ServiceNow Integration

#1

Looking at this for help,
https://elastalert.readthedocs.io/en/latest/ruletypes.html#servicenow

Under ServiceNow

First off, short_description is same meaning as password. Someone may want to update that.

Secondly, is there no way to set description on the incident?

#2

Hi Joe,

PagerDuty does not maintain the ElastAlert documentation, nor can we assume responsibility for how they document their integrations with other platforms.

Regarding your second inquiry, to set the description on a ServiceNow incident that is triggered from PagerDuty, I would suggest constructing an inbound field rule. You can find the inbound field rules in ServiceNow under PagerDuty → Configuration → Inbound Field Rules. You will want to set PagerDuty webhook type to Trigger and ServiceNow incident field to Description. With the Type setting, you can choose between setting a default description or basing the description off of a field in the PagerDuty webhook payload.

I hope this helps!

#3

Duh on the elastalert doc.

Got any examples of ServiceNow setups?

#4

inbound_field_rule_sample
inbound_field_rule_sample.jpg1968×897 137 KB

Here is an example of an inbound field rule that sets the description based based on a field in the webhook payload. I would suggest taking a look at trigger webhooks in the Webhook Import Rows to see how the alert payloads you’re working with are structured.