Skip to main content

​
Overview

The ServiceNow integration enables ThreatAware to collect IT service management data from your ServiceNow instance, providing visibility into assets, incidents, and configuration management data.
Connection Method: API Setup Time: 15 minutes Access Required: ServiceNow Administrator account

​
Data collected

The ServiceNow integration provides:
  • IT asset inventory
  • Incident and change data
  • Configuration management database (CMDB) records
  • Service request information

​
Use cases

Asset Synchronization

Sync IT assets between ServiceNow and ThreatAware

Incident Correlation

Link security incidents with IT service management tickets

Configuration Tracking

Track IT configuration changes and compliance

Change Management

Monitor IT change requests and their security impact

​
Setup instructions

1

Access ServiceNow User Administration

Create a dedicated API user in ServiceNow:
  • Log in to your ServiceNow instance with administrator privileges
  • Navigate to User Administration > Users section
2

Create New API User

Add a user account for ThreatAware:
  • Click Create New User
  • Fill in the user details:
    • User ID: threataware or similar identifier
    • First Name: ThreatAware
    • Last Name: Integration
  • Check the Web service access only checkbox
    • This restricts the account to API access
    • Improves security by preventing interactive login
  • Click Save to create the user account
3

Assign Required Role

Configure permissions for the API user:
  • Select the newly created user from the user list
  • Navigate to the Roles tab
  • Add the cmdb_read role
    • This grants read-only access to CMDB records
    • Sufficient for data collection by ThreatAware
  • Save the changes
The cmdb_read role provides read-only access to the Configuration Management Database, which is sufficient for ThreatAware integration.
4

Set User Password

Create credentials for the API user:
  • While on the user record, locate the password fields
  • Set a strong password for this user
  • Copy and save the password securely for ThreatAware configuration
5

Configure in ThreatAware

Add ServiceNow credentials to ThreatAware:
  • Log in to the ThreatAware dashboard
  • Navigate to Settings → Integrations
  • Search for ServiceNow and click Connect
  • Fill in the required fields:
    • Instance URL: Your ServiceNow platform URL (e.g., https://yourdomain.service-now.com)
    • Username: threataware (or the User ID created in Step 2)
    • Password: The password set in Step 4
  • Click Connect to establish the integration
6

Verify Connection

Confirm successful integration:
  • Check that the integration status in ThreatAware shows Active
  • Wait 5-10 minutes for initial data synchronization
  • Verify ServiceNow asset data appears in ThreatAware

​
Required credentials

Field Name: ServiceNow Instance URL Type: String Description: The base URL of your ServiceNow instanceFormat: https://yourdomain.service-now.comWhere “yourdomain” is your unique ServiceNow subdomain.Example: https://acme.service-now.com
Field Name: ServiceNow Username Type: String Description: The user ID of the API user created in ServiceNowExample: threatawareThis should be the User ID field from the user record, not the email address.
Field Name: ServiceNow Password Type: Password (encrypted) Description: The password for the ServiceNow API userSet during user creation in ServiceNow.
Store this password securely in your organisation’s password manager. It provides access to your ServiceNow data.

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings → Integrations in ThreatAware
    • Confirm ServiceNow shows Active status
    • Check the last sync timestamp
  2. Verify Data Collection
    • Wait 5-10 minutes for initial data synchronization
    • Search ThreatAware dashboard for ServiceNow asset data
    • Verify CMDB records match your ServiceNow inventory
  3. Test Queries
    • Create a test query to filter assets by ServiceNow data
    • Verify asset details and configuration data are available

​
Troubleshooting

Symptoms: Integration fails with authentication errorSolutions:
  • Verify the username is the User ID, not an email address
  • Ensure the password is correct and has not expired
  • Check that the user account is active (not disabled)
  • Confirm Web service access only is enabled for the user
  • Try resetting the user password and updating ThreatAware
Symptoms: Integration connects but no CMDB data appearsSolutions:
  • Verify the user has the cmdb_read role assigned
  • Check that the user does not have conflicting roles
  • Review the ServiceNow API documentation for required permissions
  • Add additional roles if needed for your data requirements
  • Test with an admin user to confirm data exists
Symptoms: Integration fails to connect to the serverSolutions:
  • Verify the instance URL in your browser address bar
  • Ensure it’s formatted correctly: https://yourdomain.service-now.com
  • Check for typos or extra spaces in the URL
  • Test the URL in a browser to confirm it’s accessible
  • Contact your ServiceNow administrator if URL is uncertain
Symptoms: Integration fails to connect or frequently times outSolutions:
  • Verify your network allows HTTPS (443) outbound access
  • Check that your ServiceNow instance is accessible from your network
  • Test the instance URL in a browser to confirm connectivity
  • Temporarily disable corporate proxy or VPN and test
  • Contact your network administrator if access is blocked
Symptoms: Integration shows active but no asset data appearsSolutions:
  • Wait up to 15 minutes for initial data synchronization
  • Verify you have assets in your ServiceNow CMDB
  • Check that the user account has CMDB read access
  • Review ThreatAware integration logs for sync errors
  • Contact ServiceNow support if CMDB data is missing

​
Additional resources

ServiceNow Developer Portal

Official ServiceNow API and developer documentation

ServiceNow Platform Documentation

ServiceNow platform documentation and guides

ServiceNow Support

ServiceNow support and technical assistance

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Dedicated Service Account
  • Create a dedicated user account specifically for ThreatAware
  • Use descriptive names like “threataware” or “svc_threataware”
  • Enable Web service access only for security
  • Document the account in your IT service management system
Credential Security
  • Store the ServiceNow password in your organisation’s password manager
  • Treat it with the same security as admin passwords
  • Periodically reset or rotate the password per your security policy
  • Monitor API usage in ServiceNow logs
  • Revoke access if the integration is no longer needed
Permissions Management
  • Use the minimal cmdb_read role for read-only access
  • Never grant admin or write permissions unless absolutely necessary
  • Review the ServiceNow API documentation for specific permission requirements
  • Adjust roles if ThreatAware needs additional data access