Last Updated: 2024-02-22
While this integration was thoroughly tested as of February 2024, please note that ongoing support may not be guaranteed beyond this point.
Purpose
This article describe how to create incidents through REST API in ServiceNow from Portal.
Introduction
This article outlines the process of creating incidents in ServiceNow using its REST API, Webhooks, and Event Notifications from the Portal. It begins by guiding users on how to access the REST API Explorer and construct a request to create an incident, including selecting the appropriate table and populating the request body. The article then details the steps to create a Webhook integration in the Portal, emphasizing the importance of using the correct authentication method. Finally, it describes how to set up an Event Notification to automate incident creation whenever a new finding is discovered.
This article will not go into a deep explanation of ServiceNow’s REST API. If you need the full list of endpoints you can check their documentation here.
Open the REST API Explorer in Your Instance
First open the REST API Explorer from your ServiceNow instance.
The Explorer is a tool that help you build your request to the REST API. Once again, this article is focusing solely on creating an incident.
-
On the left side menu, select the option Create a record (POST) (fig.1).
-
Select the table type you want to create a record to. (fig.2)
In this example we selected Incident (incident) in the drop-down menu. -
This is the endpoint to which you need to make the request against (fig.3) .
The variable {tableName} is the one you selected in step 2. In this case, the full URL would be:
XMLhttps://{your-instace-name}.service-now.com/api/now/table/incidents
-
Scroll down to the Request Body section and click on Add a field.
-
A new line is displayed with a drop-down menu (fig. 1 and 2) where you can select which fields you want to populate when creating an incident via the integration. In this case we are using a request with a short_description
-
If you want to add more fields, click on the + button (fig. 3) to add new.
-
An example of the body is displayed in json format beneath rows (fig. 4).
Next step is to create the integration in the Portal.
Create a Webhook in Portal
To create a webhook integration in Portal:
-
Navigate to Configuration > Integrations in the Main menu.
-
Click on the green
button at the bottom right, a new side panel is displayed:
-
Select Webhook from the drop-down menu and fill in the fields:
-
Name: the name you want to give to this integration.
-
URL: the URL from ServiceNow that you just generated in the previous section.
-
HTTP method: POST
-
Content sample: this is just to test out the integration. You can copy+paste the body that we just generated in the previous section.
-
-
Click on Add, at the right corner to create the integration.
-
Next is to add authentication.
Navigate to the Authentication tab and fill in the fields.
For this example Basic Auth is used:
Make sure you are using your User ID as the username and not your e-mail or any other identifier. To check this, you can go to your profile in ServiceNow. The user also needs to have the necessary permissions and it cannot have MFA enabled.
-
Once you are done you can go back to the Settings tab and click on Verify. If the information is correct, a new incident is created with the Short Description “This is a short description“:
-
Click on Save and continue to the next step.
Create an Event Notification
-
Navigate to Configuration > Notification Settings in the Main menu.
-
Once there, click on the green
button at the bottom right, a new side panel is displayed:
Name: Is the name you want to give to this event notification.
Trigger: In this example we are building an integration that creates a new incident every time a new finding is discovered, so Finding created is used.
Integration: Select the integration just created in the previous step from the list.
Content: Provide the short_description named of the finding using the appropriate variable. You can see the list of available variables by clicking on the Available variables card.
{"short_description":"{{ finding.name }}"}
HTTP method: POST
-
Click on Add and you are ready to go!
Now an incident is created every time a new finding is discovered.
Related Articles
- 2FA on User Accounts
- Accepting a Risk
- Account
- Agent Assessment
- Agent Call Home
- Agent Installation Introduction
- Agent Introduction
- Agent Latest Version
- API Examples
- Asset Discovery
- Assets
- Authenticated Network Scan
- Automatic Asset Joining With Netsec
- Basic Credentials
- Certificates
- Change Instance Type on HIAB on Amazon Web Services
- Check Connectivity to Agent Server
- Checking if Agent is Running
- Checking if the Agent has Produced Results
- Column Configuration
- Common Settings Panel
- Configuring and Accessing the HIAB console using SSH
- Container Inspection - Azure
- Converting Normal with Webapp Scans (Netsec) to Portal Workflows
- CyberArk Integration
- Delinea Integration
- Delta
- Discovering the Agent in OUTSCAN
- Discovery Scan Configuration
- Discussions and Commenting
- DNS Lookup in UI and in Console
- Download Agents
- Event Notification - Integration
- Event Notification - Use Cases
- Filters
- Finding the Agent Version
- Firewall Rules
- Firewall Setup for Agents
- General Information about SMB/WinRM Scanning
- Generate Reports
- Getting Started with the Portal
- Hardening the HIAB
- HIAB Backup
- HIAB Console
- HIAB Deployment Guide
- HIAB Distribution Settings
- HIAB E-mail Whitelisting
- HIAB Enrollment
- HIAB Maintenance Settings
- HIAB Remote SSH Guide
- HIAB Remote Support
- HIAB Restore
- HIAB Server Settings
- HIAB Setup Guide
- HIAB Updates
- Identity and Access Management (IAM)
- Importing Tags for AWS Discovery
- Installing a Linux Agent
- Installing a macOS Agent
- Installing a Windows Agent
- Integration Management
- Integrations
- Licensing Consumption
- Log In Using LDAP
- Log In Using Single Sign-On (SSO)
- Logging in to the Portal
- Managing Agents
- Managing Tags
- Marking as False Positives
- Network Discovery
- Network Host Assessment
- Notification Settings
- Notifications
- Object Identifiers
- PGP on User Accounts
- Portal Icon List
- Portal Integration with ServiceNow Incidents
- Ports
- Products
- Products Database
- Read Agent Scan Result
- Removing an Agent from Linux
- Removing an Agent from Windows
- Report Library
- Reports
- Resource Group Management
- REST API Interface Technical Document
- Retrieving a REST API Token From XMLAPI
- Retrieving Results From the Agent in OUTSCAN
- Retrieving the Agent UUID
- Role Management
- Scan Assessment Configuration
- Scan Blueprint
- Scan Configuration Settings
- Scan Credentials
- Scan Policies
- Scan Scheduling Errors
- Scan Stages
- Scanning Range
- Scans View
- Scheduled Reports
- Schedules
- Services
- Setting Up an Agent Using System Proxy
- SMB Credentials
- SNMP Integration
- Solutions
- SSH Credentials
- Subscriptions Overview
- Supported Browsers
- Syslog Integration
- Tags
- Technical Specification
- Troubleshooting checklists
- Understanding Scanner and Scheduler
- Updating the Agent
- User Management
- Using the Agent Info Command
- View Templates
- Virtual HIAB Appliance
- VMware vSphere Credentials
- Vulnerabilities
- Vulnerability Database
- Webhook Integration
- Webhook Integration with JIRA
- Webhook Integration with Microsoft Teams
- Webhook Integration with OAuth v2
- Workflows
- XML API Interface Technical Document