> ## Documentation Index > Fetch the complete documentation index at: https://docs.threataware.com/llms.txt > Use this file to discover all available pages before exploring further. # Create ServiceNow tickets > Raise ServiceNow incidents automatically, with context from ThreatAware device data, using an Action Center flow Available on Raise a ServiceNow incident whenever devices fall into a [Tracked View](https://docs.threataware.com/tracked-views.md), with the affected devices and the issue in the ticket. Use it for ongoing requirements such as "every Windows server has Microsoft Defender deployed and functioning". The flow sends an **HTTP request** to ServiceNow's Table API to create an incident. Parts 1 to 3 happen in ServiceNow; parts 4 to 7 in ThreatAware. ## Before you start | You need | Usually done by | | - | - | | Admin access to the ServiceNow instance, to create a user and assign roles | The customer's ServiceNow admin (parts 1 to 3) | | A [Tracked View](https://docs.threataware.com/tracked-views.md) of the devices to raise tickets for, and access to [Action Center](https://docs.threataware.com/automation.md) | A ThreatAware user or the Customer Success team (parts 4 to 7) | | Agreed values for the assignment group, business service and any other ticket fields | Both, before part 6 | > [!WARNING] > > If you have an existing integration user profile in ServiceNow, feel free to skip ahead to step 4. ## Part 1: Create an integration user in ServiceNow **1. Open Users** Sign in to ServiceNow and go to **User Administration > Users**, then click **New**. **2. Name the user** Enter a **User ID**, for example `threataware.incident.creation`. **3. Allow API access only** Tick **Web service access only**, so the account can use the API but can't sign in to the ServiceNow interface. Click **Save**. ## Part 2: Assign roles **1. Edit the user's roles** Open the saved user record, go to the **Roles** tab and click **Edit**. **2. Add a role that can create incidents** Add the `itil` role, or your organisation's least-privilege equivalent that can create incident records. If your instance enforces REST API access policies, also add `snc_platform_rest_api_access`. Click **Save**. > [!WARNING] > > **Don't skip this part.** A user with no roles can authenticate but can't create incidents, so every request from ThreatAware is rejected with `403 Forbidden`. ## Part 3: Set the password **1. Generate a password** On the user record, click **Set Password** and generate a strong password. **2. Untick Password needs reset** Make sure **Password needs reset** is unticked. If it's left ticked, ServiceNow refuses the API sign-in and ThreatAware gets `401 Unauthorized`. **3. Store it safely** Copy the password into your password vault. You need it in part 5. ## Part 4: Create the flow in ThreatAware **1. Track the devices** In **Devices**, build the view of devices that should raise tickets and [track it](https://docs.threataware.com/tracked-views.md#track-a-view), usually as **Continuous**. **2. Create a flow** In **Action Center**, click **New flow**, name it, and add an **HTTP request** step connected to **Start of action**. **3. Set the URL** Set the method to **POST** and the URL to: ```text theme={null} https://.service-now.com/api/now/table/incident ``` Replace `` with the name at the start of your ServiceNow address. Only the instance name comes from the address bar; add the `/api/now/table/incident` path exactly as shown. ## Part 5: Add the request headers Join the username and password with a colon and base64-encode the result. Do this on your own machine rather than with an online encoder, so the password never leaves it: ```bash macOS / Linux theme={null} echo -n 'username:password' | base64 ``` ```powershell Windows PowerShell theme={null} [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('username:password')) ``` Add these three headers to the HTTP request step: | Key | Value | | - | - | | `Accept` | `application/json` | | `Content-Type` | `application/json` | | `Authorization` | `Basic ` | > [!NOTE] > > Spell the key **Authorization**, with a "z". "Authorisation" isn't recognised. Leave exactly one space between `Basic` and the encoded string. ThreatAware saves header values as masked secrets; if you edit the URL later, you'll need to enter them again. ## Part 6: Write the ticket body In the HTTP request step, click **+ Add** and choose **Body**. Map ThreatAware data to your incident fields so each ticket carries the affected devices, the issue and the risk. Use **Insert merge field** in the body to add device details. For example: ```json theme={null} { "short_description": "CrowdStrike deployment project", "description": "The following {{count}} devices do not have CrowdStrike deployed", "caller_id": "threataware.incident.creation", "assignment_group": "Deployment Management", "business_service": "Applications/Software", "service_offering": "ThreatAware", "location": "London", "contact_type": "Monitoring" } ``` `{{count}}` is the number of devices in the run. See [Device details in a step](https://docs.threataware.com/automation.md#device-details-in-a-step) for the other merge fields. | Field type | What it needs | | - | - | | **Reference fields** (`caller_id`, `assignment_group`, `business_service`, `service_offering`, `location`) | The exact display name of an existing ServiceNow record, or its `sys_id`. If it doesn't match, the ticket is still created but the field is left blank. | | **Choice fields** (`contact_type`) | The value configured on your instance (the backend value, not the label). Check these with your ServiceNow admin. | ## Part 7: Set triggers, test and publish **1. Point it at your tracked view** Click **Triggers** and choose your tracked view under **Trigger from**. Set a **Maximum device count** as an emergency stop, and choose **Per device** (one ticket per device) or **All at once** (one ticket for the group) under **Run mode**. See [Triggers](https://docs.threataware.com/automation.md#triggers). **2. Test** Click **Debug** on **Start of action** to try the flow, then in ServiceNow open **Incident > All** and check a new incident has been created with every field filled in as expected. **3. Publish** Click **Publish**. From now on, devices entering the tracked view raise tickets. > [!TIP] > > Once the step works, right-click it and choose **Save as template**. Anyone building another ServiceNow flow can then add it from **Shared Templates** and only needs to change the body. See [Templates](https://docs.threataware.com/automation.md#templates). > [!NOTE] > > **Two-way sync.** When the ticket is closed in ServiceNow, the device is resolved in ThreatAware. ## Troubleshooting | Symptom | Likely cause and fix | | - | - | | `401 Unauthorized` | Wrong credentials or base64 string, the header key is misspelled, or **Password needs reset** is still ticked (part 3) | | `403 Forbidden` | The integration user is missing a role (part 2) | | `400 Bad Request` | A body key is misspelled, or the body isn't valid JSON | | `404 Not Found` | The instance name or the `/api/now/table/incident` path is wrong (part 4) | | Ticket created, but some fields blank | A reference or choice value doesn't match what exists on the instance (part 6) | | No tickets being raised | No devices are currently in the tracked view, the flow isn't published, or the **Minimum time in view** hasn't passed yet | > [!TIP] > > **Security:** use this ServiceNow account only for ThreatAware, keep its roles to the minimum needed, and rotate the password in line with your policy. When you do, update the **Authorization** header in the flow. > **Still on ThreatAware 3.2?** > > On ThreatAware 3.2, set this up as an Action on a saved view instead of a flow. Open the saved view, open its action, select the continuous trigger and choose **Create Ticket**. The URL, headers and body are the same as above. Click **Create and Run** to save the action and trigger it straight away. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.