ServiceNow

Crawler

Overview

ServiceNow is an IT service management platform for recording, tracking, and managing a company’s enterprise-level IT processes in a single location. This integration allows you to create tickets from triggered alarms in Datadog with the @notification feature. Assignment Groups are automatically pulled in as separate @notification groups when the integration is enabled.

Additionally, this integration enables you to add Datadog-generated graphs and comments to ServiceNow tickets, as well as manage the resolution workflow from within Datadog.

Setup

It’s recommended to install the Datadog update set on your ServiceNow instance. This allows you to customize the data you receive on ServiceNow and make custom transformations to the tables you use.

Datadog’s update set creates a set of interim tables that Datadog notifications are sent to. It also adds transform maps that allow you to control how the data from those notifications is mapped to other tables.

Installation

1. Install the Datadog update set in ServiceNow.
2. Define additional mappings and transformations from the Datadog tables to your target table.
3. Enter your ServiceNow details in the integration tile in Datadog.
4. Notifications to @servicenow populate the Datadog interim table and your target table.

Update set

Import the Datadog XML update set provided. In ServiceNow:

• Search for Update set.
• Find Retrieved Update Sets in the menu.
• Manually import the Datadog-SNow_Update_Set_vX.X.X.xml file.

Once you upload the XML file, it shows a state of Loaded. Click on the name of the update set to preview and commit the code to the system.

Preview the update set to ensure there are no errors:

Select Commit Update Set to merge the application into your system:

You should now be able to search for Datadog in the navigation menu and see tables appear:

Defining custom mappings

Click on Datadog Incident Tables (for example) and navigate to the bottom of the record to see the link for the associated transform map:

Understanding the Mapping

Click on the name of the transform map to view the record:

At the top are two important fields on the Transform record - Source table and Target table:

Notes:

• The source is the import set table you selected (Datadog Incident Tables) and the target is your actual Incident table (or Event table) where events are stored.

• The field mappings are at the bottom of the record. Some basic mappings are included. This is where you select the fields to include, define the format, and select the target fields in your ServiceNow instance.

Add a new field mapping

Click New:

Select the source and target fields for one to one mappings:

Or, check the Use source script box and define transformations:

Define multiple mappings quickly

Use Mapping Assist (under Related Links) to map several source and target fields:

Datadog integration tile

• In Datadog, go to the Integrations page and find the ServiceNow tile.
• Add the instance name, which is the subdomain only (for foo.service-now.com, only enter foo).
• Add the username and password for your ServiceNow instance - create a limited user in ServiceNow just for Datadog.
• Select the intermediary table you want to send notifications to from the dropdown.

Permissions

The ServiceNow user needs rest_service and x_datad_datadog.user roles so that it can access the import tables. If you’re using the legacy way of sending notifications directly to either the Incident table or Event table, you need the permissions itil and evt_mgmt_integration.

Validation

To validate the integration is set up correctly, add @servicenow in a monitor or event notification. The raw data populates rows in the interim table and is forwarded to the ServiceNow table specified in the mappings and transformations you created.

Troubleshooting

If you’re not seeing events in your ServiceNow tables:

• Seeing an error message in your Datadog integration tile or an Error while trying to post to your ServiceNow instance notification:
  • Check that you only used the subdomain when you entered your instance name.
  • Check that the user you created has the required permissions.
  • Double check that the username and password are correct.
• The integration is configured, an alert triggered, and no ticket is created:
  • Confirm that the interim table is populated. If so, the issue is with mappings and transformations. You can debug your mappings and scripts further by navigating to Transform Errors in ServiceNow.
  • Confirm that you’re working with the interim table you specified in the tile.

Need additional help? Contact Datadog support.

Knowledge Base

Auto-generate support tickets from Datadog alerts

After ServiceNow is connected to your Datadog account, alerts received can automatically create support tickets and send them to the ServiceNow ticketing queue. From there, your support team is notified of issues using the communication workflows that you have already established inside ServiceNow. Mention @servicenow in the alert message or add @servicenow to the notification list for that monitor.

Use variables in ticket payload and field mappings

Variables can be used in the body of your alerts or in field mappings to ensure details from the event are included in ServiceNow. For example, you can include the title and severity in the appropriate ServiceNow field or you can include a link back to the specific incident in Datadog right from the ServiceNow ticket.

Automate support resolution workflow

Once the monitor state returns to normal, the associated support ticket is automatically marked as “resolved”.

Send Datadog graphs to ServiceNow

In addition to automating ticket creation and resolution, you can also use Datadog to create ServiceNow tickets on an ad hoc basis whenever you see something in Datadog that needs your team’s attention. Click the camera icon to share a snapshot of any Timeboard graph, add some context in the comment box to help your colleagues interpret the graph, and @servicenow to send the graph and your comments to ServiceNow.

Further Reading