Plugin ServiceNow pour Ticket Orchestrator

2.3.0 (Required minimum CE version for this is 6.0.0)

Added

• Prise en charge ajoutée pour l’attribution d’un ticket au responsable.
• Added resolution for error logs.

Changed

• Mise à jour des contrôles de validation et refactorisation du code pour améliorer la maintenabilité.

2.2.0

Added

• Prise en charge ajoutée pour le mappage des champs de statut et de gravité personnalisés (mode Table personnalisée).

2.1.0

Added

• Ajout de la prise en charge de la destination Table personnalisée.

Changed

• Rendu de l'étape des paramètres de configuration dynamique en fonction de la table de destination sélectionnée.

2.0.0

Added

• Prise en charge ajoutée pour la table des problèmes GRC.
• Prise en charge ajoutée pour les événements de points de terminaison et d'incidents.
• Prise en charge ajoutée pour le stockage des anciennes et New valeurs de gravité (Severity) et de cessionnaire (Assignee).

Changed

• Modification du comportement de stockage pour enregistrer à la fois l'ancienne et la New valeur.

1.1.0

Added

• Ajout de l'option « No Queue » dans la configuration des files d'attente.
• Ajout d'un mécanisme de nouvelle tentative pour les demandes de création/mise à jour de tickets.
• Prise en charge de la pagination ajoutée.

1.0.2

Added

• Ajout de la prise en charge de l'ajout de métadonnées au ticket d'origine.

Changed

• Modification des mappages de champs par défaut.

1.0.0

Added

• Initial release.

Voici la liste des champs pris en charge dans la Configuration de la file d'attente pour les tables par défaut que vous pouvez mapper lors de la création de l'incident sur ServiceNow.

Incident de sécurité

Incident

Questions relatives au CRG

List of APIs used

Get Incident or Security Incident or GRC Issue or Custom Table Fields

API Endpoint: <Instance URL>/api/now/table/sys_dictionary

Method: OBTENIR

Parameters

Headers

Sample API Response (Security Incident) (Status Code: 200)

{
    "result": [
        {
            "column_label": "Malware hash",
            "element": "malware_hash"
        },
        {
            "column_label": "MITRE ATT&CK Procedure (Malware)",
            "element": "mitre_malware"
        },
        {
            "column_label": "Last Updated From Source",
            "element": "last_updated_from_src"
        },
        {
            "column_label": "Number",
            "element": "number"
        },
        {
            "column_label": "Platforms(MITRE)",
            "element": "mitre_platform"
        },
        {
            "column_label": "Parent security incident",
            "element": "parent_security_incident"
        },
        {
            "column_label": "Affected user",
            "element": "affected_user"
        },
        {
            "column_label": "Alert Rule",
            "element": "alert_rule"
        },
        {
            "column_label": "New respondents",
            "element": "new_pir_respondents"
        },
        {
            "column_label": "Machine learning Prediction",
            "element": "prediction"
        },
        {
            "column_label": "Destination IP",
            "element": "dest_ip"
        },
        {
            "column_label": "Problem",
            "element": "problem"
        },
        {
            "column_label": "Service",
            "element": "business_service"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "Effective number",
            "element": "task_effective_number"
        },
        {
            "column_label": "Service offering",
            "element": "service_offering"
        },
        {
            "column_label": "Rejection goto",
            "element": "rejection_goto"
        },
        {
            "column_label": "Malware URL",
            "element": "malware_url"
        },
        {
            "column_label": "Assigned to",
            "element": "assigned_to"
        },
        {
            "column_label": "Escalation",
            "element": "escalation"
        },
        {
            "column_label": "Time worked",
            "element": "time_worked"
        },
        {
            "column_label": "Additional assignee list",
            "element": "additional_assignee_list"
        },
        {
            "column_label": "Correlation ID",
            "element": "correlation_id"
        },
        {
            "column_label": "Updated by",
            "element": "sys_updated_by"
        },
        {
            "column_label": "MITRE ATT&CK Tactic",
            "element": "mitre_tactic"
        },
        {
            "column_label": "Phish Email",
            "element": "phish_email"
        },
        {
            "column_label": "Variables",
            "element": "variables"
        },
        {
            "column_label": "Alert Sensor",
            "element": "alert_sensor"
        },
        {
            "column_label": "Additional comments",
            "element": "comments"
        },
        {
            "column_label": "Urgency",
            "element": "urgency"
        },
        {
            "column_label": "Opened",
            "element": "opened_at"
        },
        {
            "column_label": "Watch list",
            "element": "watch_list"
        },
        {
            "column_label": "SLA due",
            "element": "sla_due"
        },
        {
            "column_label": "Contract",
            "element": "contract"
        },
        {
            "column_label": "Active",
            "element": "active"
        },
        {
            "column_label": "State",
            "element": "state"
        },
        {
            "column_label": "Work notes",
            "element": "work_notes"
        },
        {
            "column_label": "Closed by",
            "element": "closed_by"
        },
        {
            "column_label": "Follow up",
            "element": "follow_up"
        },
        {
            "column_label": "Domain",
            "element": "sys_domain"
        },
        {
            "column_label": "Updates",
            "element": "sys_mod_count"
        },
        {
            "column_label": "Configuration item",
            "element": "cmdb_ci"
        },
        {
            "column_label": "Approval history",
            "element": "approval_history"
        },
        {
            "column_label": "Business duration",
            "element": "business_duration"
        },
        {
            "column_label": "Location",
            "element": "location"
        },
        {
            "column_label": "User input",
            "element": "user_input"
        },
        {
            "column_label": "Created by",
            "element": "sys_created_by"
        },
        {
            "column_label": "Source IP",
            "element": "source_ip"
        },
        {
            "column_label": "Change request",
            "element": "change_request"
        },
        {
            "column_label": "Risk",
            "element": "risk"
        },
        {
            "column_label": "Workflow activity",
            "element": "wf_activity"
        },
        {
            "column_label": "Risk change",
            "element": "risk_change"
        },
        {
            "column_label": "MITRE ATT&CK Data Source",
            "element": "mitre_data_source"
        },
        {
            "column_label": "Work notes list",
            "element": "work_notes_list"
        },
        {
            "column_label": "Skills",
            "element": "skills"
        },
        {
            "column_label": "Attack Vector",
            "element": "attack_vector"
        },
        {
            "column_label": "MITRE ATT&CK Technique",
            "element": "mitre_technique"
        },
        {
            "column_label": "Allowed groups",
            "element": "allowed_groups"
        },
        {
            "column_label": "Automation activity",
            "element": "automation_activity"
        },
        {
            "column_label": "Business impact",
            "element": "business_criticality"
        },
        {
            "column_label": "Close code",
            "element": "close_code"
        },
        {
            "column_label": "Read access",
            "element": "special_access_read"
        },
        {
            "column_label": "Privileged access",
            "element": "special_access_write"
        },
        {
            "column_label": "Risk score",
            "element": "risk_score"
        },
        {
            "column_label": "Security tags",
            "element": "security_tags"
        },
        {
            "column_label": "Severity",
            "element": "severity"
        },
        {
            "column_label": "Security incident self",
            "element": "security_incident_self"
        },
        {
            "column_label": "Incident",
            "element": "incident"
        },
        {
            "column_label": "Comments and Work notes",
            "element": "comments_and_work_notes"
        },
        {
            "column_label": "MITRE ATT&CK Adversary Group",
            "element": "mitre_group"
        },
        {
            "column_label": "Description",
            "element": "description"
        },
        {
            "column_label": "Impact",
            "element": "impact"
        },
        {
            "column_label": "Closed",
            "element": "closed_at"
        },
        {
            "column_label": "Group list",
            "element": "group_list"
        },
        {
            "column_label": "Activity due",
            "element": "activity_due"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "MITRE ATT&CK Procedure (Tool)",
            "element": "mitre_tool"
        },
        {
            "column_label": "Request assessments",
            "element": "pir_respondents"
        },
        {
            "column_label": "Allowed members",
            "element": "allowed_members"
        },
        {
            "column_label": "Task type",
            "element": "sys_class_name"
        },
        {
            "column_label": "Parent",
            "element": "parent"
        },
        {
            "column_label": "Priority",
            "element": "priority"
        },
        {
            "column_label": "Close notes",
            "element": "close_notes"
        },
        {
            "column_label": "Reassignment count",
            "element": "reassignment_count"
        },
        {
            "column_label": "Due date",
            "element": "due_date"
        },
        {
            "column_label": "Order",
            "element": "order"
        },
        {
            "column_label": "Short description",
            "element": "short_description"
        },
        {
            "column_label": "Company",
            "element": "company"
        },
        {
            "column_label": "Approval set",
            "element": "approval_set"
        },
        {
            "column_label": "Opened by",
            "element": "opened_by"
        },
        {
            "column_label": "Contact type",
            "element": "contact_type"
        },
        {
            "column_label": "Made SLA",
            "element": "made_sla"
        },
        {
            "column_label": "Created",
            "element": "sys_created_on"
        },
        {
            "column_label": "Post incident report",
            "element": "pir"
        },
        {
            "column_label": "Assignment group",
            "element": "assignment_group"
        },
        {
            "column_label": "Approval",
            "element": "approval"
        },
        {
            "column_label": "Duration",
            "element": "calendar_duration"
        },
        {
            "column_label": "Knowledge",
            "element": "knowledge"
        },
        {
            "column_label": "Correlation display",
            "element": "correlation_display"
        },
        {
            "column_label": "Updated",
            "element": "sys_updated_on"
        },
        {
            "column_label": "Other IoC",
            "element": "other_ioc"
        },
        {
            "column_label": "Referrer URL",
            "element": "referrer_url"
        },
        {
            "column_label": "Confidence score",
            "element": "confidence_score"
        },
        {
            "column_label": "Department",
            "element": "department"
        },
        {
            "column_label": "Vulnerability",
            "element": "vulnerability"
        },
        {
            "column_label": "Delivery task",
            "element": "delivery_task"
        },
        {
            "column_label": "Actual end",
            "element": "work_end"
        },
        {
            "column_label": "Domain Path",
            "element": "sys_domain_path"
        },
        {
            "column_label": "Universal Request",
            "element": "universal_request"
        },
        {
            "column_label": "Expected start",
            "element": "expected_start"
        },
        {
            "column_label": "Actual start",
            "element": "work_start"
        },
        {
            "column_label": "Upon approval",
            "element": "upon_approval"
        },
        {
            "column_label": "Transfer reason",
            "element": "route_reason"
        },
        {
            "column_label": "Enforce restriction",
            "element": "enforce_restriction"
        },
        {
            "column_label": "External URL",
            "element": "external_url"
        },
        {
            "column_label": "Delivery plan",
            "element": "delivery_plan"
        },
        {
            "column_label": "Upon reject",
            "element": "upon_reject"
        },
        {
            "column_label": "Override risk score",
            "element": "risk_score_override"
        }
    ]
}

Sample API Response (Incident) (Status Code: 200)

{
    "result": [
        {
            "column_label": "Business impact",
            "element": "business_impact"
        },
        {
            "column_label": "Probable cause",
            "element": "cause"
        },
        {
            "column_label": "Reopen count",
            "element": "reopen_count"
        },
        {
            "column_label": "Number",
            "element": "number"
        },
        {
            "column_label": "Parent Incident",
            "element": "parent_incident"
        },
        {
            "column_label": "Service",
            "element": "business_service"
        },
        {
            "column_label": "Change Request",
            "element": "rfc"
        },
        {
            "column_label": "Effective number",
            "element": "task_effective_number"
        },
        {
            "column_label": "Service offering",
            "element": "service_offering"
        },
        {
            "column_label": "Incident state",
            "element": "incident_state"
        },
        {
            "column_label": "Resolve time",
            "element": "calendar_stc"
        },
        {
            "column_label": "Rejection goto",
            "element": "rejection_goto"
        },
        {
            "column_label": "Origin table",
            "element": "origin_table"
        },
        {
            "column_label": "Resolved by",
            "element": "resolved_by"
        },
        {
            "column_label": "Assigned to",
            "element": "assigned_to"
        },
        {
            "column_label": "Escalation",
            "element": "escalation"
        },
        {
            "column_label": "Time worked",
            "element": "time_worked"
        },
        {
            "column_label": "Additional assignee list",
            "element": "additional_assignee_list"
        },
        {
            "column_label": "Correlation ID",
            "element": "correlation_id"
        },
        {
            "column_label": "Updated by",
            "element": "sys_updated_by"
        },
        {
            "column_label": "Variables",
            "element": "variables"
        },
        {
            "column_label": "Child Incidents",
            "element": "child_incidents"
        },
        {
            "column_label": "Additional comments",
            "element": "comments"
        },
        {
            "column_label": "Urgency",
            "element": "urgency"
        },
        {
            "column_label": "Opened",
            "element": "opened_at"
        },
        {
            "column_label": "Watch list",
            "element": "watch_list"
        },
        {
            "column_label": "SLA due",
            "element": "sla_due"
        },
        {
            "column_label": "Contract",
            "element": "contract"
        },
        {
            "column_label": "Active",
            "element": "active"
        },
        {
            "column_label": "State",
            "element": "state"
        },
        {
            "column_label": "Work notes",
            "element": "work_notes"
        },
        {
            "column_label": "Closed by",
            "element": "closed_by"
        },
        {
            "column_label": "Follow up",
            "element": "follow_up"
        },
        {
            "column_label": "Domain",
            "element": "sys_domain"
        },
        {
            "column_label": "Updates",
            "element": "sys_mod_count"
        },
        {
            "column_label": "Configuration item",
            "element": "cmdb_ci"
        },
        {
            "column_label": "Approval history",
            "element": "approval_history"
        },
        {
            "column_label": "Business duration",
            "element": "business_duration"
        },
        {
            "column_label": "Location",
            "element": "location"
        },
        {
            "column_label": "User input",
            "element": "user_input"
        },
        {
            "column_label": "Created by",
            "element": "sys_created_by"
        },
        {
            "column_label": "Category",
            "element": "category"
        },
        {
            "column_label": "Chronicle Incident",
            "element": "x_cdsp_chroni_itsm_chronicle_incident_ref"
        },
        {
            "column_label": "Business resolve time",
            "element": "business_stc"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "Origin",
            "element": "origin_id"
        },
        {
            "column_label": "Workflow activity",
            "element": "wf_activity"
        },
        {
            "column_label": "Caused by Change",
            "element": "caused_by"
        },
        {
            "column_label": "Work notes list",
            "element": "work_notes_list"
        },
        {
            "column_label": "Close code",
            "element": "close_code"
        },
        {
            "column_label": "Skills",
            "element": "skills"
        },
        {
            "column_label": "Resolved",
            "element": "resolved_at"
        },
        {
            "column_label": "Splunk URL",
            "element": "x_splu2_splunk_ser_splunk_url"
        },
        {
            "column_label": "Last reopened at",
            "element": "reopened_time"
        },
        {
            "column_label": "Problem",
            "element": "problem_id"
        },
        {
            "column_label": "Caller",
            "element": "caller_id"
        },
        {
            "column_label": "Subcategory",
            "element": "subcategory"
        },
        {
            "column_label": "Comments and Work notes",
            "element": "comments_and_work_notes"
        },
        {
            "column_label": "Description",
            "element": "description"
        },
        {
            "column_label": "Impact",
            "element": "impact"
        },
        {
            "column_label": "Closed",
            "element": "closed_at"
        },
        {
            "column_label": "Group list",
            "element": "group_list"
        },
        {
            "column_label": "Activity due",
            "element": "activity_due"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "Task type",
            "element": "sys_class_name"
        },
        {
            "column_label": "Parent",
            "element": "parent"
        },
        {
            "column_label": "Priority",
            "element": "priority"
        },
        {
            "column_label": "Close notes",
            "element": "close_notes"
        },
        {
            "column_label": "Reassignment count",
            "element": "reassignment_count"
        },
        {
            "column_label": "Due date",
            "element": "due_date"
        },
        {
            "column_label": "Order",
            "element": "order"
        },
        {
            "column_label": "Short description",
            "element": "short_description"
        },
        {
            "column_label": "Company",
            "element": "company"
        },
        {
            "column_label": "Approval set",
            "element": "approval_set"
        },
        {
            "column_label": "Opened by",
            "element": "opened_by"
        },
        {
            "column_label": "Contact type",
            "element": "contact_type"
        },
        {
            "column_label": "Made SLA",
            "element": "made_sla"
        },
        {
            "column_label": "Created",
            "element": "sys_created_on"
        },
        {
            "column_label": "On hold reason",
            "element": "hold_reason"
        },
        {
            "column_label": "Assignment group",
            "element": "assignment_group"
        },
        {
            "column_label": "Approval",
            "element": "approval"
        },
        {
            "column_label": "Duration",
            "element": "calendar_duration"
        },
        {
            "column_label": "Knowledge",
            "element": "knowledge"
        },
        {
            "column_label": "Correlation display",
            "element": "correlation_display"
        },
        {
            "column_label": "Updated",
            "element": "sys_updated_on"
        },
        {
            "column_label": "Delivery task",
            "element": "delivery_task"
        },
        {
            "column_label": "Actual end",
            "element": "work_end"
        },
        {
            "column_label": "Domain Path",
            "element": "sys_domain_path"
        },
        {
            "column_label": "Universal Request",
            "element": "universal_request"
        },
        {
            "column_label": "Expected start",
            "element": "expected_start"
        },
        {
            "column_label": "Notify",
            "element": "notify"
        },
        {
            "column_label": "Actual start",
            "element": "work_start"
        },
        {
            "column_label": "Upon approval",
            "element": "upon_approval"
        },
        {
            "column_label": "Severity",
            "element": "severity"
        },
        {
            "column_label": "Transfer reason",
            "element": "route_reason"
        },
        {
            "column_label": "Delivery plan",
            "element": "delivery_plan"
        },
        {
            "column_label": "Upon reject",
            "element": "upon_reject"
        },
        {
            "column_label": "Last reopened by",
            "element": "reopened_by"
        }
    ]
}

Sample API Response (GRC Issues) (Status Code: 200)

{
    "result": [
        {
            "column_label": "Is reparenting group",
            "element": "is_reparenting_group"
        },
        {
            "column_label": "Authority document",
            "element": "authority_document"
        },
        {
            "column_label": "Item",
            "element": "item"
        },
        {
            "column_label": "Issue manager",
            "element": "issue_manager"
        },
        {
            "column_label": "Issue rating",
            "element": "issue_rating"
        },
        {
            "column_label": "Management method",
            "element": "management_method"
        },
        {
            "column_label": "Document",
            "element": "document"
        },
        {
            "column_label": "Explanation",
            "element": "explanation"
        },
        {
            "column_label": "Recommendation",
            "element": "recommendation"
        },
        {
            "column_label": "Action plan",
            "element": "action_plan"
        },
        {
            "column_label": "Substate",
            "element": "substate"
        },
        {
            "column_label": "Parent issue",
            "element": "parent_issue"
        },
        {
            "column_label": "Control objective/Risk statement",
            "element": "content"
        },
        {
            "column_label": "Entity",
            "element": "profile"
        },
        {
            "column_label": "Functional domain",
            "element": "functional_domain"
        },
        {
            "column_label": "User hierarchy status",
            "element": "user_hierarchy_status"
        },
        {
            "column_label": "Is group",
            "element": "is_group"
        },
        {
            "column_label": "Issue group rule",
            "element": "issue_group_rule"
        },
        {
            "column_label": "Issue manager group",
            "element": "issue_manager_group"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "Classification",
            "element": "classification"
        },
        {
            "column_label": "Allowed groups",
            "element": "confidential_user_groups"
        },
        {
            "column_label": "Issue source",
            "element": "issue_source"
        },
        {
            "column_label": "User hierarchy 2",
            "element": "user_hierarchy_2"
        },
        {
            "column_label": "User hierarchy 1",
            "element": "user_hierarchy_1"
        },
        {
            "column_label": "Policy",
            "element": "policy"
        },
        {
            "column_label": "Confidential",
            "element": "is_confidential"
        },
        {
            "column_label": "Response",
            "element": "response"
        },
        {
            "column_label": "Confirmed date",
            "element": "confirmed_date"
        },
        {
            "column_label": "Issue type",
            "element": "issue_type"
        },
        {
            "column_label": "Allowed users",
            "element": "confidential_users"
        },
        {
            "column_label": "Created manually",
            "element": "created_manually"
        },
        {
            "column_label": "Group level",
            "element": "group_level"
        },
        {
            "column_label": "Actual end",
            "element": "work_end"
        },
        {
            "column_label": "Company",
            "element": "company"
        },
        {
            "column_label": "Task type",
            "element": "sys_class_name"
        },
        {
            "column_label": "Number",
            "element": "number"
        },
        {
            "column_label": "Impact",
            "element": "impact"
        },
        {
            "column_label": "Short description",
            "element": "short_description"
        },
        {
            "column_label": "Approval set",
            "element": "approval_set"
        },
        {
            "column_label": "Description",
            "element": "description"
        },
        {
            "column_label": "Closed",
            "element": "closed_at"
        },
        {
            "column_label": "Opened by",
            "element": "opened_by"
        },
        {
            "column_label": "Made SLA",
            "element": "made_sla"
        },
        {
            "column_label": "Group list",
            "element": "group_list"
        },
        {
            "column_label": "Contact type",
            "element": "contact_type"
        },
        {
            "column_label": "Activity due",
            "element": "activity_due"
        },
        {
            "column_label": "Created by",
            "element": "sys_created_by"
        },
        {
            "column_label": "Workflow activity",
            "element": "wf_activity"
        },
        {
            "column_label": "Rejection goto",
            "element": "rejection_goto"
        },
        {
            "column_label": "Upon reject",
            "element": "upon_reject"
        },
        {
            "column_label": "Contract",
            "element": "contract"
        },
        {
            "column_label": "Escalation",
            "element": "escalation"
        },
        {
            "column_label": "Effective number",
            "element": "task_effective_number"
        },
        {
            "column_label": "Active",
            "element": "active"
        },
        {
            "column_label": "Work notes",
            "element": "work_notes"
        },
        {
            "column_label": "Assigned to",
            "element": "assigned_to"
        },
        {
            "column_label": "Time worked",
            "element": "time_worked"
        },
        {
            "column_label": "Business service",
            "element": "business_service"
        },
        {
            "column_label": "Domain Path",
            "element": "sys_domain_path"
        },
        {
            "column_label": "State",
            "element": "state"
        },
        {
            "column_label": "Additional assignee list",
            "element": "additional_assignee_list"
        },
        {
            "column_label": "Follow up",
            "element": "follow_up"
        },
        {
            "column_label": "Sys ID",
            "element": "sys_id"
        },
        {
            "column_label": "Correlation ID",
            "element": "correlation_id"
        },
        {
            "column_label": "Created",
            "element": "sys_created_on"
        },
        {
            "column_label": "Work notes list",
            "element": "work_notes_list"
        },
        {
            "column_label": "Universal Request",
            "element": "universal_request"
        },
        {
            "column_label": "Closed by",
            "element": "closed_by"
        },
        {
            "column_label": "Domain",
            "element": "sys_domain"
        },
        {
            "column_label": "Delivery plan",
            "element": "delivery_plan"
        },
        {
            "column_label": "Upon approval",
            "element": "upon_approval"
        },
        {
            "column_label": "Parent",
            "element": "parent"
        },
        {
            "column_label": "Close notes",
            "element": "close_notes"
        },
        {
            "column_label": "Assignment group",
            "element": "assignment_group"
        },
        {
            "column_label": "Duration",
            "element": "calendar_duration"
        },
        {
            "column_label": "Priority",
            "element": "priority"
        },
        {
            "column_label": "Approval",
            "element": "approval"
        },
        {
            "column_label": "Due date",
            "element": "due_date"
        },
        {
            "column_label": "Updated by",
            "element": "sys_updated_by"
        },
        {
            "column_label": "Correlation display",
            "element": "correlation_display"
        },
        {
            "column_label": "Updates",
            "element": "sys_mod_count"
        },
        {
            "column_label": "Reassignment count",
            "element": "reassignment_count"
        },
        {
            "column_label": "Order",
            "element": "order"
        },
        {
            "column_label": "Knowledge",
            "element": "knowledge"
        },
        {
            "column_label": "Service offering",
            "element": "service_offering"
        },
        {
            "column_label": "Delivery task",
            "element": "delivery_task"
        },
        {
            "column_label": "Configuration item",
            "element": "cmdb_ci"
        },
        {
            "column_label": "Comments and Work notes",
            "element": "comments_and_work_notes"
        },
        {
            "column_label": "Urgency",
            "element": "urgency"
        },
        {
            "column_label": "Approval history",
            "element": "approval_history"
        },
        {
            "column_label": "Additional comments",
            "element": "comments"
        },
        {
            "column_label": "Opened",
            "element": "opened_at"
        },
        {
            "column_label": "Business duration",
            "element": "business_duration"
        },
        {
            "column_label": "User input",
            "element": "user_input"
        },
        {
            "column_label": "Variables",
            "element": "variables"
        },
        {
            "column_label": "Watch list",
            "element": "watch_list"
        },
        {
            "column_label": "Location",
            "element": "location"
        },
        {
            "column_label": "SLA due",
            "element": "sla_due"
        },
        {
            "column_label": "Updated",
            "element": "sys_updated_on"
        },
        {
            "column_label": "Actual start",
            "element": "work_start"
        },
        {
            "column_label": "Expected start",
            "element": "expected_start"
        },
        {
            "column_label": "Transfer reason",
            "element": "route_reason"
        },
        {
            "column_label": "Skills",
            "element": "skills"
        }
    ]
}

Get ServiceNow groups as Queue

API Endpoint: <Instance URL>/api/now/table/sys_user_group

Method: OBTENIR

Parameters

Headers

Sample API Response (Status Code: 200)

{
    "result": [
        {
            "sys_id": "01336b6347332100158b949b6c9a71b5",
            "name": "Finance Vendors"
        },
        ….
    ]
}

Create Incident or Security Incident or GRC Issue or Custom Table record

API Endpoint: <Instance URL>/api/now/table/<table>

Method: PUBLIER

Path Parameters

Headers

Body

{
    "short_description": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name",
    "description": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType",
    "assignment_group": "<group_sys_id>"
}

Sample API Response (Security Incident) (Status Code: 201)

{
    "result": {
        "parent": "",
        "sla_suspended_reason": "",
        "watch_list": "",
        "upon_reject": "cancel",
        "sys_updated_on": "2024-10-25 10:46:39",
        "qualification_group": "",
        "expected_end": "",
        "enforce_restriction": "false",
        "approval_history": "",
        "source_ip": "",
        "skills": "",
        "number": "SIR1083059",
        "problem": "",
        "previous_agent": "",
        "state": "10",
        "sys_created_by": "user1.abc",
        "template_workflow_invoked": "false",
        "knowledge": "false",
        "order": "",
        "phish_email": "",
        "cmdb_ci": "",
        "delivery_plan": "",
        "contract": "",
        "impact": "3",
        "active": "true",
        "work_notes_list": "",
        "vulnerability": "",
        "priority": "4",
        "sys_domain_path": "/",
        "sla_suspended": "false",
        "business_duration": "",
        "group_list": "",
        "special_access_write": "",
        "dest_ip": "",
        "mitre_platform": "",
        "approval_set": "",
        "risk_change": "up",
        "malware_url": "",
        "universal_request": "",
        "last_updated_from_src": "",
        "template": "",
        "short_description": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name",
        "correlation_display": "",
        "delivery_task": "",
        "work_start": "",
        "request_type": "",
        "affected_user": "",
        "other_ioc": "",
        "additional_assignee_list": "",
        "alert_sensor": "",
        "assigned_vendor": "",
        "service_offering": "",
        "sys_class_name": "sn_si_incident",
        "closed_by": "",
        "follow_up": "",
        "mitre_group": "",
        "sla_suspended_on": "",
        "estimated_end": "",
        "vendor_reference": "",
        "reassignment_count": "0",
        "assigned_to": "",
        "request_category": "",
        "requested_due_by": "",
        "mitre_malware": "",
        "sla_suspended_for": "",
        "business_criticality": "3",
        "sla_due": "",
        "opened_for": {
            "link": "https://service-now.com/api/now/table/sys_user/c813b7cb1b8342148f4aedb8b04bcb91",
            "value": "c813b7cb1b8342148f4aedb8b04bcb91"
        },
        "comments_and_work_notes": "",
        "mitre_technique": "",
        "special_access_read": "",
        "substate": "",
        "escalation": "0",
        "upon_approval": "proceed",
        "allowed_groups": "",
        "correlation_id": "",
        "asset": "",
        "mitre_tool": "",
        "spam": "false",
        "referrer_url": "",
        "made_sla": "true",
        "mitre_tactic": "",
        "is_catalog": "false",
        "malware_hash": "",
        "alert_rule": "",
        "task_effective_number": "SIR1083059",
        "external_url": "",
        "sys_updated_by": "user1.abc",
        "opened_by": {
            "link": "https://service-now.com/api/now/table/sys_user/c813b7cb1b8342148f4aedb8b04bcb91",
            "value": "c813b7cb1b8342148f4aedb8b04bcb91"
        },
        "user_input": "",
        "sys_created_on": "2024-10-25 10:46:39",
        "sys_domain": {
            "link": "https://service-now.com/api/now/table/sys_user_group/global",
            "value": "global"
        },
        "pir": "",
        "route_reason": "",
        "closed_at": "",
        "allowed_members": "",
        "business_service": "",
        "attack_vector": "",
        "time_worked": "",
        "expected_start": "",
        "opened_at": "2024-10-25 10:46:39",
        "task_created": "false",
        "x_cdsp_chroni_sir_chronicle_si": "",
        "work_end": "",
        "confidence_score": "",
        "prediction": "",
        "automation_activity": "",
        "subcategory": "",
        "work_notes": "",
        "security_tags": "",
        "risk_score_override": "false",
        "initiated_from": "",
        "close_code": "",
        "assignment_group": {
            "link": "https://service-now.com/api/now/table/sys_user_group/<group_sys_id>",
            "value": "<group_sys_id>"
        },
        "description": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType",
        "calendar_duration": "",
        "close_notes": "",
        "pir_respondents": "",
        "sys_id": "f25adc501b255a549f2eeb98b04bcb56",
        "contact_type": "",
        "urgency": "3",
        "secure_notes": "",
        "company": "",
        "new_pir_respondents": "",
        "department": "",
        "activity_due": "",
        "severity": "2",
        "comments": "",
        "risk_score": "40",
        "approval": "not requested",
        "due_date": "",
        "sys_mod_count": "0",
        "parent_security_incident": "",
        "sys_tags": "",
        "billable": "false",
        "mitre_data_source": "",
        "caller": "",
        "location": "",
        "risk": "3",
        "category": "",
        "incident": "",
        "change_request": "",
        "security_incident_self": {
            "link": "https://service-now.com/api/now/table/sn_si_incident/f25adc501b255a549f2eeb98b04bcb56",
            "value": "f25adc501b255a549f2eeb98b04bcb56"
        }
    }
}

Sample API Response (Incident) (Status Code: 201)

{
    "result": {
        "parent": "",
        "made_sla": "true",
        "caused_by": "",
        "watch_list": "",
        "upon_reject": "cancel",
        "sys_updated_on": "2024-10-25 10:44:54",
        "child_incidents": "0",
        "hold_reason": "",
        "origin_table": "",
        "task_effective_number": "INC0923990",
        "approval_history": "",
        "skills": "",
        "number": "INC0923990",
        "resolved_by": "",
        "sys_updated_by": "user1.abc",
        "opened_by": {
            "link": "https://service-now.com/api/now/table/sys_user/c813b7cb1b8342148f4aedb8b04bcb91",
            "value": "c813b7cb1b8342148f4aedb8b04bcb91"
        },
        "user_input": "",
        "sys_created_on": "2024-10-25 10:44:54",
        "sys_domain": {
            "link": "https://service-now.com/api/now/table/sys_user_group/global",
            "value": "global"
        },
        "state": "1",
        "route_reason": "",
        "sys_created_by": "user1.abc",
        "knowledge": "false",
        "order": "",
        "calendar_stc": "",
        "x_cdsp_chroni_itsm_chronicle_incident_ref": "",
        "closed_at": "",
        "cmdb_ci": "",
        "delivery_plan": "",
        "contract": "",
        "impact": "3",
        "active": "true",
        "work_notes_list": "",
        "business_service": "",
        "business_impact": "",
        "priority": "5",
        "sys_domain_path": "/",
        "rfc": "",
        "time_worked": "",
        "expected_start": "",
        "opened_at": "2024-10-25 10:44:54",
        "business_duration": "",
        "group_list": "",
        "work_end": "",
        "caller_id": "",
        "reopened_time": "",
        "resolved_at": "",
        "approval_set": "",
        "subcategory": "",
        "work_notes": "",
        "universal_request": "",
        "short_description": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name",
        "close_code": "",
        "correlation_display": "",
        "delivery_task": "",
        "work_start": "",
        "assignment_group": {
            "link": "https://service-now.com/api/now/table/sys_user_group/<group_sys_id>",
            "value": "<group_sys_id>"
        },
        "additional_assignee_list": "",
        "business_stc": "",
        "cause": "",
        "description": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType",
        "origin_id": "",
        "calendar_duration": "",
        "close_notes": "",
        "notify": "1",
        "service_offering": "",
        "sys_class_name": "incident",
        "closed_by": "",
        "follow_up": "",
        "parent_incident": "",
        "sys_id": "d1f994dc1be15a549f2eeb98b04bcb71",
        "contact_type": "",
        "reopened_by": "",
        "incident_state": "1",
        "urgency": "3",
        "problem_id": "",
        "company": "",
        "reassignment_count": "0",
        "activity_due": "",
        "assigned_to": "",
        "severity": "3",
        "comments": "",
        "approval": "not requested",
        "sla_due": "",
        "comments_and_work_notes": "",
        "due_date": "",
        "sys_mod_count": "0",
        "reopen_count": "0",
        "sys_tags": "",
        "escalation": "0",
        "upon_approval": "proceed",
        "correlation_id": "",
        "location": "",
        "category": "inquiry"
    }
}

Sample API Response (GRC Issue) (Status Code: 201)

{
    "result": {
        "parent": "",
        "shadow": "false",
        "watch_list": "",
        "authority_document": "",
        "recommendation": "",
        "wbs": "",
        "upon_reject": "cancel",
        "sys_updated_on": "2024-10-25 10:46:11",
        "explanation": "",
        "approval_history": "",
        "rollup": "false",
        "skills": "",
        "number": "IPT0020059",
        "schedule_start_date": "2024-10-25 10:46:11",
        "capex_cost": "0",
        "state": "1",
        "sys_created_by": "user1.abc",
        "knowledge": "false",
        "order": "",
        "work_duration": "",
        "item": "",
        "budget_cost": "0",
        "cmdb_ci": "",
        "dependency": "",
        "contract": "",
        "impact": "3",
        "key_milestone": "false",
        "profile": "",
        "remaining_effort": "",
        "active": "true",
        "work_notes_list": "",
        "functional_domain": "",
        "classification": "",
        "priority": "4",
        "sys_domain_path": "/",
        "version": "",
        "business_duration": "",
        "group_list": "",
        "override_status": "false",
        "approval_set": "",
        "critical_path": "false",
        "status": "green",
        "universal_request": "",
        "end_date": "2024-10-26 10:46:11",
        "short_description": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name",
        "correlation_display": "",
        "work_start": "",
        "top_task": {
            "link": "https://service-now.com/api/now/table/planned_task/444a541847e5161034d5e0d3706d4326",
            "value": "444a541847e5161034d5e0d3706d4326"
        },
        "parent_issue": "",
        "time_constraint": "asap",
        "document": "",
        "additional_assignee_list": "",
        "service_offering": "",
        "sys_class_name": "sn_grc_issue",
        "closed_by": "",
        "follow_up": "",
        "calculation_type": "automatic",
        "confidential_user_groups": "",
        "reassignment_count": "0",
        "schedule_end_date": "2024-10-26 10:46:11",
        "assigned_to": "",
        "policy": "",
        "start_date": "2024-10-25 10:46:11",
        "mpp_task_id": "",
        "sub_tree_root": "",
        "sla_due": "",
        "comments_and_work_notes": "",
        "remaining_duration": "",
        "has_conflict": "false",
        "substate": "",
        "allow_dates_outside_schedule": "false",
        "escalation": "0",
        "upon_approval": "proceed",
        "issue_manager": "",
        "correlation_id": "",
        "group_level": "",
        "made_sla": "true",
        "user_hierarchy_2": "",
        "user_hierarchy_1": "",
        "wbs_order": "",
        "task_effective_number": "IPT0020059",
        "work_effort": "",
        "sys_updated_by": "user1.abc",
        "opened_by": {
            "link": "https://service-now.com/api/now/table/sys_user/dadb5bc43be9d210c71edd6aa5e45a1b",
            "value": "dadb5bc43be9d210c71edd6aa5e45a1b"
        },
        "user_input": "",
        "sys_created_on": "2024-10-25 10:46:11",
        "sys_domain": {
            "link": "https://service-now.com/api/now/table/sys_user_group/global",
            "value": "global"
        },
        "route_reason": "",
        "start_date_derived_from": "",
        "orig_sys_id": "",
        "closed_at": "",
        "is_reparenting_group": "false",
        "level": "",
        "business_service": "",
        "confidential_users": "",
        "is_confidential": "false",
        "relation_applied": "",
        "time_worked": "",
        "expected_start": "",
        "issue_group_rule": "",
        "opened_at": "2024-10-25 10:46:11",
        "task": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name​IPT0020059",
        "work_end": "",
        "run_calc_brs": "true",
        "work_notes": "",
        "work_cost": "0",
        "assignment_group": "",
        "orig_top_task_id": "",
        "user_hierarchy_status": "2",
        "software_model": "",
        "created_manually": "true",
        "description": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType",
        "effort": "",
        "calendar_duration": "",
        "end_date_derived_from": "",
        "close_notes": "",
        "content": "",
        "duration": "1970-01-02 00:00:00",
        "issue_manager_group": "",
        "sys_id": "444a541847e5161034d5e0d3706d4326",
        "contact_type": "",
        "urgency": "3",
        "constraint_date": "",
        "company": "",
        "end": "2024-10-25",
        "activity_due": "",
        "comments": "",
        "cost": "0",
        "approval": "not requested",
        "due_date": "",
        "issue_type": "",
        "start": "2024-10-25",
        "sys_mod_count": "0",
        "management_method": "",
        "confirmed_date": "",
        "model_id": "",
        "opex_cost": "0",
        "sys_tags": "",
        "time_zone": "",
        "html_description": "",
        "percent_complete": "0",
        "is_group": "false",
        "milestone": "false",
        "issue_source": "44ab97f6c75200107e299e0703c2602a",
        "action_plan": "",
        "response": "",
        "issue_rating": "",
        "location": ""
    }
}

Get Incident or Security Incidents or GRC Issues or Custom Table Record

API Endpoint: <Instance URL>/api/now/table/<table>

Method: OBTENIR

Path Parameters

Parameters

Headers

Sample API Response (Status Code: 200)

{
    "result": [
        {
            "severity": "2",
            "sys_id": "f25adc501b255a549f2eeb98b04bcb56",
            "state": "10",
            "assigned_to": {
                "link": "https://<Instance URL>/api/now/table/sys_user/324sndm",
                "value": "324sndm"
            }
        }
    ]
}

Sample API Response (GRC Issue) (Status Code: 200)

{
    "result": [
        {
            "sys_id": "444a541847e5161034d5e0d3706d4326",
            "impact": "3",
            "state": "1",
            "assigned_to": ""
        }
    ]
}

Update Incident or Security Incident or GRC Issue or Custom Table record

API Endpoint: <Instance URL>/api/now/table/<table>

Method: PATCH

Path Parameters

Headers

Body

{
    "work_notes": "Received new alert with Alert ID: $id and Alert Name: $alertName in Cloud Exchange."
}

Sample API Response (Status Code: 200)

{
    "result": {
        "parent": "",
        "sla_suspended_reason": "",
        "watch_list": "",
        "upon_reject": "cancel",
        "sys_updated_on": "2024-10-25 11:56:25",
        "qualification_group": "",
        "expected_end": "",
        "enforce_restriction": "false",
        "approval_history": "",
        "source_ip": "",
        "skills": "",
        "number": "SIR1083059",
        "problem": "",
        "previous_agent": "",
        "state": "10",
        "sys_created_by": "user1.abc",
        "template_workflow_invoked": "false",
        "knowledge": "false",
        "order": "",
        "phish_email": "",
        "cmdb_ci": "",
        "delivery_plan": "",
        "contract": "",
        "impact": "3",
        "active": "true",
        "work_notes_list": "",
        "vulnerability": "",
        "priority": "4",
        "sys_domain_path": "/",
        "sla_suspended": "false",
        "business_duration": "",
        "group_list": "",
        "special_access_write": "",
        "dest_ip": "",
        "mitre_platform": "",
        "approval_set": "",
        "risk_change": "up",
        "malware_url": "",
        "universal_request": "",
        "last_updated_from_src": "automation",
        "template": "",
        "short_description": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name",
        "correlation_display": "",
        "delivery_task": "",
        "work_start": "",
        "request_type": "",
        "affected_user": "",
        "other_ioc": "",
        "additional_assignee_list": "",
        "alert_sensor": "",
        "assigned_vendor": "",
        "service_offering": "",
        "sys_class_name": "sn_si_incident",
        "closed_by": "",
        "follow_up": "",
        "mitre_group": "",
        "sla_suspended_on": "",
        "estimated_end": "",
        "vendor_reference": "",
        "reassignment_count": "0",
        "assigned_to": "",
        "request_category": "",
        "requested_due_by": "",
        "mitre_malware": "",
        "sla_suspended_for": "",
        "business_criticality": "3",
        "sla_due": "",
        "opened_for": {
            "link": "https://service-now.com/api/now/table/sys_user/c813b7cb1b8342148f4aedb8b04bcb91",
            "value": "c813b7cb1b8342148f4aedb8b04bcb91"
        },
        "comments_and_work_notes": "",
        "mitre_technique": "",
        "special_access_read": "",
        "substate": "",
        "escalation": "0",
        "upon_approval": "proceed",
        "allowed_groups": "",
        "correlation_id": "",
        "asset": "",
        "mitre_tool": "",
        "spam": "false",
        "referrer_url": "",
        "made_sla": "true",
        "mitre_tactic": "",
        "is_catalog": "false",
        "malware_hash": "",
        "alert_rule": "",
        "task_effective_number": "SIR1083059",
        "external_url": "",
        "sys_updated_by": "user1.abc",
        "opened_by": {
            "link": "https://service-now.com/api/now/table/sys_user/c813b7cb1b8342148f4aedb8b04bcb91",
            "value": "c813b7cb1b8342148f4aedb8b04bcb91"
        },
        "user_input": "",
        "sys_created_on": "2024-10-25 10:46:39",
        "sys_domain": {
            "link": "https://service-now.com/api/now/table/sys_user_group/global",
            "value": "global"
        },
        "pir": "",
        "route_reason": "",
        "closed_at": "",
        "allowed_members": "",
        "business_service": "",
        "attack_vector": "",
        "time_worked": "",
        "expected_start": "",
        "opened_at": "2024-10-25 10:46:39",
        "task_created": "false",
        "x_cdsp_chroni_sir_chronicle_si": "",
        "work_end": "",
        "confidence_score": "",
        "prediction": "",
        "automation_activity": "",
        "subcategory": "",
        "work_notes": "",
        "security_tags": "",
        "risk_score_override": "false",
        "initiated_from": "",
        "close_code": "",
        "assignment_group": {
            "link": "https://service-now.com/api/now/table/sys_user_group/<group_sys_id>",
            "value": "<group_sys_id>"
        },
        "description": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType",
        "calendar_duration": "",
        "close_notes": "",
        "pir_respondents": "",
        "sys_id": "f25adc501b255a549f2eeb98b04bcb56",
        "contact_type": "",
        "urgency": "3",
        "secure_notes": "",
        "company": "",
        "new_pir_respondents": "",
        "department": "",
        "activity_due": "",
        "severity": "2",
        "comments": "",
        "risk_score": "40",
        "approval": "not requested",
        "due_date": "",
        "sys_mod_count": "2",
        "parent_security_incident": "",
        "sys_tags": "",
        "billable": "false",
        "mitre_data_source": "",
        "caller": "",
        "location": "",
        "risk": "3",
        "category": "",
        "incident": "",
        "change_request": "",
        "security_incident_self": {
            "link": "https://service-now.com/api/now/table/sn_si_incident/f25adc501b255a549f2eeb98b04bcb56",
            "value": "f25adc501b255a549f2eeb98b04bcb56"
        }
    }
}

Fetch Assignee Users

API Endpoint: <Instance URL>/api/now/table/sys_user

Method: OBTENIR

Parameters

Headers

Sample API Response (Status Code: 200)

{
    "result": [
        {
            "sys_id": "800b174138d089c868d09de320f9833b",
            "user_name": "user.abc"
        }
    ]
}