Create ServiceNow tickets

Raise a ServiceNow incident whenever devices fall into a Tracked View, with the affected devices and the issue in the ticket. Use it for ongoing requirements such as “every Windows server has Microsoft Defender deployed and functioning”. The flow sends an HTTP request to ServiceNow’s Table API to create an incident. Parts 1 to 3 happen in ServiceNow; parts 4 to 7 in ThreatAware.

Before you start

You need	Usually done by
Admin access to the ServiceNow instance, to create a user and assign roles	The customer’s ServiceNow admin (parts 1 to 3)
A Tracked View of the devices to raise tickets for, and access to Action Center	A ThreatAware user or the Customer Success team (parts 4 to 7)
Agreed values for the assignment group, business service and any other ticket fields	Both, before part 6

If you have an existing integration user profile in ServiceNow, feel free to skip ahead to step 4.

Part 1: Create an integration user in ServiceNow

Open Users

Name the user

Enter a User ID, for example threataware.incident.creation.

Allow API access only

Tick Web service access only, so the account can use the API but can’t sign in to the ServiceNow interface. Click Save.

Part 2: Assign roles

Edit the user's roles

Open the saved user record, go to the Roles tab and click Edit.

Add a role that can create incidents

Add the itil role, or your organisation’s least-privilege equivalent that can create incident records. If your instance enforces REST API access policies, also add snc_platform_rest_api_access. Click Save.

Don’t skip this part. A user with no roles can authenticate but can’t create incidents, so every request from ThreatAware is rejected with 403 Forbidden.

Part 3: Set the password

Generate a password

On the user record, click Set Password and generate a strong password.

Untick Password needs reset

Make sure Password needs reset is unticked. If it’s left ticked, ServiceNow refuses the API sign-in and ThreatAware gets 401 Unauthorized.

Store it safely

Copy the password into your password vault. You need it in part 5.

Part 4: Create the flow in ThreatAware

Track the devices

In Devices, build the view of devices that should raise tickets and track it, usually as Continuous.

Create a flow

In Action Center, click New flow, name it, and add an HTTP request step connected to Start of action.

Set the URL

Set the method to POST and the URL to:

https://<your-instance>.service-now.com/api/now/table/incident

Replace <your-instance> with the name at the start of your ServiceNow address. Only the instance name comes from the address bar; add the /api/now/table/incident path exactly as shown.

Part 5: Add the request headers

Join the username and password with a colon and base64-encode the result. Do this on your own machine rather than with an online encoder, so the password never leaves it:

echo -n 'username:password' | base64

[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('username:password'))

Add these three headers to the HTTP request step:

Key	Value
`Accept`	`application/json`
`Content-Type`	`application/json`
`Authorization`	`Basic <your-base64-string>`

Spell the key Authorization, with a “z”. “Authorisation” isn’t recognised. Leave exactly one space between Basic and the encoded string. ThreatAware saves header values as masked secrets; if you edit the URL later, you’ll need to enter them again.

Part 6: Write the ticket body

In the HTTP request step, click + Add and choose Body. Map ThreatAware data to your incident fields so each ticket carries the affected devices, the issue and the risk. Use Insert merge field in the body to add device details. For example:

{
  "short_description": "CrowdStrike deployment project",
  "description": "The following {{count}} devices do not have CrowdStrike deployed",
  "caller_id": "threataware.incident.creation",
  "assignment_group": "Deployment Management",
  "business_service": "Applications/Software",
  "service_offering": "ThreatAware",
  "location": "London",
  "contact_type": "Monitoring"
}

{{count}} is the number of devices in the run. See Device details in a step for the other merge fields.

Field type	What it needs
Reference fields (`caller_id`, `assignment_group`, `business_service`, `service_offering`, `location`)	The exact display name of an existing ServiceNow record, or its `sys_id`. If it doesn’t match, the ticket is still created but the field is left blank.
Choice fields (`contact_type`)	The value configured on your instance (the backend value, not the label). Check these with your ServiceNow admin.

Part 7: Set triggers, test and publish

Point it at your tracked view

Click Triggers and choose your tracked view under Trigger from. Set a Maximum device count as an emergency stop, and choose Per device (one ticket per device) or All at once (one ticket for the group) under Run mode. See Triggers.

Test

Click Debug on Start of action to try the flow, then in ServiceNow open Incident > All and check a new incident has been created with every field filled in as expected.

Publish

Click Publish. From now on, devices entering the tracked view raise tickets.

Once the step works, right-click it and choose Save as template. Anyone building another ServiceNow flow can then add it from Shared Templates and only needs to change the body. See Templates.

Two-way sync. When the ticket is closed in ServiceNow, the device is resolved in ThreatAware.

Troubleshooting

Symptom	Likely cause and fix
`401 Unauthorized`	Wrong credentials or base64 string, the header key is misspelled, or Password needs reset is still ticked (part 3)
`403 Forbidden`	The integration user is missing a role (part 2)
`400 Bad Request`	A body key is misspelled, or the body isn’t valid JSON
`404 Not Found`	The instance name or the `/api/now/table/incident` path is wrong (part 4)
Ticket created, but some fields blank	A reference or choice value doesn’t match what exists on the instance (part 6)
No tickets being raised	No devices are currently in the tracked view, the flow isn’t published, or the Minimum time in view hasn’t passed yet

Security: use this ServiceNow account only for ThreatAware, keep its roles to the minimum needed, and rotate the password in line with your policy. When you do, update the Authorization header in the flow.

Still on ThreatAware 3.2?

On ThreatAware 3.2, set this up as an Action on a saved view instead of a flow. Open the saved view, open its action, select the continuous trigger and choose Create Ticket. The URL, headers and body are the same as above. Click Create and Run to save the action and trigger it straight away.

Get started

Inventory

Tags, Logic & Coverage

Vitals & Issues

Action Center

Integrations

Reporting

Access & Admin

Reference

Trust & Security

Before you start

Part 1: Create an integration user in ServiceNow

Part 2: Assign roles

Part 3: Set the password

Part 4: Create the flow in ThreatAware

Part 5: Add the request headers

Part 6: Write the ticket body

Part 7: Set triggers, test and publish

Troubleshooting

​Before you start

​Part 1: Create an integration user in ServiceNow

​Part 2: Assign roles

​Part 3: Set the password

​Part 4: Create the flow in ThreatAware

​Part 5: Add the request headers

​Part 6: Write the ticket body

​Part 7: Set triggers, test and publish

​Troubleshooting

Before you start

Part 1: Create an integration user in ServiceNow

Part 2: Assign roles

Part 3: Set the password

Part 4: Create the flow in ThreatAware

Part 5: Add the request headers

Part 6: Write the ticket body

Part 7: Set triggers, test and publish

Troubleshooting