Forum Discussion
ServiceNow would simply be a post to the incident table. You need to cover whatever fields are required in your instance. This ServiceNow documentation page gives you some info.
Hi Joe, we used this JSON script.
{ "description": "Group: ##GROUP##\nHost: ##HOST##\nSeverity Level: ##LEVEL##\nAlert ID: ##ALERTID##", "caller_id": "##servicenow.user##", "alertid": "##ALERTID##","severity":5, "internalid": "##INTERNALID##", "host": "##HOST##", "instance": "##INSTANCE##", "level": "##LEVEL##", "status": "##ALERTSTATUS##", "datasource": "##DATASOURCE##", "eventsource": "##EVENTSOURCE##", "type": "##ALERTTYPE##", "datapoint": "##DATAPOINT##", "value": "##VALUE##", "threshold": "##THRESHOLD##", "start": "##START##", "finish": "##FINISH##", "duration": "##DURATION##", "host_ci": "##sn.sys_id##", "instance_ci": "##sn.instance.sys_id##", "company": "##sn.company##", "body": { "message": "##MESSAGE##" } }
it works, I just need to tweak it to add the Source , node, etc.
- network72 months ago
Neophyte
Joe, have you seen this type of config before?
- Joe_Williams29 days ago
Professor
We don't hit the incident table directly ourselves. We hit a custom table that then runs some business rules. But here is an example of one of the payloads we send.
{ "u_short_description":"##HOST## - ##ALERTID## - ##DSNAME## - ##INSTANCE## - ##DATAPOINT##", "u_comments":"\n[code]<b>Group:</b>[/code] ##system.staticgroups##\n[code]<b>Severity Level:</b>[/code] ##LEVEL##\n[code]<b>Device:</b>[/code] ##HOST##\n[code]<b>IP:</b>[/code] ##system.hostname##\n[code]<b>DataSource:</b>[/code] ##DSNAME##\n[code]<b>Instance:</b>[/code] ##INSTANCE##\n[code]<b>Instance Description:</b>[/code] ##DSIDESCRIPTION##\n[code]<b>DataPoint:</b>[/code] ##DATAPOINT##\n[code]<b>Value:</b>[/code] ##VALUE##\n[code]<b>Threshold:</b>[/code] ##THRESHOLD##\n[code]<b>Description: </b>[/code] ##DPDESCRIPTION##", "u_work_notes": "\n[code]<b>Alert ID:</b> <a href='##ALERTDETAILURL##' target=_blank>##ALERTID##</a>[/code]\n[code]<b>Device:</b> <a href='##DEVICEURL##' target=_blank>##HOSTNAME##</a><br><br>##servicenow.alertinfo##[/code]\n[code]<b>Collector:</b> ##AGENT_DESCRIPTION##", "u_source":"LogicMonitor", "u_alert_status":"##ALERTSTATUS##", "u_alert_level":"##LEVEL##", "u_event_type":"##INSTANCE##", "u_device_sys_id": "##sn.sys_id##", "u_cmdb_ci":"##HOST##", "u_company_sys_id": "##servicenow.company_sys_id##", "u_assignment_group":"##servicenow.assignmentgroup##", "u_urgency":"2", "u_state":"1", "u_impact":"2", "u_platform_internal_id": "##ALERTID##", "u_datasources": "##DSNAME##", "u_instance": "##INSTANCE##", "u_datapoint": "##DATAPOINT##", "u_alert_level": "##LEVEL##", "u_alert_value": "##VALUE##", "u_alert_threshold": "##THRESHOLD##", "u_alert_status": "##ALERTSTATUS##", "u_source_instance": "ClientPortal" }
Related Content
- 2 months ago
- 6 months ago