ServiceNow

Crawler

Overview

ServiceNow is an IT service management platform for recording, tracking, and managing a company’s enterprise-level IT processes in a single location.

The Datadog ServiceNow integration is a two-way integration that allows you to:

1. Create context-rich incidents or events in ServiceNow from Datadog alerts.
2. Sync important metadata like business services from your CMDB to Datadog, and leverage these as tags across the Datadog platform for grouping, filtering, and alerting.
3. Create server configuration items (CIs) in CMDB for newly discovered hosts from Datadog.

Datadog integrates with the follow ServiceNow tools:

• ITOM
• ITSM
• CMDB

Note: Each of these ServiceNow modules can be used independently of each other with the integration. For example, you can use ITSM without CMDB.

Setup

To use any of the modules, first, install the latest Datadog Update Set on your ServiceNow instance, and configure the ServiceNow integration tile in Datadog.

1. Install the latest Datadog Update Set
2. Set Datadog account permissions
3. Instructions for use with CMDB
4. Instructions for use with ITOM and ITSM

Install the Datadog Update Set

In ServiceNow:

• Search for Update Set.
• Find Retrieved Update Sets in the menu.
• Manually import the Datadog-SNow_Update_Set_vX.X.X.xml file.

Import the Datadog XML Update Set provided.

Once you upload the XML file, it shows a state of Loaded. Click on the name of the Update Set to preview and commit the code to the system.

Preview the Update Set to ensure there are no errors:

Select Commit Update Set to merge the application into your system:

You should now be able to search for Datadog in the navigation menu and see tables appear:

Permissions

In order to access import tables and apply transform maps, the ServiceNow user needs the following permissions:

• x_datad_datadog.user
• import_set_loader
• import_transformer

For ITOM and ITSM users:

If you’d like to send notifications directly to the Incident table or Event table, you need the ITIL and evt_mgmt_integration roles.

Configuring integration for use with the CMDB

This step assumes you have already installed the latest Datadog Update Set. If you have not, see the instructions for installing the latest update set.

Add Datadog as a Discovery Source to match and add CIs to the CMDB.

1. In ServiceNow, navigate to System Definitions > Choice Lists and create a new entry with the following values:

   • Table: Configuration Item [cmdb_ci]
   • Element: discovery_source
   • Label: Datadog
   • Value: Datadog

2. Search for the Datadog integration, and click on the Datadog Integration Settings in the menu.

3. Enable the setting: Enable adding Datadog hosts into ServiceNow CMDB

   • This enables Datadog to push configuration data to the ServiceNow CMDB. Tags can be added to hosts that have been matched with ServiceNow CMDB CIs within Datadog.
     

   Note: The “Enable adding Datadog hosts into ServiceNow CMDB” option must be enabled for the tag syncing functionality to work.

   • By default, no tags are synced from ServiceNow to Datadog. There are three potential sources of data for tags:

     • Labels
     • Business Services
     • Configuration Item (CI) attributes

   • In the example configuration below, both Labels and Business Services are added as tags. Also, sys_id and sys_class_name attributes are added as tags.

4. You can customize how often data is written to your CMDB by updating your autoflush rule

5. You can also customize your entries to the CMDB by setting custom transform maps

6. Configure the ServiceNow integration tile in Datadog

Configuring for use with ITOM and ITSM modules

Notifications using @servicenow in Datadog populate the interim tables selected in your ServiceNow tile. Note the following steps assume you have already set up the ServiceNow tile in the Datadog integrations page. Once that has been completed:

1. From the dropdown, select the intermediary table you want to send notifications to from the dropdown.
2. To validate the integration is set up correctly, add @servicenow in a monitor or event notification. The raw data populates rows in the interim table and is forwarded to the ServiceNow table specified in the mappings and transformations you created.
3. Use transform maps to customize the formatting for data sent to the tables,
4. Configure the ServiceNow integration tile in Datadog

Configure the ServiceNow tile in Datadog

1. Navigate in Datadog to the ServiceNow integration tile, on the Integrations page.
2. Add the instance name, which is the subdomain of your ServiceNow domain: <INSTANCE_NAME>.service-now.com.
3. Add the username and password for your ServiceNow instance. If you are using the ITSM or ITOM module, and would like to send notifications to an intermediary table, you can select one from the dropdown.

Note: You can create a limited user in ServiceNow just for Datadog.

Customize data with transform maps

For use with CMDB

Datadog provides transform maps that create incidents and CMDB configuration items. Since every CMDB can potentially be different, you should verify the default match required by your CMDB.

To navigate to the Transform Maps:

1. Search for Datadog Tables or Import hosts.
2. Choose a table on the sidebar.
3. Click on the Transform Maps button in the Related Links section.

The “Import hosts” table has two Transform Maps, one for each potential profile that can be created. If the operating system is Linux, then the cmdb_ci_linux_server profile is created (or matched with an existing CI). Otherwise the cmdb_ci_server profile is used as a fallback. Additional Transform Maps can be created to make sure the right Configuration profiles are being used.

For more details about how to modify or define additional mappings and transformations, see the Defining custom mappings section.

For use with ITOM and ITSM

The Datadog Incident and Datadog Event tables use a transform map to transform Datadog events to corresponding incidents and events in ServiceNow.

Troubleshooting

If you’re not seeing events in your ServiceNow tables and instead have

• An error message in your Datadog integration tile or an Error while trying to post to your ServiceNow instance notification:

  • Verify only the subdomain was used when entering your instance name.
  • Verify the user you created has the required permissions.
  • Verify the username and password are correct.

• The integration is configured, an alert triggered, and no ticket is created:

  • Confirm that the interim table is populated. If so, the issue is with mappings and transformations. You can debug your mappings andscripts further by navigating to Transform Errors in ServiceNow.
  • Confirm that you’re working with the interim table you specified in the tile.

The ServiceNow user needs rest_service and x_datad_datadog.user roles so that it can access the import tables. If you’re using the legacy way of sending notifications directly to either the Incident table or Event table, you need the permissions itil and evt_mgmt_integration.

Need additional help? Contact Datadog support.

Knowledge Base

Datadog Import Host AutoFlush Rule

To prevent the import set table x_datad_datadog_import_host from accumulating too many rows, an AutoFlush Rule has been added to the Table Cleaner tool to keep only the last 24 hours of data. This configuration setting can be changed as needed by navigating to sys_auto_flush_list.do in the filter navigator and going into the rule for the x_datad_datadog_import_host table. The Age in seconds field can be updated accordingly.

Auto-generate support tickets from Datadog alerts

After ServiceNow is connected to your Datadog account, alerts received can automatically create support tickets and send them to the ServiceNow ticketing queue. From there, your support team is notified of issues using the communication workflows that you have already established inside ServiceNow. Mention @servicenow in the alert message or add @servicenow to the notification list for that monitor.

Use variables in ticket payload and field mappings

Variables can be used in the body of your alerts or in field mappings to ensure details from the event are included in ServiceNow. For example, you can include the title and severity in the appropriate ServiceNow field or you can include a link back to the specific incident in Datadog right from the ServiceNow ticket.

Automate support resolution workflow

Once the monitor state returns to normal, the associated support ticket is automatically marked as “resolved”.

Send Datadog graphs to ServiceNow

In addition to automating ticket creation and resolution, you can use Datadog to create ServiceNow tickets on an ad hoc basis whenever you see something in Datadog that needs your team’s attention. Click the camera icon to share a snapshot of any Timeboard graph, add some context in the comment box, and @servicenow to send the graph and your comments to ServiceNow.

Defining custom mappings

Click on Datadog Incident Tables (for example) and navigate to the bottom of the record to see the link for the associated transform map:

Understanding the mapping

Click on the name of the transform map to view the record:

At the top are two important fields on the Transform record - Source table and Target table:

Notes:

• The source is the import set table you selected (Datadog Incident Tables) and the target is your actual incident table (or event table) where events are stored.
• The field mappings are at the bottom of the record. Some basic mappings are included. This is where you select the fields to include, define the format, and select the target fields in your ServiceNow instance.

Add a new field mapping

Click New:

Select the source and target fields for one to one mappings:

Or, check the Use source script box and define transformations:

Note: For mapping any custom fields in the Integration Tile, you can use the following mapping script for either the Datadog Event and Incident Transform maps. In this example the field my_field was defined as a custom field in the integration tile:

answer = (function transformEntry(source)
{
    var additional_info = JSON.parse(source.additional_info);
    return additional_info.custom_my_field;
})(source);

Define multiple mappings

Use Mapping Assist (under Related Links) to map several source and target fields:

Validation

To validate the integration is set up correctly, add @servicenow in a monitor or event notification. The raw data populates rows in the interim table and is forwarded to the ServiceNow table specified in the mappings and transformations you created.

Further Reading

Additional helpful documentation, links, and articles:

Create ServiceNow tickets from Datadog alertsBLOG