Create And Update ServiceNow Record
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This playbook will create or update incident in ServiceNow. When incident is created, playbook will run and create incident in ServiceNow. When incident is updated, playbook will run and add update to comment section. When incident is closed, playbook will run and close incident in ServiceNow.
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | Servicenow |
| Source | View on GitHub |
Logic App Connectors
This playbook uses 3 Logic App connectors / built-in actions:
| Connector / Action | Type | Connections | Actions |
|---|---|---|---|
azuresentinel |
Managed | 1 | 0 |
microsoftsentinel |
Managed | 0 | 1 |
service-now |
Managed | 1 | 3 |
Action parameters (URLs, paths, function IDs)
microsoftsentinel (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Update_incident | put | /Incidents |
— |
service-now (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Create_Record | post | /api/now/v2/table/@{encodeURIComponent('incident')} |
— |
| Update_Record_-_Incident_closed | put | /api/now/v2/table/@{encodeURIComponent('incident')}/@{encodeURIComponent(variables('SNOW System ID'))} |
— |
| Update_Record_-_incident_not_closed | put | /api/now/v2/table/@{encodeURIComponent('incident')}/@{encodeURIComponent(variables('SNOW System ID'))} |
— |
Additional Documentation
ServiceNow-CreateAndUpdateIncident
author: Benjamin Kovacevic
This playbook will create or update incident in ServiceNow. When incident is created, playbook will run and create incident in ServiceNow. When incident is updated, playbook will run and add update to comment section. When incident is closed, playbook will run and close incident in ServiceNow.
Prerequisites
We will need following data to make Jira connector:
- ServiceNow instance (ex. xyz.service-now.com)
- Username
- Password
Quick Deployment
Post-deployment
- Authorize ServiceNow connector
- Assign Microsoft Sentinel Responder role to playbook's managed identity. To do so, choose Identity blade under Settings of the Logic App.
- Add playbook as an action to the automation rule, ex.:
- Trigger = When incident is updated;
- Condition = Staus > Changed To > Closed;.
Automation Rule Example
Automation Rule Condition Example
Screenshots
Playbook
ServiceNow New Incident
ServiceNow Update Incident
ServiceNow Incident closed
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊