Those with ServiceNow integrations: How do you configure your HTTP Delivery to UPDATE incidents rather than creating new ones for acknowledged and cleared alerts?
New incidents (Duplicates) are opened every time an incident is acknowledged or cleared. Looking at the HTTP Delivery section of my integration and it looks like all requests for active alerts, acknowledged alerts, cleared alerts and escalated/de-escalated alerts are just set to POST to the same table within SNOW: <myinstancename>/api/now/table/x_lomo_lmint_logicmonitor_inbound_webser
It seems to me like a sysid should be created and used for each incident and that the HTTP Delivery section should be using HTTP PUT method, along with the unique sysid for each incident that is being updated with an acknowledgement, clear or escalation/de-escalation..
Any ideas on how to accomplish updating these incidents? I have attached a screenshot of my HTTP Delivery section for acknowledged alerts
Shack
·4 years agoWhat do you have set for the ServiceNOW Incident State?
Mike Moniz
·4 years agoI don't have a ServiceNow integration to look at anymore but the integration is now designed to use the LogicMonitor Incident Management Integration add-on from the ServiceNow store at https://store.servicenow.com/sn_appstore_store.do#!/store/application/951bdc460f07b200c514c3ace1050e5e/. The add-on is what creates the x_lomo_* tables and such.
If I remember correctly all the alerts gets dumped into a table and the code within ServiceNow add-on takes are of all the mapping to real incident tickets and keeping updates together.