I thought I might offer my real world experience of using this...
This might just be our instance of Service Now, but our service now expects us to pass values for Impact and Severity (or it might be Urgency, we pass both to Service Now) and it calculates the Priority based on a mapping table of Impact vs Severity.
From our payload config:
"severity": "##servicenow.severity##",
"urgency":"##servicenow.severity##",
"impact":"##servicenow.impact##",
The servicenow.severity isn't actually a device property, LogicMonitor sets that to a value that relates to the level of the alert (critical=1, error=2, warn=3). We pass that as both severity and urgency in our payloads to service now. I'm not actually sure which it uses - I imagine one of them isn't actually used.
servicenow.impact is a value that we set on devices. We set it to 2 at the root of our Logic Monitor instance, so it's inherited by all devices. If we decided that one device (or a group) were not as important, we set the property servicenow.impact=3 at that device (or group), likely we set it to 1 for devices that are critical.
So the Priority that Service Now assigns to the incident at creation is controlled by Service Now, but it takes into account of the alert severity and the impact value (which we can change to influence to Priority).
I don't think we customised the Service Now side of the integration to handle the "impact" field, so if you're not sending it I guess it's defaulting to something.
Professor
