The impact of the incident.

Required

Urgency

The urgency of the incident.

Required

Assignment Group

The group that works on the incident. Assignment group options are derived by querying the sys_user_group table with sysparm_display_value: 'all'.

Required

Configuration item

The affected entity.

Optional

Short description

A brief description of the incident.

Optional

Description

A detailed description of the incident.

Optional

Create Record

Create a new record in a specified ServiceNow table.

Inputs

FieldDescriptionRequired

Table

The name of the table in which to create a record.

Required

Payload Fields

Key-value pairs of table field names and their values.

Optional

Get Groups

Get groups from your ServiceNow instance. You can import them as Ownership teams.

Inputs

FieldDescriptionRequired

SysParm Query

An encoded query used to filter the result set.

Optional

Limit

Maximum number of results to return. The default setting is 100.

Optional

Resolve Incident

Update a ServiceNow incident to mark it as resolved. Provide resolution notes and a resolution code.

Inputs

FieldDescriptionRequired

Incident Number

The number of the incident to resolve.

Required

Resolution Notes

Add notes for the resolution of the incident.

Required

Resolution Code

The close code for the resolution.

Required

Search

Search your ServiceNow instance. Select the table to search in, and optionally filter, limit, and sort the results.

Inputs

FieldDescriptionRequired

Table

Select the table in which to search.

Required

SysParm Query

An encoded query used to filter the result set.

Optional

SysParm Fields

Comma-separated list of fields that limit the result.

Optional

Query category

Category to filter search results.

Optional

Limit

Maximum number of results to return. The default setting is 100.

Optional

Offset

Records to skip. The default setting is 0.

Optional

Order by asc

Field name to sort results in ascending order.

Optional

Order by desc

Field name to sort results in descending order.

Optional

Search Incidents

Query ServiceNow to retrieve a list of incidents that match the criteria you specify.

Inputs

FieldDescriptionRequired

SysParm Query

An encoded query used to filter the result set.

Optional

SysParm Fields

Comma-separated list of fields that limit the result.

Optional

Limit

Maximum number of results to return. The default setting is 100.

Optional

Update Record

Update an existing record in a specified ServiceNow table.

Inputs

FieldDescriptionRequired

Table

The name of the table in which to update a record.

Required

Unique record identifier (sys_id)

The sys_id of the entry to update.

Required

Payload Fields

Key-value pairs of table field names and their values.

Optional

ServiceNow Connector action for ServiceNow IT Operations Management (ITOM)

Send events from your monitoring data to ServiceNow Event Management, which correlates them into alerts based on your ServiceNow configuration. Your Dynatrace environment can integrate with a ServiceNow IT Operations Management (ITOM) instance using the ServiceNow for Workflows ServiceNow Connector.

ActionDescriptionServiceNow API endpoint

Send ITOM Event

Send an event to ServiceNow Event Management using the ITOM inbound web service. Requires an ITOM events connection.

POST /api/sn_em_connector/em/inbound_event

Send ITOM Event

The Send ITOM Event action sends a single event to ServiceNow Event Management using the ITOM inbound web service. ServiceNow uses the Message Key to deduplicate incoming events and correlate them into the same alert. The action requires an ITOM events connection.

Inputs

FieldDescriptionRequired

Node

The hostname of the affected Configuration Item (CI) in ServiceNow's CMDB.

Optional

Type

The event type, for example, SLOWDOWN or AVAILABILITY.

Required

Resource

The specific resource on the node that generated the event, for example, CPU or disk.

Optional

Message Key

Unique identifier for the event. ServiceNow uses this to deduplicate incoming events and correlate them into the same alert.

Required

Severity

ServiceNow event severity numbers 0 to 4, where 0 = Clear (OK), 1 = Critical, 2 = Major, 3 = Minor, and 4 = Warning.

Required

Resolution State

Indicates to ServiceNow whether to open (New) or close (Closing) the alert.

Required

Time Of Event

Event timestamp (UTC) in GlideDateTime format YYYY-MM-DD HH:MM:SS.

Required

Metric Name

A label for the affected metric or indicator.

Required

Description

Human-readable description of the event.

Optional

Additional Info

A JSON object with key-value pairs appended to the event payload.

  • Any scalar root-level property is carried over 1:1 to the alert's additional info field.

  • Any non-scalar root-level property, that is, arrays and objects, is flattened by the Dynatrace push connector and added to the alert's additional info field.

    For example:

    {
      "my_object": {
        "property_one": "object property value 1",
        "property_two": "object property value 2"
      },
      "my_array": [ "array value 1", "array value 2" ]
    }

    All values from both properties my_object and my_array are flattened to "flattened.my_object.property_one": "object property value 1", "flattened.my_object.property_two": "object property value 2", "flattened.my_array.0": "array value 1", and "flattened.my_array.1": "array value 2".

  • To bind an alert to a Configuration Item (CI) in ServiceNow, provide the necessary Dynatrace entity information: ID, type, and name. For ServiceNow instances with the Service Graph Connector installed, only the Dynatrace entity ID is needed to look up the linked Configuration Item.

    • smartscape_entity_id, the ID of the Dynatrace entity that is linked to an existing ServiceNow Configuration Item, for example, SERVICE-C62D27215EFF3945.
    • smartscape_entity_type, the type of the Dynatrace entity, for example, SERVICE.
    • smartscape_entity_name, the name of the Dynatrace entity.
    {
      "smartscape_entity_id": "SERVICE-C62D27215EFF3945",
      "smartscape_entity_type": "SERVICE",
      "smartscape_entity_name": "Biz Service 1"
    }

  • If you want to attach alert tags, you can provide a mapping called alert_tags that maps to entries of type string, for example:

    {
      "alert_tags": {
        "app": "my app",
        "cost_center": "R&D"
      }
    }

    Each of these entries is added to the alert's additional info field, prefixed with your instance's alert tag prefix stored in evt_mgmt.alert_tags_prefix.

    For the default t_ alert tag prefix, the example yields these entries: "t_app": "my app" and "t_cost_center": "R&D".

Optional

How ServiceNow binds ITOM alerts to CIs

ServiceNow Event Management binds each ITOM alert to the Configuration Item (CI) in the Configuration Management Database (CMDB) that represents the affected Dynatrace entity. How it finds that CI depends on whether you set a Connection_sys_id when you set up the push connector.

  • With the ServiceNow Service Graph Connector (SGC) for Dynatrace SaaS: The SGC imports Dynatrace entities into the CMDB and stores each entity's Dynatrace ID as a source native key, scoped to the SGC connection. When you set Connection_sys_id, the push connector uses this key to bind each incoming alert directly to the matching CI. Alerts then carry service context from the CMDB topology, participate in service impact analysis, and can be automatically routed to the CI's support group.
  • Without the SGC: Event Management looks up existing CIs in the CMDB tables using the entity name, entity ID, and entity type that Dynatrace sends with each event. Binding succeeds only if a matching CI already exists and its attributes match the values in the event. Alerts that don't match any CI remain unbound.
Related tags
Dynatrace Platform