Employee
NeophyteHi Kerry,
Do you have a script for the integration with Service Now using the Custom HTTP integrations?
ProfessorServiceNow would simply be a post to the incident table. You need to cover whatever fields are required in your instance. This ServiceNow documentation page gives you some info.
NeophyteHi Joe, we used this JSON script.
{ "description": "Group: ##GROUP##\nHost: ##HOST##\nSeverity Level: ##LEVEL##\nAlert ID: ##ALERTID##", "caller_id": "##servicenow.user##", "alertid": "##ALERTID##","severity":5, "internalid": "##INTERNALID##", "host": "##HOST##", "instance": "##INSTANCE##", "level": "##LEVEL##", "status": "##ALERTSTATUS##", "datasource": "##DATASOURCE##", "eventsource": "##EVENTSOURCE##", "type": "##ALERTTYPE##", "datapoint": "##DATAPOINT##", "value": "##VALUE##", "threshold": "##THRESHOLD##", "start": "##START##", "finish": "##FINISH##", "duration": "##DURATION##", "host_ci": "##sn.sys_id##", "instance_ci": "##sn.instance.sys_id##", "company": "##sn.company##", "body": { "message": "##MESSAGE##" } }
it works, I just need to tweak it to add the Source , node, etc.
NeophyteJoe, have you seen this type of config before?
ProfessorWe don't hit the incident table directly ourselves. We hit a custom table that then runs some business rules. But here is an example of one of the payloads we send.
{ "u_short_description":"##HOST## - ##ALERTID## - ##DSNAME## - ##INSTANCE## - ##DATAPOINT##", "u_comments":"\n[code]<b>Group:</b>[/code] ##system.staticgroups##\n[code]<b>Severity Level:</b>[/code] ##LEVEL##\n[code]<b>Device:</b>[/code] ##HOST##\n[code]<b>IP:</b>[/code] ##system.hostname##\n[code]<b>DataSource:</b>[/code] ##DSNAME##\n[code]<b>Instance:</b>[/code] ##INSTANCE##\n[code]<b>Instance Description:</b>[/code] ##DSIDESCRIPTION##\n[code]<b>DataPoint:</b>[/code] ##DATAPOINT##\n[code]<b>Value:</b>[/code] ##VALUE##\n[code]<b>Threshold:</b>[/code] ##THRESHOLD##\n[code]<b>Description: </b>[/code] ##DPDESCRIPTION##", "u_work_notes": "\n[code]<b>Alert ID:</b> <a href='##ALERTDETAILURL##' target=_blank>##ALERTID##</a>[/code]\n[code]<b>Device:</b> <a href='##DEVICEURL##' target=_blank>##HOSTNAME##</a><br><br>##servicenow.alertinfo##[/code]\n[code]<b>Collector:</b> ##AGENT_DESCRIPTION##", "u_source":"LogicMonitor", "u_alert_status":"##ALERTSTATUS##", "u_alert_level":"##LEVEL##", "u_event_type":"##INSTANCE##", "u_device_sys_id": "##sn.sys_id##", "u_cmdb_ci":"##HOST##", "u_company_sys_id": "##servicenow.company_sys_id##", "u_assignment_group":"##servicenow.assignmentgroup##", "u_urgency":"2", "u_state":"1", "u_impact":"2", "u_platform_internal_id": "##ALERTID##", "u_datasources": "##DSNAME##", "u_instance": "##INSTANCE##", "u_datapoint": "##DATAPOINT##", "u_alert_level": "##LEVEL##", "u_alert_value": "##VALUE##", "u_alert_threshold": "##THRESHOLD##", "u_alert_status": "##ALERTSTATUS##", "u_source_instance": "ClientPortal" }
