Advanced ServiceNow Teams Integration Playbook
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
This playbook showcases an example of triggering an incident within a targeted Teams channel and opening up a ticket within Service Now. Additionally The playbook will also list playbooks that can be initiated from teams using an adaptive card and callbacks that will take action upon certain entities identified in the incident.
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | Teams |
| Source | View on GitHub |
Additional Documentation
Advanced - ServiceNow & Teams Integration
Author: Jing Nghik
This arm template will deploy multiple logic app playbooks and api connectors.
- (Main playbook) \
Updates
- Migrated playbook to support incidents instead of alerts
- fixed some JSON parsing problems with adaptive cards by adding an compose action to render the card.
Video Walkthrough
Requirements
In order to fully utilize this playbook. There are a number of pre-configuration steps required before deploying the Logic App.
You will need the following:
- ServiceNow instance URL, Username, and password
You can create a dev environment to test with for free at https://developer.servicenow.com/dev.do
- access/authorization to enable api connectors for Azure resource manager, teams, and Microsoft Sentinel.
- Teams Group ID, Alert Channel ID, Investigation Response Channel ID
The group ID and Channel ID can be obtained by going to Teams and getting the link which has the values you need for the parameters. (Will need to URL decode it if there are special characters). URL Decoder Link
- Investigation Channel ID can also use the same ID as alert channel if desired.
Workflow
- Based on the rules, Microsoft Sentinel triggers an incident or alert.
- This runs a linked playbook that first will check to determine if an existing serviceNow ticket already exists with the same incident ID (to prevent duplicate tickets)
- The ticket is opened in serviceNow and a Teams message is created in the Alerts channel with alert/incident details.
- A corresponding investigation response message is sent with a list of available playbooks that can be run from teams.
- Based on selected playbooks submitted, the playbooks are ran ad-hoc by routing the alert body to the selected playbook.
- If the executed playbook returns a response, that message is updated in the related serviceNow ticket, commented in the Microsoft Sentinel Incident, and also added added as a reply to the Initial Teams Alert message.
Setup Steps
- Click Deploy to Azure and fill in parameters
- Populate the Teams Group and Channel IDs to ensure it messages are generated in the right channel.
- Search for API connectors and find the deployment prefix and fix any connectors by authorizing the connection.
- Manually trigger an Microsoft Sentinel alert to test.
Deploy the ARM template
Thanks!
Thank you to the following people for contributing to my efforts in building this playbook! - Twitter @thijslecomte - For showing me how to make my first template! - Jan Ignacio, Joey Cruz, Sreedhar Ande, Nicholas Dicola, Rod Trent, Nathan Swift for pushing me to contribute to this repo, testing, and feedback.
Todo list
- Have the playbook support buth alerts and incidents. (Only works for alerts)
- A way to support other messaging services and ticketing platforms
- selectable card templates
- Way to not create a new teams thread if one already exists.
- support pager duty and teams on-call.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊