Add ServiceNow Notification Target

Prerequisite

A ServiceNow instance and the system administrator user credential of the instance is required to create the ServiceNow notification target.

1. On FortiCNP menu, go to ADMIN > Notifications.
2. Click +Add New and select ServiceNow Incident, then click Add New Notification Target.
3. Give a name for the Notification Target.
4. Enter the ServiceNow Instance URL - for example, https://xxxxx.service-now.com.



5. Enter the ServiceNow Instance Credential username and password separated by a colon - for example, username:password.
6. In Impact and Urgency parameter, enter the impact parameter for the ServiceNow incident: "1 - High", "2 - Medium", "3 - Low"(default), the values are case sensitive.
7. In Assignment Group, enter the assignment group. In Assignee, enter the assignee. (The default value for both of them is empty)

Note: If both assignment group and assignee are entered, the assignee must be in the assignment group, otherwise the incident cannot be created.



8. In Category, enter one of the following values: "Inquiry/Help"(default), "Software" ,"Hardware" ,"Network", "Database", "--None--". (The values are note case sensitive)
9. In Subcategory, enter one of the following values of the category. The default is "--None--"
   1. Inquiry/Help - Antivirus, Email, Internal Application, --None--
   2. Software - Email, Operating System, --None--
   3. Hardware - CPU, Disk, Keyboard, Memory, Monitor, Mouse, --None--
   4. Network - DHCP, DNS, IP Address, VPN, Wireless, --None--
   5. Database - DB2, MS SQL Server, Oracle
10. In Alert Notification, turn On/Off the alert notification triggered by policy violations.



11. Click Send Notification for Alert Triggered By Objects In drop down menu and select resource group(s). Only the alerts triggered by the selected resource groups will send notification. You can monitor all cloud accounts be selecting All Resource. To create a resource group, please see Resource Group.



12. Select the method that the notification should be triggered by - Severity Level or Specific Policy.
    1. When Severity Level is selected, select the severity level the notification will be triggered by. Only the alerts triggered by the selected severity level will send notifications

    

    2. When Specific Policy is selected, click the select policy drop down menu and select at least one policy. Only the alerts triggered by the selected policy will sent notifications.

    

13. Check Do not Send Notification for the Same Alerts within 24 hours to prevent receiving the same notification within 24 hour period.



14. Click Add New Notification Target to finish.

When a FortiCNP finding is generated for the notification target, a ServiceNow incident will be created with the subject: FortiCNP Alert Notice - (Finding Subject)