About the connector

ServiceNow provides intelligent and automated workflows across the enterprise. It supports real-time communication, collaboration, and resource sharing across various functions.

For a complete list of operators available in ServiceNow for filters and queries, see https://docs.servicenow.com/en-US/bundle/sandiego-platform-user-interface/page/use/common-ui-elements/reference/r_OpAvailableFiltersQueries.html.

For information on encoded query strings supported by ServiceNow, see https://docs.servicenow.com/en-US/bundle/sandiego-platform-user-interface/page/use/using-lists/concept/c_EncodedQueryStrings.html.

If you want to leverage FortiSOAR's Custom API Endpoint to integrate with ServiceNow, or manually trigger FortiSOAR playbooks from your third-party products, you must create a business rule or edit a current business rule to use HMAC authentication instead of Basic authentication, the steps for which are mentioned in Creating or editing a business rule to use HMAC Authentication section.

This document provides information about the ServiceNow connector, which facilitates automated interactions, with a ServiceNow server using FortiSOAR™ playbooks. Add the ServiceNow connector as a step in FortiSOAR™ playbooks and perform automated operations, such as automatically adding a new incident record in ServiceNow tables and searching and retrieving information about ServiceNow records.

Important: This version of the connector supports OAUTH with ServiceNow as an OAUTH Provider.

You can use FortiSOAR™'s Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling incidents from ServiceNow. For more information, see the Data Ingestion Support section.

Version information

Connector Version: 3.3.0

FortiSOAR™ Version Tested on: 7.5.0-4015

ServiceNow Version Tested on: Tokyo (Cloud Setup)

Authored By: Fortinet

Certified: Yes

Release Notes for version 3.3.0

The following enhancements have been made to the ServiceNow connector in version 3.3.0:

• Added the following new operations and playbooks:
  • Submit Attachment
  • Delete Attachment
• Renamed the action Download File to Download Attachment.
• Added output schema for following actions:
  • Download Attachment
  • Get Attachments
• Fixed an issue where the connector failed to authenticate with OAuth when Password or Client Secret contained non-unicode characters.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-servicenow

Prerequisites to configuring the connector

• You must have the FQDN or IP address of the ServiceNow server to which you will connect and perform the automated operations and credentials (Username-Password pair) to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the ServiceNow server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the ServiceNow connector card. On the connector popup, click the Configurations tab to enter the required configuration details.

Parameter	Description
Server URL	FQDN or IP of the ServiceNow server to which you will connect and perform automated operations. For example, https://instance.service-now.com
Authentication Type	Specify the authentication type as either Basic or OAuth. If you select Basic as the authentication type, then you must specify the following parameters: Username: Username to access the ServiceNow server to which you will connect and perform automated operations. Password: Password to access the ServiceNow server to which you will connect and perform automated operations. If you select OAuth as the authentication type, then you must specify the following parameters: Username: Username to access the ServiceNow server to which you will connect and perform automated operations. Password: Password to access the ServiceNow server to which you will connect and perform automated operations. Client ID: Auto-generated unique ID of the client application that is requesting the access token. Note: For the process to get the Client ID and Client Secret, see the Getting the Client ID and Client Secret from ServiceNow section. Client Secret: Shared secret string that the instance and the OAuth application use to authorize communications between each other.
Verify SSL	Specifies whether the SSL certificate for the server is to be verified or not.

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations:

Function	Description	Annotation and Category
Create Table Record	Adds a new record in the ServiceNow table that you have specified.	create_record Investigation
Create Incident	Adds a new incident record in ServiceNow based on the input parameters you have specified.	create_incident Investigation
Get Users	Retrieves a list of users and their details from ServiceNow based on the response fields you have specified.	get_users Investigation
Get Assignment Groups	Retrieves a list and details of all existing assignment groups from ServiceNow.	get_assignment_group Investigation
Search Table Record	Searches for a record in ServiceNow based on the table name, column name and value, and other input parameters you have specified.	search_record Investigation
Advanced Search	Executes a generalized query on the ServiceNow table that you have specified to search for a record in ServiceNow.	search_query Investigation
Update ServiceNow Table Record	Updates a record in the ServiceNow table based on the Sys ID of the table record and other input parameters you have specified.	update_record Investigation
Update ServiceNow Incident	Updates an incident ServiceNow table based on the Sys ID of the incident and other input parameters you have specified.	update_record Investigation
Add Item to Cart	Adds an item to the cart and submits the order on ServiceNow.	add_item_to_cart Investigation
Get Items	Retrieves a list of all existing catalogs and a list and details of all items that are contained in each catalog from ServiceNow. You can optionally specify the Sys ID of the item to retrieve details only for a specific item.	get_items Investigation
Get Cart	Retrieves a default list of all existing cart contents, cart details, and prices from ServiceNow.	get_cart Investigation
Get Catalogs	Retrieves a list and details of catalogs to which the user has access from ServiceNow. You can optionally specify the Sys ID of the catalog to retrieve details only for a specific catalog.	get_catalogs Investigation
Get Catalog Categories	Retrieves a list and details of all existing categories or the list and details of categories for a specified catalog from ServiceNow based on the Sys ID of the catalog you have specified.	get_categories_for catalog Investigation
Update Cart Item	Updates an item in a cart in ServiceNow based on the Cart Item ID and other input parameters you have specified.	update_cart_item Investigation
Delete Cart Item	Deletes an item from a cart in ServiceNow based on the Cart Item ID you have specified.	delete_cart_item Investigation
Get Attachments	Retrieves attachments from a specific table in ServiceNow based on the system ID of the table you have specified.	get_attachments Investigation
Download Attachment	Downloads a specific file from ServiceNow and adds it in the FortiSOAR™ "Attachments" module based on the system ID of the file you have specified.	download_file Investigation
Create Change Request	Creates one Standard, Normal, or Emergency change request based on input parameters you have specified.	create_change_request Investigation
Get Change Request Details	Retrieves the details of the Standard, Normal, or Emergency change request based on the sys_id you have specified.	get_change_request Investigation
Get All Change Requests	Retrieves one or more Standard, Normal, or Emergency change request change requests based on input parameters you have specified.	get_change_request Investigation
Update Change Request	Updates a Standard, Normal, or Emergency change request based on the sys_id and other input parameters you have specified.	update_change_request Investigation
Delete Change Request	Deletes a Standard, Normal, or Emergency change request based on the sys_id you have specified.	delete_change_request Investigation
Create Change Request Task	Creates one change request task based on the default change request task record and associates it with the specified change request based on the sys_id and other input parameters you have specified.	create_change_request_task Investigation
Get Change Request Tasks	Retrieves one or more tasks associated with a specified change request based on the sys_id and other input parameters you have specified.	get_change_request_tasks Investigation
Update Change Request Task	Updates a change request task identified by the specified sys_id, task_sys_id, and other input parameters you have specified.	update_change_request_task Investigation
Delete Change Request Task	Deletes the change request task identified by the specified sys_id and task_sys_id you have specified.	delete_change_request_task Investigation
Create Security Incident	Adds a new security incident record in ServiceNow based on the description and other input parameters you have specified. Note: If the Security Incident Response (SIR) module does not appear in your ServiceNow instance, then you need to get the SIR module from the 'Plugins' section. For more information, see the Getting the Security Incident Response (SIR) module section.	create_SIR Investigation
Search Security Incident Record	Executes a generalized query on the ServiceNow Security Incident table that you have specified to search for a record in ServiceNow based on the table name and search query you have specified. Note: If the Security Incident Response (SIR) module does not appear in your ServiceNow instance, then you need to get the SIR module from the 'Plugins' section. For more information, see the Getting the Security Incident Response (SIR) module section.	get_SIR Investigation
Get Location	Retrieves a list and details of all existing locations from ServiceNow.	get_location Investigation
Update Security Incident	Updates security incident in ServiceNow based on the Sys ID of the incident and other input parameters you have specified. Note: If the Security Incident Response (SIR) module does not appear in your ServiceNow instance, then you need to get the SIR module from the 'Plugins' section. For more information, see the Getting the Security Incident Response (SIR) module section.	update_SIR Investigation
Delete Security Incident	Deletes a security Incident from ServiceNow based on the System ID you have specified. Note: If the Security Incident Response (SIR) module does not appear in your ServiceNow instance, then you need to get the SIR module from the 'Plugins' section. For more information, see the Getting the Security Incident Response (SIR) module section.	delete_SIR Investigation
Submit Attachment	Submits files to ServiceNow from FortiSOAR™ based on the Attachment or File IRI that you have specified.	submit_file Investigation
Delete Attachment	Deletes attachments from a specific table in ServiceNow based on the system ID of the file you have specified.	delete_file Investigation

operation: Create Table Record

Input parameters

Parameter	Description
Table Name	Name of the table (in the ServiceNow database) in which you want to create the record. For example, incident.
Record Information	Map the record field that is present in FortiSOAR™ to the ServiceNow record field stored in the dictionary. You can pass this information to the ServiceNow record field using dynamic variables. For example, Table Name: incident Record Information: {"short_description": "QRadar Offense", "urgency": "2", "impact": "2"}

Output

The JSON output contains the ID and the URL of the record added to the specified ServiceNow table.

The output contains the following populated JSON schema:
{
"result": {
"order": "",
"made_sla": "",
"close_notes": "",
"business_duration": "",
"opened_at": "",
"comments": "",
"closed_by": "",
"severity": "",
"description": "",
"watch_list": "",
"resolved_by": "",
"contact_type": "",
"additional_assignee_list": "",
"opened_by": {
"value": "",
"link": ""
},
"sys_mod_count": "",
"number": "",
"hold_reason": "",
"correlation_id": "",
"reopen_count": "",
"sys_created_on": "",
"caller_id": "",
"escalation": "",
"group_list": "",
"incident_state": "",
"sys_updated_by": "",
"active": "",
"subcategory": "",
"state": "",
"child_incidents": "",
"work_notes_list": "",
"follow_up": "",
"activity_due": "",
"problem_id": "",
"sys_tags": "",
"short_description": "",
"category": "",
"upon_reject": "",
"assignment_group": "",
"sys_created_by": "",
"business_stc": "",
"comments_and_work_notes": "",
"due_date": "",
"closed_at": "",
"assigned_to": "",
"expected_start": "",
"work_end": "",
"correlation_display": "",
"sys_domain": {
"value": "",
"link": ""
},
"resolved_at": "",
"approval": "",
"close_code": "",
"sys_updated_on": "",
"rfc": "",
"parent_incident": "",
"caused_by": "",
"upon_approval": "",
"location": "",
"sys_class_name": "",
"user_input": "",
"time_worked": "",
"calendar_stc": "",
"priority": "",
"approval_history": "",
"knowledge": "",
"sys_domain_path": "",
"notify": "",
"business_service": "",
"approval_set": "",
"work_start": "",
"sys_id": "",
"impact": "",
"parent": "",
"sla_due": "",
"company": "",
"urgency": "",
"cmdb_ci": "",
"reassignment_count": "",
"delivery_task": "",
"work_notes": "",
"calendar_duration": "",
"delivery_plan": ""
}
}

operation: Create Incident

Input parameters

Parameter	Description
Caller	Name of the caller (in the ServiceNow database) details of whom you can retrieve using the Get Users operation.
Short Description	Short description of the incident that you want to create in ServiceNow.
Description	(Optional) Description of the incident that you want to create in ServiceNow.
Location	(Optional) Location of the incident that you want to create in ServiceNow.
Category	(Optional) Category of the incident that you want to create in ServiceNow. You can specify one of the following categories: Inquiry/Help, Software, Hardware, Network, or Database.
Severity	(Optional) Severity of the incident that you want to create in ServiceNow. You can specify one of the following severities: 1-High, 2-Medium, or 3-Low.
Urgency	(Optional) Urgency of the incident that you want to create in ServiceNow. You can specify one of the following urgencies: 1-High, 2-Medium, or 3-Low.
State	(Optional) State of the incident that you want to create in ServiceNow. You can specify one of the following states: New, In Progress, On Hold, Resolved, Closed, or Canceled.
Impact	(Optional) Impact of the incident that you want to create in ServiceNow. You can specify one of the following impacts: 1-High, 2-Medium, or 3-Low.
Work Notes	(Optional) Work Notes of the incident that you want to create in ServiceNow.
Assigned To	(Optional) Name of the user (in the ServiceNow database) to whom you want to assign this incident. You can retrieve user details using the Get Users operation.
Assignment Group	(Optional) Name of the assignment group (in the ServiceNow database) to which you want to assign this incident. You can retrieve assignment group details using the Get Assignment Group operation.
Other Fields	(Optional) JSON field provided to enable you to enter other fields while creating an incident in ServiceNow

Output

The JSON output contains the ID and the other details of the created ServiceNow Incident.

The output contains the following populated JSON schema:
{
"result": {
"order": "",
"made_sla": "",
"close_notes": "",
"business_duration": "",
"opened_at": "",
"comments": "",
"closed_by": "",
"severity": "",
"description": "",
"watch_list": "",
"resolved_by": "",
"contact_type": "",
"additional_assignee_list": "",
"opened_by": {
"value": "",
"link": ""
},
"sys_mod_count": "",
"number": "",
"hold_reason": "",
"correlation_id": "",
"reopen_count": "",
"sys_created_on": "",
"caller_id": "",
"escalation": "",
"group_list": "",
"incident_state": "",
"sys_updated_by": "",
"active": "",
"subcategory": "",
"state": "",
"child_incidents": "",
"work_notes_list": "",
"follow_up": "",
"activity_due": "",
"problem_id": "",
"sys_tags": "",
"short_description": "",
"category": "",
"upon_reject": "",
"assignment_group": {
"value": "",
"link": ""
},
"sys_created_by": "",
"business_stc": "",
"comments_and_work_notes": "",
"due_date": "",
"closed_at": "",
"assigned_to": {
"value": "",
"link": ""
},
"expected_start": "",
"work_end": "",
"correlation_display": "",
"sys_domain": {
"value": "",
"link": ""
},
"resolved_at": "",
"approval": "",
"close_code": "",
"sys_updated_on": "",
"rfc": "",
"parent_incident": "",
"caused_by": "",
"upon_approval": "",
"location": {
"value": "",
"link": ""
},
"sys_class_name": "",
"user_input": "",
"time_worked": "",
"calendar_stc": "",
"priority": "",
"approval_history": "",
"knowledge": "",
"sys_domain_path": "",
"notify": "",
"business_service": "",
"approval_set": "",
"work_start": "",
"sys_id": "",
"impact": "",
"parent": "",
"sla_due": "",
"company": "",
"urgency": "",
"cmdb_ci": "",
"reassignment_count": "",
"delivery_task": "",
"work_notes": "",
"calendar_duration": "",
"delivery_plan": ""
}
}

operation: Get Users

Input parameters

Parameter	Description
Response Fields	Response keys based on which you want to retrieve users from ServiceNow. You can select multiple response fields.

Output

The JSON output contains detailed information about ServiceNow users retrieved based on the response fields you have specified.

The output contains the following populated JSON schema:
{
"result": [
{
"default_perspective": "",
"calendar_integration": "",
"last_login": "",
"cost_center": {
"value": "",
"link": ""
},
"introduction": "",
"sys_updated_by": "",
"roles": "",
"country": "",
"schedule": "",
"sys_mod_count": "",
"ldap_server": "",
"date_format": "",
"sys_created_by": "",
"sys_domain_path": "",
"city": "",
"photo": "",
"employee_number": "",
"state": "",
"web_service_access_only": "",
"phone": "",
"name": "",
"mobile_phone": "",
"sys_tags": "",
"home_phone": "",
"sys_created_on": "",
"gender": "",
"user_password": "",
"notification": "",
"email": "",
"sys_domain": {
"value": "",
"link": ""
},
"title": "",
"middle_name": "",
"last_name": "",
"sys_updated_on": "",
"vip": "",
"last_login_time": "",
"locked_out": "",
"location": {
"value": "",
"link": ""
},
"sys_class_name": "",
"manager": {
"value": "",
"link": ""
},
"time_format": "",
"active": "",
"password_needs_reset": "",
"preferred_language": "",
"failed_attempts": "",
"source": "",
"building": "",
"user_name": "",
"street": "",
"company": {
"value": "",
"link": ""
},
"zip": "",
"time_zone": "",
"internal_integration_user": "",
"sys_id": "",
"first_name": "",
"department": {
"value": "",
"link": ""
}
}
]
}

operation: Get Assignment Groups

Input parameters

None.

Output

A JSON output contains detailed information about all existing ServiceNow assignment groups.

The output contains the following populated JSON schema:
{
"result": [
{
"sys_created_on": "",
"type": "",
"active": "",
"sys_updated_by": "",
"parent": "",
"source": "",
"cost_center": "",
"email": "",
"manager": "",
"description": "",
"roles": "",
"include_members": "",
"name": "",
"default_assignee": "",
"sys_tags": "",
"sys_mod_count": "",
"sys_created_by": "",
"exclude_manager": "",
"sys_id": "",
"sys_updated_on": ""
}
]
}

operation: Search Table Record

Input parameters

Parameter	Description
Table Name	Name of the table (in the ServiceNow database) in which you want to search for a record.
Column Name	Key of the record that you want to search in the ServiceNow table. For example, incident.
Value	Value of the record that you want to search in the ServiceNow table. For example, Incident ID.
Active Record	Select this option if you want to search only active records in the ServiceNow table.

Output

The JSON output contains detailed information about the ServiceNow table record based on the table name, column name, and value that you have specified.

The output contains the following populated JSON schema:
{
"result": [
{
"order": "",
"made_sla": "",
"close_notes": "",
"business_duration": "",
"opened_at": "",
"comments": "",
"closed_by": "",
"severity": "",
"description": "",
"watch_list": "",
"resolved_by": "",
"contact_type": "",
"additional_assignee_list": "",
"opened_by": {
"value": "",
"link": ""
},
"sys_mod_count": "",
"number": "",
"hold_reason": "",
"correlation_id": "",
"reopen_count": "",
"sys_created_on": "",
"caller_id": {
"value": "",
"link": ""
},
"escalation": "",
"group_list": "",
"incident_state": "",
"sys_updated_by": "",
"active": "",
"subcategory": "",
"state": "",
"child_incidents": "",
"work_notes_list": "",
"follow_up": "",
"activity_due": "",
"problem_id": {
"value": "",
"link": ""
},
"sys_tags": "",
"short_description": "",
"category": "",
"upon_reject": "",
"assignment_group": {
"value": "",
"link": ""
},
"sys_created_by": "",
"business_stc": "",
"comments_and_work_notes": "",
"due_date": "",
"closed_at": "",
"assigned_to": {
"value": "",
"link": ""
},
"expected_start": "",
"work_end": "",
"correlation_display": "",
"sys_domain": {
"value": "",
"link": ""
},
"resolved_at": "",
"approval": "",
"close_code": "",
"sys_updated_on": "",
"rfc": "",
"parent_incident": "",
"caused_by": "",
"upon_approval": "",
"location": {
"value": "",
"link": ""
},
"sys_class_name": "",
"user_input": "",
"time_worked": "",
"calendar_stc": "",
"priority": "",
"approval_history": "",
"knowledge": "",
"sys_domain_path": "",
"notify": "",
"business_service": "",
"approval_set": "",
"work_start": "",
"sys_id": "",
"impact": "",
"parent": "",
"sla_due": "",
"company": {
"value": "",
"link": ""
},
"urgency": "",
"cmdb_ci": {
"value": "",
"link": ""
},
"reassignment_count": "",
"delivery_task": "",
"work_notes": "",
"calendar_duration": "",
"delivery_plan": ""
}
]
}

operation: Advanced Search

Input parameters

Parameter	Description
Table Name	Name of the table (in the ServiceNow database) in which you want to search for a record. For example, incident.
Advanced Search Query	System ID, description, and state of a ServiceNow record. Using these parameters, create a generalized query to search for multiple fields in ServiceNow. For example, Table Name: incident Record Information: {"category=inquiry&number=INC0000059"}
Limit	(Optional) Maximum number of results, per page, that this operation should return. By default, this is set as 10000.

Output

The JSON output contains detailed information about the ServiceNow record retrieved based on the generalized query.

The output contains the following populated JSON schema:
{
"result": [
{
"order": "",
"number": "",
"close_notes": "",
"business_duration": "",
"opened_at": "",
"additional_assignee_list": "",
"comments": "",
"closed_by": "",
"notify": "",
"description": "",
"watch_list": "",
"resolved_by": "",
"sys_mod_count": "",
"subcategory": "",
"sys_domain_path": "",
"resolved_at": "",
"parent": "",
"correlation_id": "",
"reopen_count": "",
"sys_created_on": "",
"caller_id": {
"value": "",
"link": ""
},
"opened_by": {
"value": "",
"link": ""
},
"hold_reason": "",
"group_list": "",
"incident_state": "",
"made_sla": "",
"active": "",
"contact_type": "",
"state": "",
"child_incidents": "",
"work_notes_list": "",
"follow_up": "",
"activity_due": "",
"problem_id": {
"value": "",
"link": ""
},
"sys_tags": "",
"short_description": "",
"category": "",
"upon_reject": "",
"assignment_group": {
"value": "",
"link": ""
},
"sys_created_by": "",
"business_stc": "",
"comments_and_work_notes": "",
"expected_start": "",
"due_date": "",
"closed_at": "",
"calendar_stc": "",
"time_worked": "",
"work_end": "",
"correlation_display": "",
"sys_domain": {
"value": "",
"link": ""
},
"rfc": "",
"approval": "",
"close_code": "",
"sys_updated_on": "",
"parent_incident": "",
"caused_by": "",
"work_start": "",
"upon_approval": "",
"location": {
"value": "",
"link": ""
},
"sys_class_name": "",
"priority": "",
"severity": "",
"assigned_to": {
"value": "",
"link": ""
},
"escalation": "",
"user_input": "",
"approval_history": "",
"knowledge": "",
"business_service": "",
"approval_set": "",
"urgency": "",
"sys_id": "",
"impact": "",
"sys_updated_by": "",
"sla_due": "",
"company": {
"value": "",
"link": ""
},
"cmdb_ci": {
"value": "",
"link": ""
},
"reassignment_count": "",
"delivery_task": "",
"work_notes": "",
"calendar_duration": "",
"delivery_plan": ""
}
]
}

operation: Update ServiceNow Table Record

Input parameters

Parameter	Description
Table Name	Name of the table (in the ServiceNow database) that you want to update.
Sys ID	System ID of the ServiceNow table record that you want to update.
Description	(Optional) Description that you want to update for the ServiceNow table record.
Other Fields	(Optional) JSON field provided to enable you to enter other fields while updating a table record in ServiceNow

Output

The JSON output contains the detailed information of the table record updated in ServiceNow based on the input parameters you have specified.

The output contains the following populated JSON schema:
{
"result": []
}

operation: Update ServiceNow Incident

Input parameters

Parameter	Description
Sys ID	System ID of the ServiceNow incident that you want to update. The system ID for an incident is generated when you create an incident in ServiceNow.
State	(Optional) State of the incident that you want to update in ServiceNow. You can specify one of the following states: New, In Progress, On Hold, Resolved, Closed, or Canceled.
Severity	(Optional) Severity of the incident that you want to update in ServiceNow. You can specify one of the following severities: 1-High, 2-Medium, or 3-Low.
Description	(Optional) Description that you want to update for the ServiceNow incident.
Work Notes	(Optional) Work notes that you want to update for the ServiceNow incident.
Other Fields	(Optional) JSON field provided to enable you to enter other fields while updating an incident in ServiceNow

Output

The JSON output contains the detailed information of the incident record updated in ServiceNow based on the input parameters you have specified.

The output contains the following populated JSON schema:
{
"result": {
"order": "",
"number": "",
"close_notes": "",
"business_duration": "",
"opened_at": "",
"additional_assignee_list": "",
"comments": "",
"closed_by": "",
"notify": "",
"description": "",
"watch_list": "",
"resolved_by": "",
"sys_mod_count": "",
"subcategory": "",
"sys_domain_path": "",
"resolved_at": "",
"parent": "",
"correlation_id": "",
"reopen_count": "",
"sys_created_on": "",
"caller_id": "",
"opened_by": {
"value": "",
"link": ""
},
"hold_reason": "",
"group_list": "",
"incident_state": "",
"made_sla": "",
"active": "",
"contact_type": "",
"state": "",
"child_incidents": "",
"work_notes_list": "",
"follow_up": "",
"activity_due": "",
"problem_id": "",
"sys_tags": "",
"short_description": "",
"category": "",
"upon_reject": "",
"assignment_group": "",
"sys_created_by": "",
"business_stc": "",
"comments_and_work_notes": "",
"expected_start": "",
"due_date": "",
"closed_at": "",
"calendar_stc": "",
"time_worked": "",
"work_end": "",
"correlation_display": "",
"sys_domain": {
"value": "",
"link": ""
},
"rfc": "",
"approval": "",
"close_code": "",
"sys_updated_on": "",
"parent_incident": "",
"caused_by": "",
"work_start": "",
"upon_approval": "",
"location": {
"value": "",
"link": ""
},
"sys_class_name": "",
"priority": "",
"severity": "",
"assigned_to": "",
"escalation": "",
"user_input": "",
"approval_history": "",
"knowledge": "",
"business_service": "",
"approval_set": "",
"urgency": "",
"sys_id": "",
"impact": "",
"sys_updated_by": "",
"sla_due": "",
"company": "",
"cmdb_ci": "",
"reassignment_count": "",
"delivery_task": "",
"work_notes": "",
"calendar_duration": "",
"delivery_plan": ""
}
}

operation: Add Item to Cart

Input parameters

>Parameter	>Description
>Catalog Item ID	>System ID of the item that you want to add to your cart.
>Extra Variables	>(Optional) JSON field provided to enable you to enter other fields while adding an item to a cart.
>Submit Order	>Select the checkbox to submit the order on ServiceNow. By default, this is set to False.

Output

The JSON output contains the information of the cart and the item added into that cart in ServiceNow.

The output contains the following populated JSON schema:
{
"result": {
"cart_id": "",
"subtotal": "",
"items": [
{
"localized_recurring_price": "",
"recurring_price": "",
"quantity": "",
"item_name": "",
"price": "",
"cart_item_id": "",
"localized_price": "",
"catalog_item_id": "",
"recurring_frequency": ""
}
]
}
}

operation: Get Items

Input parameters

Parameter	Description
Item Sys ID	(Optional) System ID of the item whose details you want to retrieve from ServiceNow.

Output

A JSON output contains a list of all existing catalogs and a list and details of all items that are contained in each catalog retrieved from ServiceNow. If you have specified the system ID of the item, then this operation retrieves the details only for a specific item from ServiceNow.

The output contains a non-dictionary value.

operation: Get Cart

Input parameters

None.

Output

A JSON output contains the default list of all existing cart contents, cart details, and prices retrieved from ServiceNow.

The output contains the following populated JSON schema:
{
"result": {
"total_title": "",
"subtotal_recurring_price": "",
"show_subtotal_price": "",
"none": {
"total_title": "",
"subtotal_recurring_price": "",
"show_subtotal_price": "",
"subtotal_title": "",
"items": [
{
"cart_item_id": "",
"recurring_price": "",
"quantity": "",
"item_name": "",
"price": "",
"localized_recurring_price": "",
"variables": {},
"localized_price": "",
"catalog_item_id": "",
"recurring_frequency": "",
"delivery_time": ""
}
],
"subtotal_recurring_frequency": "",
"subtotal_price": ""
},
"yearly": {
"total_title": "",
"subtotal_recurring_price": "",
"show_subtotal_price": "",
"subtotal_title": "",
"items": [
{
"cart_item_id": "",
"recurring_price": "",
"quantity": "",
"item_name": "",
"price": "",
"localized_recurring_price": "",
"variables": {
"Additional software requirements": "",
"Adobe Acrobat": "",
"Adobe Photoshop": "",
"Optional Software": ""
},
"localized_price": "",
"catalog_item_id": "",
"recurring_frequency": "",
"delivery_time": ""
}
],
"subtotal_recurring_frequency": "",
"subtotal_price": ""
},
"monthly": {
"total_title": "",
"subtotal_recurring_price": "",
"show_subtotal_price": "",
"subtotal_title": "",
"items": [
{
"cart_item_id": "",
"recurring_price": "",
"quantity": "",
"item_name": "",
"price": "",
"localized_recurring_price": "",
"variables": {
"Monthly data allowance": "",
"Contract duration": "",
"Storage": "",
"Allocated carrier": "",
"Color": ""
},
"localized_price": "",
"catalog_item_id": "",
"recurring_frequency": "",
"delivery_time": ""
}
],
"subtotal_recurring_frequency": "",
"subtotal_price": ""
},
"cart_id": "",
"subtotal_title": "",
"subtotal_recurring_frequency": "",
"subtotal_price": ""
}
}

operation: Get Catalogs

Input parameters

Parameter	Description
Sys ID	(Optional) System ID of the catalog whose details you want to retrieve from ServiceNow.

Output

The JSON output contains a list and details of all existing catalogs to which the user has access retrieved from ServiceNow. If you have specified the system ID of the catalog, then this operation retrieves the details only for the specified catalog from ServiceNow.

The output contains a non-dictionary value.

operation: Get Catalog Categories

Input parameters

Parameter	Description
Sys ID	(Optional) System ID of the catalog whose categories you want to retrieve from ServiceNow.

Output

The JSON output contains a list of all a list and details of all existing catalog categories retrieved from ServiceNow. If you have specified the system ID of the catalog, then this operation retrieves the category details only for the specified catalog from ServiceNow.

The output contains the following populated JSON schema:
{
"result": [
{
"description": "",
"full_description": "",
"count": "",
"icon": "",
"title": "",
"header_icon": "",
"homepage_image": "",
"sys_id": "",
"subcategories": []
}
]
}

operation: Update Cart Item

Input parameters

>Parameter	>Description
>Cart Item ID	>System ID of the item that you want to update in your cart.
>Other Fields	>(Optional) JSON field provided to enable you to enter other fields while updating an item to a cart.

Output

The JSON output contains the information updated cart item retrieved from ServiceNow.

The output contains the following populated JSON schema:
{
"result": {
"total_title": "",
"subtotal_recurring_price": "",
"show_subtotal_price": "",
"yearly": {
"total_title": "",
"subtotal_recurring_price": "",
"subtotal_title": "",
"show_subtotal_price": "",
"items": [
{
"cart_item_id": "",
"recurring_price": "",
"quantity": "",
"item_name": "",
"price": "",
"localized_recurring_price": "",
"variables": {
"Additional software requirements": "",
"Adobe Acrobat": "",
"Adobe Photoshop": "",
"Optional Software": ""
},
"localized_price": "",
"catalog_item_id": "",
"recurring_frequency": "",
"delivery_time": ""
}
],
"subtotal_recurring_frequency": "",
"subtotal_price": ""
},
"cart_id": "",
"subtotal_title": "",
"subtotal_recurring_frequency": "",
"subtotal_price": ""
}
}

operation: Delete Cart Item

Input parameters

Parameter	Description
Cart Item ID	(Optional) System ID of the item that you want to delete from your cart.

Output

The output contains a non-dictionary value.

operation: Get Attachments

Input parameters

Parameter	Description
Table Sys ID	System ID of the table whose associated attachments you want to retrieve from ServiceNow.

Output

The output contains the following populated JSON schema:

{
    "result": [
        {
            "hash": "",
            "state": "",
            "sys_id": "",
            "sys_tags": "",
            "file_name": "",
            "compressed": "",
            "size_bytes": "",
            "table_name": "",
            "image_width": "",
            "content_type": "",
            "image_height": "",
            "table_sys_id": "",
            "sys_mod_count": "",
            "sys_created_by": "",
            "sys_created_on": "",
            "sys_updated_by": "",
            "sys_updated_on": "",
            "size_compressed": "",
            "chunk_size_bytes": "",
            "encryption_context": "",
            "average_image_color": ""
        }
    ]
}

operation: Download Attachment

Input parameters

Parameter	Description
File Sys ID	System ID of the file that you want to download from ServiceNow and add to the FortiSOAR™ "Attachments" module.

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "@id": "",
    "file": {
        "id": "",
        "@id": "",
        "size": "",
        "uuid": "",
        "@type": "",
        "assignee": "",
        "filename": "",
        "metadata": [],
        "mimeType": "",
        "thumbnail": "",
        "uploadDate": ""
    },
    "name": "",
    "type": "",
    "uuid": "",
    "@type": "",
    "tasks": [],
    "alerts": [],
    "assets": [],
    "owners": [],
    "people": [],
    "@context": "",
    "assignee": "",
    "comments": [],
    "conflict": "",
    "warrooms": [],
    "incidents": [],
    "createDate": "",
    "createUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "indicators": [],
    "modifyDate": "",
    "modifyUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "recordTags": [],
    "userOwners": [],
    "description": "",
    "tenantRecordId": ""
}

operation: Create Change Request

Input parameters

Parameter

Description

Change Request Type

Select the type of change request you want to create from the Change Request Type drop-down list. You can choose from the following options: Standard Change, Normal Change, or Emergency Change. If you choose the change request type as 'Standard Change', then you can specify the following parameters: Standard Change Template ID: Sys_id of the standard change template on which you want to base the new standard change request. The Sys_id of the standard change template is located in the Standard Change Template [std_change_record_producer] table. Other Parameters: (Optional) Fields within the specified standard change template that you want to modify while creating the request. The key is the field name within the template and the value is the information to populate in the field. If you pass fields that cannot be modified, i.e, Read-only fields or fields that and fields that do not exist in the specified standard change template, then such fields will be ignored, some examples include Description, Backout plan, Test plan, and Implementation plan fields. If you choose the change request type as 'Normal Change' or 'Emergency Change', then you can specify the following parameters: Requested By: Name of the user for whom you are requesting this change. Category: Select the category (type) for the change request you want to create. You can choose from options such as Hardware, Software, Service, Documentation, etc. Service: Name of the service for the change request you want to create. For example, IT Services, Retail. Priority: Select the priority for the change request you want to create. You can choose from the following options: 1-Critical, 2-High, 3-Moderate, or 4-Low. Risk: Select the risk level for the change request you want to create. You can choose from the following options: High, Moderate, Low, Very High, or None. Impact: Select the impact for the change request you want to create. You can choose from the following options: 1-High, 2-Moderate, or 3-Low. Short Description: Short summary of the change request you want to create. Description: Description of the change request you want to create. Other Parameters: Fields within the specified standard change template that you want to modify while creating the request. The key is the field name within the template and the value is the information to populate in the field. If you pass fields that cannot be modified, i.e, Read-only fields or fields that and fields that do not exist in the specified standard change template, then such fields will be ignored, an example of such field is the Business Rules field.

Output

The output contains the following populated JSON schema:
{
"result": {
"reason": {
"display_value": "",
"value": ""
},
"parent": {
"display_value": "",
"value": ""
},
"watch_list": {
"display_value": "",
"value": ""
},
"upon_reject": {
"display_value": "",
"value": ""
},
"sys_updated_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"type": {
"display_value": "",
"value": ""
},
"approval_history": {
"display_value": "",
"value": ""
},
"test_plan": {
"display_value": "",
"value": ""
},
"number": {
"display_value": "",
"value": ""
},
"cab_delegate": {
"display_value": "",
"value": ""
},
"_by_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"state": {
"display_value": "",
"value": ""
},
"sys_created_by": {
"display_value": "",
"value": ""
},
"knowledge": {
"display_value": "",
"value": ""
},
"order": {
"display_value": "",
"value": ""
},
"phase": {
"display_value": "",
"value": ""
},
"cmdb_ci": {
"display_value": "",
"value": ""
},
"delivery_plan": {
"display_value": "",
"value": ""
},
"impact": {
"display_value": "",
"value": ""
},
"contract": {
"display_value": "",
"value": ""
},
"active": {
"display_value": "",
"value": ""
},
"work_notes_list": {
"display_value": "",
"value": ""
},
"priority": {
"display_value": "",
"value": ""
},
"sys_domain_path": {
"display_value": "",
"value": ""
},
"cab_recommendation": {
"display_value": "",
"value": ""
},
"production_system": {
"display_value": "",
"value": ""
},
"rejection_goto": {
"display_value": "",
"value": ""
},
"review_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"_by": {
"display_value": "",
"value": ""
},
"business_duration": {
"display_value": "",
"value": ""
},
"group_list": {
"display_value": "",
"value": ""
},
"change_plan": {
"display_value": "",
"value": ""
},
"approval_set": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"wf_activity": {
"display_value": "",
"value": ""
},
"implementation_plan": {
"display_value": "",
"value": ""
},
"universal_request": {
"display_value": "",
"value": ""
},
"end_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"short_description": {
"display_value": "",
"value": ""
},
"correlation_display": {
"display_value": "",
"value": ""
},
"delivery_task": {
"display_value": "",
"value": ""
},
"work_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"outside_maintenance_schedule": {
"display_value": "",
"value": ""
},
"additional_assignee_list": {
"display_value": "",
"value": ""
},
"std_change_producer_version": {
"display_value": "",
"value": ""
},
"sys_class_name": {
"display_value": "t",
"value": ""
},
"service_offering": {
"display_value": "",
"value": ""
},
"closed_by": {
"display_value": "",
"value": ""
},
"follow_up": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"review_status": {
"display_value": "",
"value": ""
},
"reassignment_count": {
"display_value": "",
"value": ""
},
"start_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assigned_to": {
"display_value": "",
"value": ""
},
"variables": {
"display_value": "",
"value": ""
},
"sla_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"comments_and_work_notes": {
"display_value": "",
"value": ""
},
"escalation": {
"display_value": "",
"value": ""
},
"upon_approval": {
"display_value": "",
"value": ""
},
"correlation_id": {
"display_value": "",
"value": ""
},
"made_sla": {
"display_value": "",
"value": ""
},
"backout_plan": {
"display_value": "",
"value": ""
},
"conflict_status": {
"display_value": "",
"value": ""
},
"task_effective_number": {
"display_value": "",
"value": ""
},
"sys_updated_by": {
"display_value": "",
"value": ""
},
"ed_by": {
"display_value": "",
"value": ""
},
"user_input": {
"display_value": "",
"value": ""
},
"sys_created_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"on_hold_task": {
"display_value": "",
"value": ""
},
"sys_domain": {
"display_value": "",
"value": ""
},
"route_reason": {
"display_value": "",
"value": ""
},
"closed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"review_comments": {
"display_value": "",
"value": ""
},
"business_service": {
"display_value": "",
"value": ""
},
"time_worked": {
"display_value": "",
"value": ""
},
"chg_model": {
"display_value": "",
"value": ""
},
"expected_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"ed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"work_end": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"phase_state": {
"display_value": "",
"value": ""
},
"cab_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"work_notes": {
"display_value": "",
"value": ""
},
"close_code": {
"display_value": "",
"value": ""
},
"assignment_group": {
"display_value": "",
"value": ""
},
"description": {
"display_value": "",
"value": ""
},
"on_hold_reason": {
"display_value": "",
"value": ""
},
"calendar_duration": {
"display_value": "",
"value": ""
},
"close_notes": {
"display_value": "",
"value": ""
},
"sys_id": {
"display_value": "",
"value": ""
},
"contact_type": {
"display_value": "",
"value": ""
},
"cab_required": {
"display_value": "",
"value": ""
},
"urgency": {
"display_value": "",
"value": ""
},
"scope": {
"display_value": "",
"value": ""
},
"company": {
"display_value": "",
"value": ""
},
"justification": {
"display_value": "",
"value": ""
},
"activity_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"comments": {
"display_value": "",
"value": ""
},
"approval": {
"display_value": "",
"value": ""
},
"due_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_mod_count": {
"display_value": "",
"value": ""
},
"on_hold": {
"display_value": "",
"value": ""
},
"sys_tags": {
"display_value": "",
"value": ""
},
"conflict_last_run": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"unauthorized": {
"display_value": "",
"value": ""
},
"risk": {
"display_value": "",
"value": ""
},
"location": {
"display_value": "",
"value": ""
},
"category": {
"display_value": "",
"value": ""
},
"risk_impact_analysis": {
"display_value": "",
"value": ""
},
"__meta": {
"ignoredFields": []
}
}
}

operation: Get Change Request Details

Input parameters

Parameter	Description
Change Request Type	Select the type of change request whose details you want to retrieve from ServiceNow. You can choose from the following options: Standard Change, Normal Change, or Emergency Change.
Sys ID	Sys_id of the Standard Change, Normal Change, or Emergency Change request whose details you want to retrieve from the Change Request [change_request] table.

Output

The output contains the following populated JSON schema:
{
"result": {
"reason": {
"display_value": "",
"value": ""
},
"parent": {
"display_value": "",
"value": ""
},
"watch_list": {
"display_value": "",
"value": ""
},
"upon_reject": {
"display_value": "",
"value": ""
},
"sys_updated_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"type": {
"display_value": "",
"value": ""
},
"approval_history": {
"display_value": "",
"value": ""
},
"test_plan": {
"display_value": "",
"value": ""
},
"number": {
"display_value": "",
"value": ""
},
"cab_delegate": {
"display_value": "",
"value": ""
},
"_by_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"state": {
"display_value": "",
"value": ""
},
"sys_created_by": {
"display_value": "",
"value": ""
},
"knowledge": {
"display_value": "",
"value": ""
},
"order": {
"display_value": "",
"value": ""
},
"phase": {
"display_value": "",
"value": ""
},
"cmdb_ci": {
"display_value": "",
"value": ""
},
"delivery_plan": {
"display_value": "",
"value": ""
},
"impact": {
"display_value": "",
"value": ""
},
"contract": {
"display_value": "",
"value": ""
},
"active": {
"display_value": "",
"value": ""
},
"work_notes_list": {
"display_value": "",
"value": ""
},
"priority": {
"display_value": "",
"value": ""
},
"sys_domain_path": {
"display_value": "",
"value": ""
},
"cab_recommendation": {
"display_value": "",
"value": ""
},
"production_system": {
"display_value": "",
"value": ""
},
"rejection_goto": {
"display_value": "",
"value": ""
},
"review_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"_by": {
"display_value": "",
"value": ""
},
"business_duration": {
"display_value": "",
"value": ""
},
"group_list": {
"display_value": "",
"value": ""
},
"change_plan": {
"display_value": "",
"value": ""
},
"approval_set": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"wf_activity": {
"display_value": "",
"value": ""
},
"implementation_plan": {
"display_value": "",
"value": ""
},
"universal_request": {
"display_value": "",
"value": ""
},
"end_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"short_description": {
"display_value": "",
"value": ""
},
"correlation_display": {
"display_value": "",
"value": ""
},
"delivery_task": {
"display_value": "",
"value": ""
},
"work_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"outside_maintenance_schedule": {
"display_value": "",
"value": ""
},
"additional_assignee_list": {
"display_value": "",
"value": ""
},
"std_change_producer_version": {
"display_value": "",
"value": ""
},
"sys_class_name": {
"display_value": "",
"value": ""
},
"service_offering": {
"display_value": "",
"value": ""
},
"closed_by": {
"display_value": "",
"value": ""
},
"follow_up": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"review_status": {
"display_value": "",
"value": ""
},
"reassignment_count": {
"display_value": "",
"value": ""
},
"start_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assigned_to": {
"display_value": "",
"value": ""
},
"variables": {
"display_value": "",
"value": ""
},
"sla_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"comments_and_work_notes": {
"display_value": "",
"value": ""
},
"escalation": {
"display_value": "",
"value": ""
},
"upon_approval": {
"display_value": "",
"value": ""
},
"correlation_id": {
"display_value": "",
"value": ""
},
"made_sla": {
"display_value": "",
"value": ""
},
"backout_plan": {
"display_value": "",
"value": ""
},
"conflict_status": {
"display_value": "",
"value": ""
},
"task_effective_number": {
"display_value": "",
"value": ""
},
"sys_updated_by": {
"display_value": "",
"value": ""
},
"opened_by": {
"display_value": "",
"value": ""
},
"user_input": {
"display_value": "",
"value": ""
},
"sys_created_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"on_hold_task": {
"display_value": "",
"value": ""
},
"sys_domain": {
"display_value": "",
"value": ""
},
"route_reason": {
"display_value": "",
"value": ""
},
"closed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"review_comments": {
"display_value": "",
"value": ""
},
"business_service": {
"display_value": "",
"value": ""
},
"time_worked": {
"display_value": "",
"value": ""
},
"chg_model": {
"display_value": "",
"value": ""
},
"expected_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"opened_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"work_end": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"phase_state": {
"display_value": "",
"value": ""
},
"cab_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"work_notes": {
"display_value": "",
"value": ""
},
"close_code": {
"display_value": "",
"value": ""
},
"assignment_group": {
"display_value": "",
"value": ""
},
"description": {
"display_value": "",
"value": ""
},
"on_hold_reason": {
"display_value": "",
"value": ""
},
"calendar_duration": {
"display_value": "",
"value": ""
},
"close_notes": {
"display_value": "",
"value": ""
},
"sys_id": {
"display_value": "",
"value": ""
},
"contact_type": {
"display_value": "",
"value": ""
},
"cab_required": {
"display_value": "",
"value": ""
},
"urgency": {
"display_value": "",
"value": ""
},
"scope": {
"display_value": "",
"value": ""
},
"company": {
"display_value": "",
"value": ""
},
"justification": {
"display_value": "",
"value": ""
},
"activity_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"comments": {
"display_value": "",
"value": ""
},
"approval": {
"display_value": "",
"value": ""
},
"due_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_mod_count": {
"display_value": "",
"value": ""
},
"on_hold": {
"display_value": "",
"value": ""
},
"sys_tags": {
"display_value": "",
"value": ""
},
"conflict_last_run": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"unauthorized": {
"display_value": "",
"value": ""
},
"risk": {
"display_value": "",
"value": ""
},
"location": {
"display_value": "",
"value": ""
},
"category": {
"display_value": "",
"value": ""
},
"risk_impact_analysis": {
"display_value": "",
"value": ""
}
}
}

operation: Get All Change Requests

Input parameters

Parameter	Description
Change Request Type	Select the type of change request that you want to retrieve from ServiceNow. You can choose from the following options: Standard Change, Normal Change, or Emergency Change.
Order By	(Optional) Field using which you want to sort the change requests retrieved by this operation. By default, this is set as number.
Offset	(Optional) Index of the first item to be returned by this operation. Use this value to paginate record retrieval. By default, this is set as 0.
Limit	(Optional) Maximum number of records that this operation should return. By default, this is set as 500.
Other Filter Parameters	(Optional) Name-value pairs used to filter the result set returned by this operation. The name is the field on which the specified value will be filtered. For example, {'active': true, 'assigned_to': 'john.smith'}
Text Search	(Optional) String used to search all change request record fields. This search uses ServiceNow's full-text search platform functionality and defaults to IR_AND_OR_QUERY.

Output

The output contains the following populated JSON schema:
{
"result": [
{
"reason": {
"display_value": "",
"value": ""
},
"parent": {
"display_value": "",
"value": ""
},
"watch_list": {
"display_value": "",
"value": ""
},
"upon_reject": {
"display_value": "",
"value": ""
},
"sys_updated_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"type": {
"display_value": "",
"value": ""
},
"approval_history": {
"display_value": "",
"value": ""
},
"test_plan": {
"display_value": "",
"value": ""
},
"number": {
"display_value": "",
"value": ""
},
"cab_delegate": {
"display_value": "",
"value": ""
},
"_by_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"state": {
"display_value": "",
"value": ""
},
"sys_created_by": {
"display_value": "",
"value": ""
},
"knowledge": {
"display_value": "",
"value": ""
},
"order": {
"display_value": "",
"value": ""
},
"phase": {
"display_value": "",
"value": ""
},
"cmdb_ci": {
"display_value": "",
"value": ""
},
"delivery_plan": {
"display_value": "",
"value": ""
},
"impact": {
"display_value": "",
"value": ""
},
"contract": {
"display_value": "",
"value": ""
},
"active": {
"display_value": "",
"value": ""
},
"work_notes_list": {
"display_value": "",
"value": ""
},
"priority": {
"display_value": "",
"value": ""
},
"sys_domain_path": {
"display_value": "",
"value": ""
},
"cab_recommendation": {
"display_value": "",
"value": ""
},
"production_system": {
"display_value": "",
"value": ""
},
"rejection_goto": {
"display_value": "",
"value": ""
},
"review_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"_by": {
"display_value": "",
"value": ""
},
"business_duration": {
"display_value": "",
"value": ""
},
"group_list": {
"display_value": "",
"value": ""
},
"change_plan": {
"display_value": "",
"value": ""
},
"approval_set": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"wf_activity": {
"display_value": "",
"value": ""
},
"implementation_plan": {
"display_value": "",
"value": ""
},
"universal_request": {
"display_value": "",
"value": ""
},
"end_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"short_description": {
"display_value": "",
"value": ""
},
"correlation_display": {
"display_value": "",
"value": ""
},
"delivery_task": {
"display_value": "",
"value": ""
},
"work_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"outside_maintenance_schedule": {
"display_value": "",
"value": ""
},
"additional_assignee_list": {
"display_value": "",
"value": ""
},
"std_change_producer_version": {
"display_value": "",
"value": ""
},
"sys_class_name": {
"display_value": "",
"value": ""
},
"service_offering": {
"display_value": "",
"value": ""
},
"closed_by": {
"display_value": "",
"value": ""
},
"follow_up": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"review_status": {
"display_value": "",
"value": ""
},
"reassignment_count": {
"display_value": "",
"value": ""
},
"start_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assigned_to": {
"display_value": "",
"value": ""
},
"variables": {
"display_value": "",
"value": ""
},
"sla_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"comments_and_work_notes": {
"display_value": "",
"value": ""
},
"escalation": {
"display_value": "",
"value": ""
},
"upon_approval": {
"display_value": "",
"value": ""
},
"correlation_id": {
"display_value": "",
"value": ""
},
"made_sla": {
"display_value": "",
"value": ""
},
"backout_plan": {
"display_value": "",
"value": ""
},
"conflict_status": {
"display_value": "",
"value": ""
},
"task_effective_number": {
"display_value": "",
"value": ""
},
"sys_updated_by": {
"display_value": "",
"value": ""
},
"ed_by": {
"display_value": "",
"value": ""
},
"user_input": {
"display_value": "",
"value": ""
},
"sys_created_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"on_hold_task": {
"display_value": "",
"value": ""
},
"sys_domain": {
"display_value": "",
"value": ""
},
"route_reason": {
"display_value": "",
"value": ""
},
"closed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"review_comments": {
"display_value": "",
"value": ""
},
"business_service": {
"display_value": "",
"value": ""
},
"time_worked": {
"display_value": "",
"value": ""
},
"chg_model": {
"display_value": "",
"value": ""
},
"expected_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"ed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"work_end": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"phase_state": {
"display_value": "",
"value": ""
},
"cab_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"work_notes": {
"display_value": "",
"value": ""
},
"close_code": {
"display_value": "",
"value": ""
},
"assignment_group": {
"display_value": "",
"value": ""
},
"description": {
"display_value": "",
"value": ""
},
"on_hold_reason": {
"display_value": "",
"value": ""
},
"calendar_duration": {
"display_value": "",
"value": ""
},
"close_notes": {
"display_value": "",
"value": ""
},
"sys_id": {
"display_value": "",
"value": ""
},
"contact_type": {
"display_value": "",
"value": ""
},
"cab_required": {
"display_value": "",
"value": ""
},
"urgency": {
"display_value": "",
"value": ""
},
"scope": {
"display_value": "",
"value": ""
},
"company": {
"display_value": "",
"value": ""
},
"justification": {
"display_value": "",
"value": ""
},
"activity_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"comments": {
"display_value": "",
"value": ""
},
"approval": {
"display_value": "",
"value": ""
},
"due_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_mod_count": {
"display_value": "",
"value": ""
},
"on_hold": {
"display_value": "",
"value": ""
},
"sys_tags": {
"display_value": "",
"value": ""
},
"conflict_last_run": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"unauthorized": {
"display_value": "",
"value": ""
},
"risk": {
"display_value": "",
"value": ""
},
"location": {
"display_value": "",
"value": ""
},
"category": {
"display_value": "",
"value": ""
},
"risk_impact_analysis": {
"display_value": "",
"value": ""
}
},
{
"__meta": {
"encodedQuery": "",
"fields": {
"applied": [],
"ignored": []
}
}
}
]
}

operation: Update Change Request

Input parameters

Parameter	Description
Change Request Type	Select the type of change request that you want to update in ServiceNow. You can choose from the following options: Standard Change, Normal Change, or Emergency Change.
Sys ID	Sys_id of the Standard Change, Normal Change, or Emergency Change request that you want to update in the Change Request [change_request] table.
Other Parameters	Name-value pairs for the field(s) that you want to update in the specified change request. For example, to update the short description file, enter a name-value pair similar to the following: {"short_description": "my short desc" }

Output

The output contains the following populated JSON schema:
{
"result": {
"reason": {
"display_value": "",
"value": ""
},
"parent": {
"display_value": "",
"value": ""
},
"watch_list": {
"display_value": "",
"value": ""
},
"upon_reject": {
"display_value": "",
"value": ""
},
"sys_updated_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"type": {
"display_value": "",
"value": ""
},
"approval_history": {
"display_value": "",
"value": ""
},
"test_plan": {
"display_value": ""
},
"number": {
"display_value": "",
"value": ""
},
"cab_delegate": {
"display_value": "",
"value": ""
},
"_by_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"state": {
"display_value": "",
"value": ""
},
"sys_created_by": {
"display_value": "",
"value": ""
},
"knowledge": {
"display_value": "",
"value": ""
},
"order": {
"display_value": "",
"value": ""
},
"phase": {
"display_value": "",
"value": ""
},
"cmdb_ci": {
"display_value": "",
"value": ""
},
"delivery_plan": {
"display_value": "",
"value": ""
},
"impact": {
"display_value": "",
"value": ""
},
"contract": {
"display_value": "",
"value": ""
},
"active": {
"display_value": "",
"value": ""
},
"work_notes_list": {
"display_value": "",
"value": ""
},
"priority": {
"display_value": "",
"value": ""
},
"sys_domain_path": {
"display_value": "",
"value": ""
},
"cab_recommendation": {
"display_value": "",
"value": ""
},
"production_system": {
"display_value": "",
"value": ""
},
"rejection_goto": {
"display_value": "",
"value": ""
},
"review_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"_by": {
"display_value": "",
"value": ""
},
"business_duration": {
"display_value": "",
"value": ""
},
"group_list": {
"display_value": "",
"value": ""
},
"change_plan": {
"display_value": "",
"value": ""
},
"approval_set": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"wf_activity": {
"display_value": "",
"value": ""
},
"implementation_plan": {
"display_value": "",
"value": ""
},
"universal_request": {
"display_value": "",
"value": ""
},
"end_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"short_description": {
"display_value": "",
"value": ""
},
"correlation_display": {
"display_value": "",
"value": ""
},
"delivery_task": {
"display_value": "",
"value": ""
},
"work_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"outside_maintenance_schedule": {
"display_value": "",
"value": ""
},
"additional_assignee_list": {
"display_value": "",
"value": ""
},
"std_change_producer_version": {
"display_value": "",
"value": ""
},
"sys_class_name": {
"display_value": "",
"value": ""
},
"service_offering": {
"display_value": "",
"value": ""
},
"closed_by": {
"display_value": "",
"value": ""
},
"follow_up": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"review_status": {
"display_value": "",
"value": ""
},
"reassignment_count": {
"display_value": "",
"value": ""
},
"start_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assigned_to": {
"display_value": "",
"value": ""
},
"variables": {
"display_value": "",
"value": ""
},
"sla_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"comments_and_work_notes": {
"display_value": "",
"value": ""
},
"escalation": {
"display_value": "",
"value": ""
},
"upon_approval": {
"display_value": "",
"value": ""
},
"correlation_id": {
"display_value": "",
"value": ""
},
"made_sla": {
"display_value": "",
"value": ""
},
"backout_plan": {
"display_value": "",
"value": ""
},
"conflict_status": {
"display_value": "",
"value": ""
},
"task_effective_number": {
"display_value": "",
"value": ""
},
"sys_updated_by": {
"display_value": "",
"value": ""
},
"ed_by": {
"display_value": "",
"value": ""
},
"user_input": {
"display_value": "",
"value": ""
},
"sys_created_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"on_hold_task": {
"display_value": "",
"value": ""
},
"sys_domain": {
"display_value": "",
"value": ""
},
"route_reason": {
"display_value": "",
"value": ""
},
"closed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"review_comments": {
"display_value": "",
"value": ""
},
"business_service": {
"display_value": "",
"value": ""
},
"time_worked": {
"display_value": "",
"value": ""
},
"chg_model": {
"display_value": "",
"value": ""
},
"expected_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"ed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"work_end": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"phase_state": {
"display_value": "",
"value": ""
},
"cab_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"work_notes": {
"display_value": "",
"value": ""
},
"close_code": {
"display_value": "",
"value": ""
},
"assignment_group": {
"display_value": "",
"value": ""
},
"description": {
"display_value": ""
},
"on_hold_reason": {
"display_value": "",
"value": ""
},
"calendar_duration": {
"display_value": "",
"value": ""
},
"close_notes": {
"display_value": "",
"value": ""
},
"sys_id": {
"display_value": "",
"value": ""
},
"contact_type": {
"display_value": "",
"value": ""
},
"cab_required": {
"display_value": "",
"value": ""
},
"urgency": {
"display_value": "",
"value": ""
},
"scope": {
"display_value": "",
"value": ""
},
"company": {
"display_value": "",
"value": ""
},
"justification": {
"display_value": "",
"value": ""
},
"activity_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"comments": {
"display_value": "",
"value": ""
},
"approval": {
"display_value": "",
"value": ""
},
"due_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_mod_count": {
"display_value": "",
"value": ""
},
"on_hold": {
"display_value": "",
"value": ""
},
"sys_tags": {
"display_value": "",
"value": ""
},
"conflict_last_run": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"unauthorized": {
"display_value": "",
"value": ""
},
"risk": {
"display_value": "",
"value": ""
},
"location": {
"display_value": "",
"value": ""
},
"category": {
"display_value": "",
"value": ""
},
"risk_impact_analysis": {
"display_value": "",
"value": ""
},
"__meta": {
"ignoredFields": []
}
}
}

operation: Delete Change Request

Input parameters

Parameter	Description
Change Request Type	Select the type of change request that you want to delete from ServiceNow. You can choose from the following options: Standard Change, Normal Change, or Emergency Change.
Sys ID	Sys_id of the Standard Change, Normal Change, or Emergency Change request that you want to delete from the Change Request [change_request] table.

Output

The output contains the following populated JSON schema:
{
"result": {
"reason": {
"display_value": "",
"value": ""
},
"parent": {
"display_value": "",
"value": ""
},
"watch_list": {
"display_value": "",
"value": ""
},
"upon_reject": {
"display_value": "",
"value": ""
},
"sys_updated_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"type": {
"display_value": "",
"value": ""
},
"approval_history": {
"display_value": "",
"value": ""
},
"test_plan": {
"display_value": "",
"value": ""
},
"number": {
"display_value": "",
"value": ""
},
"cab_delegate": {
"display_value": "",
"value": ""
},
"_by_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"state": {
"display_value": "",
"value": ""
},
"sys_created_by": {
"display_value": "",
"value": ""
},
"knowledge": {
"display_value": "",
"value": ""
},
"order": {
"display_value": "",
"value": ""
},
"phase": {
"display_value": "",
"value": ""
},
"cmdb_ci": {
"display_value": "",
"value": ""
},
"delivery_plan": {
"display_value": "",
"value": ""
},
"impact": {
"display_value": "",
"value": ""
},
"contract": {
"display_value": "",
"value": ""
},
"active": {
"display_value": "",
"value": ""
},
"work_notes_list": {
"display_value": "",
"value": ""
},
"priority": {
"display_value": "",
"value": ""
},
"sys_domain_path": {
"display_value": "",
"value": ""
},
"cab_recommendation": {
"display_value": "",
"value": ""
},
"production_system": {
"display_value": "",
"value": ""
},
"rejection_goto": {
"display_value": "",
"value": ""
},
"review_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"_by": {
"display_value": "",
"value": ""
},
"business_duration": {
"display_value": "",
"value": ""
},
"group_list": {
"display_value": "",
"value": ""
},
"change_plan": {
"display_value": "",
"value": ""
},
"approval_set": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"wf_activity": {
"display_value": "",
"value": ""
},
"implementation_plan": {
"display_value": "",
"value": ""
},
"universal_request": {
"display_value": "",
"value": ""
},
"end_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"short_description": {
"display_value": "",
"value": ""
},
"correlation_display": {
"display_value": "",
"value": ""
},
"delivery_task": {
"display_value": "",
"value": ""
},
"work_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"outside_maintenance_schedule": {
"display_value": "",
"value": ""
},
"additional_assignee_list": {
"display_value": "",
"value": ""
},
"std_change_producer_version": {
"display_value": "",
"value": ""
},
"sys_class_name": {
"display_value": "",
"value": ""
},
"service_offering": {
"display_value": "",
"value": ""
},
"closed_by": {
"display_value": "",
"value": ""
},
"follow_up": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"review_status": {
"display_value": "",
"value": ""
},
"reassignment_count": {
"display_value": "",
"value": ""
},
"start_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assigned_to": {
"display_value": "",
"value": ""
},
"variables": {
"display_value": "",
"value": ""
},
"sla_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"comments_and_work_notes": {
"display_value": "",
"value": ""
},
"escalation": {
"display_value": "",
"value": ""
},
"upon_approval": {
"display_value": "",
"value": ""
},
"correlation_id": {
"display_value": "",
"value": ""
},
"made_sla": {
"display_value": "",
"value": ""
},
"backout_plan": {
"display_value": "",
"value": ""
},
"conflict_status": {
"display_value": "",
"value": ""
},
"task_effective_number": {
"display_value": "",
"value": ""
},
"sys_updated_by": {
"display_value": "",
"value": ""
},
"ed_by": {
"display_value": "r",
"value": ""
},
"user_input": {
"display_value": "",
"value": ""
},
"sys_created_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"on_hold_task": {
"display_value": "",
"value": ""
},
"sys_domain": {
"display_value": "",
"value": ""
},
"route_reason": {
"display_value": "",
"value": ""
},
"closed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"review_comments": {
"display_value": "",
"value": ""
},
"business_service": {
"display_value": "",
"value": ""
},
"time_worked": {
"display_value": "",
"value": ""
},
"chg_model": {
"display_value": "",
"value": ""
},
"expected_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"ed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"work_end": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"phase_state": {
"display_value": "",
"value": ""
},
"cab_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"work_notes": {
"display_value": "",
"value": ""
},
"close_code": {
"display_value": "",
"value": ""
},
"assignment_group": {
"display_value": "",
"value": ""
},
"description": {
"display_value": "",
"value": ""
},
"on_hold_reason": {
"display_value": "",
"value": ""
},
"calendar_duration": {
"display_value": "",
"value": ""
},
"close_notes": {
"display_value": "",
"value": ""
},
"sys_id": {
"display_value": "",
"value": ""
},
"contact_type": {
"display_value": "",
"value": ""
},
"cab_required": {
"display_value": "",
"value": ""
},
"urgency": {
"display_value": "",
"value": ""
},
"scope": {
"display_value": "",
"value": ""
},
"company": {
"display_value": "",
"value": ""
},
"justification": {
"display_value": "",
"value": ""
},
"activity_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"comments": {
"display_value": "",
"value": ""
},
"approval": {
"display_value": "",
"value": ""
},
"due_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_mod_count": {
"display_value": "",
"value": ""
},
"on_hold": {
"display_value": "",
"value": ""
},
"sys_tags": {
"display_value": "",
"value": ""
},
"conflict_last_run": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"unauthorized": {
"display_value": "",
"value": ""
},
"risk": {
"display_value": "",
"value": ""
},
"location": {
"display_value": "",
"value": ""
},
"category": {
"display_value": "",
"value": ""
},
"risk_impact_analysis": {
"display_value": "",
"value": ""
}
}
}

operation: Create Change Request Task

Input parameters

Parameter	Description
Change Sys ID	Sys_id of the change request to which you want to associate this task. The sys_id is located in the Change Request [change_request] table.
Short Description	Summary of the task that you want to create in ServiceNow.
Description	Description of the task that you want to create in ServiceNow.
Other Parameters	(Optional) Fields that you want to modify while creating the change request task. The key is the field name within the template and the value is the information to populate in the field. If you pass fields that cannot be modified, i.e, Read-only fields or fields that and fields that do not exist, then such fields will be ignored, an example of such field is the Business Rules field.

Output

The output contains the following populated JSON schema:
{
"result": {
"parent": {
"display_value": "",
"value": ""
},
"planned_end_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"made_sla": {
"display_value": "",
"value": ""
},
"watch_list": {
"display_value": "",
"value": ""
},
"upon_reject": {
"display_value": "",
"value": ""
},
"sys_updated_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"task_effective_number": {
"display_value": "",
"value": ""
},
"approval_history": {
"display_value": "",
"value": ""
},
"number": {
"display_value": "",
"value": ""
},
"sys_updated_by": {
"display_value": "",
"value": ""
},
"ed_by": {
"display_value": "",
"value": ""
},
"user_input": {
"display_value": "",
"value": ""
},
"sys_created_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_domain": {
"display_value": "",
"value": ""
},
"state": {
"display_value": "",
"value": ""
},
"sys_created_by": {
"display_value": "",
"value": ""
},
"route_reason": {
"display_value": "",
"value": ""
},
"knowledge": {
"display_value": "",
"value": ""
},
"order": {
"display_value": "",
"value": ""
},
"closed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"cmdb_ci": {
"display_value": "",
"value": ""
},
"delivery_plan": {
"display_value": "",
"value": ""
},
"impact": {
"display_value": "",
"value": ""
},
"contract": {
"display_value": "",
"value": ""
},
"active": {
"display_value": "",
"value": ""
},
"work_notes_list": {
"display_value": "",
"value": ""
},
"business_service": {
"display_value": "",
"value": ""
},
"priority": {
"display_value": "",
"value": ""
},
"sys_domain_path": {
"display_value": "",
"value": ""
},
"time_worked": {
"display_value": "",
"value": ""
},
"rejection_goto": {
"display_value": "",
"value": ""
},
"expected_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"ed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"business_duration": {
"display_value": "",
"value": ""
},
"group_list": {
"display_value": "",
"value": ""
},
"work_end": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"planned_start_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"approval_set": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"wf_activity": {
"display_value": "",
"value": ""
},
"work_notes": {
"display_value": "",
"value": ""
},
"universal_request": {
"display_value": "",
"value": ""
},
"short_description": {
"display_value": "",
"value": ""
},
"close_code": {
"display_value": "",
"value": ""
},
"correlation_display": {
"display_value": "",
"value": ""
},
"delivery_task": {
"display_value": "",
"value": ""
},
"work_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assignment_group": {
"display_value": "",
"value": ""
},
"additional_assignee_list": {
"display_value": "",
"value": ""
},
"description": {
"display_value": "",
"value": ""
},
"on_hold_reason": {
"display_value": "",
"value": ""
},
"calendar_duration": {
"display_value": "",
"value": ""
},
"sys_class_name": {
"display_value": "",
"value": ""
},
"service_offering": {
"display_value": "",
"value": ""
},
"close_notes": {
"display_value": "",
"value": ""
},
"closed_by": {
"display_value": "",
"value": ""
},
"follow_up": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_id": {
"display_value": "",
"value": ""
},
"contact_type": {
"display_value": "",
"value": ""
},
"urgency": {
"display_value": "",
"value": ""
},
"company": {
"display_value": "",
"value": ""
},
"reassignment_count": {
"display_value": "",
"value": ""
},
"activity_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assigned_to": {
"display_value": "",
"value": ""
},
"variables": {
"display_value": "",
"value": ""
},
"comments": {
"display_value": "",
"value": ""
},
"sla_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"approval": {
"display_value": "",
"value": ""
},
"comments_and_work_notes": {
"display_value": "",
"value": ""
},
"due_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_mod_count": {
"display_value": "",
"value": ""
},
"on_hold": {
"display_value": "",
"value": ""
},
"sys_tags": {
"display_value": "",
"value": ""
},
"escalation": {
"display_value": "",
"value": ""
},
"upon_approval": {
"display_value": "",
"value": ""
},
"correlation_id": {
"display_value": "",
"value": ""
},
"change_task_type": {
"display_value": "",
"value": ""
},
"location": {
"display_value": "",
"value": ""
},
"created_from": {
"display_value": "",
"value": ""
},
"change_request": {
"display_value": "",
"value": ""
}
}
}

operation: Get Change Request Tasks

Input parameters

Parameter	Description
Sys ID	Sys_id of the change request whose tasks you want to retrieve from the Change Request [change_request] table.
Order By	(Optional) Field using which you want to sort the change requests tasks retrieved by this operation. By default, this is set as number.
Offset	(Optional) Index of the first item to be returned by this operation. Use this value to paginate record retrieval. This functionality enables the retrieval of all records, regardless of the number of records, in small manageable chunks. By default, this is set as 0.
Limit	(Optional) Maximum number of records that this operation should return. By default, this is set as 500.

Output

The output contains the following populated JSON schema:
{
"result": [
{
"parent": {
"display_value": "",
"value": ""
},
"planned_end_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"made_sla": {
"display_value": "",
"value": ""
},
"watch_list": {
"display_value": "",
"value": ""
},
"upon_reject": {
"display_value": "",
"value": ""
},
"sys_updated_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"task_effective_number": {
"display_value": "",
"value": ""
},
"approval_history": {
"display_value": "",
"value": ""
},
"number": {
"display_value": "",
"value": ""
},
"sys_updated_by": {
"display_value": "",
"value": ""
},
"ed_by": {
"display_value": "",
"value": ""
},
"user_input": {
"display_value": "",
"value": ""
},
"sys_created_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_domain": {
"display_value": "",
"value": ""
},
"state": {
"display_value": "",
"value": ""
},
"sys_created_by": {
"display_value": "",
"value": ""
},
"route_reason": {
"display_value": "",
"value": ""
},
"knowledge": {
"display_value": "",
"value": ""
},
"order": {
"display_value": "",
"value": ""
},
"closed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"cmdb_ci": {
"display_value": "",
"value": ""
},
"delivery_plan": {
"display_value": "",
"value": ""
},
"impact": {
"display_value": "",
"value": ""
},
"contract": {
"display_value": "",
"value": ""
},
"active": {
"display_value": "",
"value": ""
},
"work_notes_list": {
"display_value": "",
"value": ""
},
"business_service": {
"display_value": "",
"value": ""
},
"priority": {
"display_value": "",
"value": ""
},
"sys_domain_path": {
"display_value": "",
"value": ""
},
"time_worked": {
"display_value": "",
"value": ""
},
"rejection_goto": {
"display_value": "",
"value": ""
},
"expected_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"ed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"business_duration": {
"display_value": "",
"value": ""
},
"group_list": {
"display_value": "",
"value": ""
},
"work_end": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"planned_start_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"approval_set": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"wf_activity": {
"display_value": "",
"value": ""
},
"work_notes": {
"display_value": "",
"value": ""
},
"universal_request": {
"display_value": "",
"value": ""
},
"short_description": {
"display_value": "",
"value": ""
},
"close_code": {
"display_value": "",
"value": ""
},
"correlation_display": {
"display_value": "",
"value": ""
},
"delivery_task": {
"display_value": "",
"value": ""
},
"work_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assignment_group": {
"display_value": "",
"value": ""
},
"additional_assignee_list": {
"display_value": "",
"value": ""
},
"description": {
"display_value": "",
"value": ""
},
"on_hold_reason": {
"display_value": "",
"value": ""
},
"calendar_duration": {
"display_value": "",
"value": ""
},
"sys_class_name": {
"display_value": "",
"value": ""
},
"service_offering": {
"display_value": "",
"value": ""
},
"close_notes": {
"display_value": "",
"value": ""
},
"closed_by": {
"display_value": "",
"value": ""
},
"follow_up": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_id": {
"display_value": "",
"value": ""
},
"contact_type": {
"display_value": "",
"value": ""
},
"urgency": {
"display_value": "",
"value": ""
},
"company": {
"display_value": "",
"value": ""
},
"reassignment_count": {
"display_value": "",
"value": ""
},
"activity_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assigned_to": {
"display_value": "",
"value": ""
},
"variables": {
"display_value": "",
"value": ""
},
"comments": {
"display_value": "",
"value": ""
},
"sla_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"approval": {
"display_value": "",
"value": ""
},
"comments_and_work_notes": {
"display_value": "",
"value": ""
},
"due_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_mod_count": {
"display_value": "",
"value": ""
},
"on_hold": {
"display_value": "",
"value": ""
},
"sys_tags": {
"display_value": "",
"value": ""
},
"escalation": {
"display_value": "",
"value": ""
},
"upon_approval": {
"display_value": "",
"value": ""
},
"correlation_id": {
"display_value": "",
"value": ""
},
"change_task_type": {
"display_value": "",
"value": ""
},
"location": {
"display_value": "",
"value": ""
},
"created_from": {
"display_value": "",
"value": ""
},
"change_request": {
"display_value": "",
"value": ""
}
}
]
}

operation: Update Change Request Task

Input parameters

Parameter	Description
Sys ID	Sys_id of the change request whose tasks you want to update in ServiceNow. This verifies whether the specified task is associated with the specified change request. The sys_id is located in the Change Request [change_request] table.
Task Sys ID	Sys_id of the task that you want to update in the Change Task [change_task] table.
Other Parameters	(Optional) Name-value pairs for the field(s) to update in the associated change request task. For example, to update the short description file, enter a name-value pair similar to the following: {"short_description": "my short desc" }

Output

The output contains the following populated JSON schema:
{
"result": {
"parent": {
"display_value": "",
"value": ""
},
"planned_end_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"made_sla": {
"display_value": "",
"value": ""
},
"watch_list": {
"display_value": "",
"value": ""
},
"upon_reject": {
"display_value": "",
"value": ""
},
"sys_updated_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"task_effective_number": {
"display_value": "",
"value": ""
},
"approval_history": {
"display_value": "",
"value": ""
},
"number": {
"display_value": "",
"value": ""
},
"sys_updated_by": {
"display_value": "",
"value": ""
},
"ed_by": {
"display_value": "",
"value": ""
},
"user_input": {
"display_value": "",
"value": ""
},
"sys_created_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_domain": {
"display_value": "",
"value": ""
},
"state": {
"display_value": "",
"value": ""
},
"sys_created_by": {
"display_value": "",
"value": ""
},
"route_reason": {
"display_value": "",
"value": ""
},
"knowledge": {
"display_value": "",
"value": ""
},
"order": {
"display_value": "",
"value": ""
},
"closed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"cmdb_ci": {
"display_value": "",
"value": ""
},
"delivery_plan": {
"display_value": "",
"value": ""
},
"impact": {
"display_value": "",
"value": ""
},
"contract": {
"display_value": "",
"value": ""
},
"active": {
"display_value": "",
"value": ""
},
"work_notes_list": {
"display_value": "",
"value": ""
},
"business_service": {
"display_value": "",
"value": ""
},
"priority": {
"display_value": "",
"value": ""
},
"sys_domain_path": {
"display_value": "",
"value": ""
},
"time_worked": {
"display_value": "",
"value": ""
},
"rejection_goto": {
"display_value": "",
"value": ""
},
"expected_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"ed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"business_duration": {
"display_value": "",
"value": ""
},
"group_list": {
"display_value": "",
"value": ""
},
"work_end": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"planned_start_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"approval_set": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"wf_activity": {
"display_value": "",
"value": ""
},
"work_notes": {
"display_value": "",
"value": ""
},
"universal_request": {
"display_value": "",
"value": ""
},
"short_description": {
"display_value": "",
"value": ""
},
"close_code": {
"display_value": "",
"value": ""
},
"correlation_display": {
"display_value": "",
"value": ""
},
"delivery_task": {
"display_value": "",
"value": ""
},
"work_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assignment_group": {
"display_value": "",
"value": ""
},
"additional_assignee_list": {
"display_value": "",
"value": ""
},
"description": {
"display_value": "",
"value": ""
},
"on_hold_reason": {
"display_value": "",
"value": ""
},
"calendar_duration": {
"display_value": "",
"value": ""
},
"sys_class_name": {
"display_value": "",
"value": ""
},
"service_offering": {
"display_value": "",
"value": ""
},
"close_notes": {
"display_value": "",
"value": ""
},
"closed_by": {
"display_value": "",
"value": ""
},
"follow_up": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_id": {
"display_value": "",
"value": ""
},
"contact_type": {
"display_value": "",
"value": ""
},
"urgency": {
"display_value": "",
"value": ""
},
"company": {
"display_value": "",
"value": ""
},
"reassignment_count": {
"display_value": "",
"value": ""
},
"activity_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assigned_to": {
"display_value": "",
"value": ""
},
"variables": {
"display_value": "",
"value": ""
},
"comments": {
"display_value": "",
"value": ""
},
"sla_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"approval": {
"display_value": "",
"value": ""
},
"comments_and_work_notes": {
"display_value": "",
"value": ""
},
"due_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_mod_count": {
"display_value": "",
"value": ""
},
"on_hold": {
"display_value": "",
"value": ""
},
"sys_tags": {
"display_value": "",
"value": ""
},
"escalation": {
"display_value": "",
"value": ""
},
"upon_approval": {
"display_value": "",
"value": ""
},
"correlation_id": {
"display_value": "",
"value": ""
},
"change_task_type": {
"display_value": "",
"value": ""
},
"location": {
"display_value": "",
"value": ""
},
"created_from": {
"display_value": "",
"value": ""
},
"change_request": {
"display_value": "",
"value": ""
},
"__meta": {
"ignoredFields": []
}
}
}

operation: Delete Change Request Task

Input parameters

Parameter	Description
Change Sys ID	Sys_id of the change request whose tasks you want to delete from ServiceNow. This verifies whether the specified task is associated with the specified change request. The sys_id is located in the Change Request [change_request] table.
Task Sys ID	Sys_id of the task that you want to delete from the Change Task [change_task] table.

Output

The output contains the following populated JSON schema:
{
"result": {
"parent": {
"display_value": "",
"value": ""
},
"planned_end_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"made_sla": {
"display_value": "",
"value": ""
},
"watch_list": {
"display_value": "",
"value": ""
},
"upon_reject": {
"display_value": "",
"value": ""
},
"sys_updated_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"task_effective_number": {
"display_value": "",
"value": ""
},
"approval_history": {
"display_value": "",
"value": ""
},
"number": {
"display_value": "",
"value": ""
},
"sys_updated_by": {
"display_value": "",
"value": ""
},
"opened_by": {
"display_value": "",
"value": ""
},
"user_input": {
"display_value": "",
"value": ""
},
"sys_created_on": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_domain": {
"display_value": "",
"value": ""
},
"state": {
"display_value": "",
"value": ""
},
"sys_created_by": {
"display_value": "",
"value": ""
},
"route_reason": {
"display_value": "",
"value": ""
},
"knowledge": {
"display_value": "",
"value": ""
},
"order": {
"display_value": "",
"value": ""
},
"closed_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"cmdb_ci": {
"display_value": "",
"value": ""
},
"delivery_plan": {
"display_value": "",
"value": ""
},
"impact": {
"display_value": "",
"value": ""
},
"contract": {
"display_value": "",
"value": ""
},
"active": {
"display_value": "",
"value": ""
},
"work_notes_list": {
"display_value": "",
"value": ""
},
"business_service": {
"display_value": "",
"value": ""
},
"priority": {
"display_value": "",
"value": ""
},
"sys_domain_path": {
"display_value": "/",
"value": "/"
},
"time_worked": {
"display_value": "",
"value": ""
},
"rejection_goto": {
"display_value": "",
"value": ""
},
"expected_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"opened_at": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"business_duration": {
"display_value": "",
"value": ""
},
"group_list": {
"display_value": "",
"value": ""
},
"work_end": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"planned_start_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"approval_set": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"wf_activity": {
"display_value": "",
"value": ""
},
"work_notes": {
"display_value": "",
"value": ""
},
"universal_request": {
"display_value": "",
"value": ""
},
"short_description": {
"display_value": "",
"value": ""
},
"close_code": {
"display_value": "",
"value": ""
},
"correlation_display": {
"display_value": "",
"value": ""
},
"delivery_task": {
"display_value": "",
"value": ""
},
"work_start": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assignment_group": {
"display_value": "",
"value": ""
},
"additional_assignee_list": {
"display_value": "",
"value": ""
},
"description": {
"display_value": "",
"value": ""
},
"on_hold_reason": {
"display_value": "",
"value": ""
},
"calendar_duration": {
"display_value": "",
"value": ""
},
"sys_class_name": {
"display_value": "",
"value": ""
},
"service_offering": {
"display_value": "",
"value": ""
},
"close_notes": {
"display_value": "",
"value": ""
},
"closed_by": {
"display_value": "",
"value": ""
},
"follow_up": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_id": {
"display_value": "",
"value": ""
},
"contact_type": {
"display_value": "",
"value": ""
},
"urgency": {
"display_value": "",
"value": ""
},
"company": {
"display_value": "",
"value": ""
},
"reassignment_count": {
"display_value": "",
"value": ""
},
"activity_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"assigned_to": {
"display_value": "",
"value": ""
},
"variables": {
"display_value": "",
"value": ""
},
"comments": {
"display_value": "",
"value": ""
},
"sla_due": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"approval": {
"display_value": "",
"value": ""
},
"comments_and_work_notes": {
"display_value": "",
"value": ""
},
"due_date": {
"display_value": "",
"value": "",
"display_value_internal": ""
},
"sys_mod_count": {
"display_value": "",
"value": ""
},
"on_hold": {
"display_value": "",
"value": ""
},
"sys_tags": {
"display_value": "",
"value": ""
},
"escalation": {
"display_value": "",
"value": ""
},
"upon_approval": {
"display_value": "",
"value": ""
},
"correlation_id": {
"display_value": "",
"value": ""
},
"change_task_type": {
"display_value": "",
"value": ""
},
"location": {
"display_value": "",
"value": ""
},
"created_from": {
"display_value": "",
"value": ""
},
"change_request": {
"display_value": "",
"value": ""
}
}
}

operation: Create Security Incident

Input parameters

Parameter	Description
Short Description	Short description of the security incident that you want to create in ServiceNow.
Description	(Optional) Detalled Description of the security incident that you want to create in ServiceNow.
Location	(Optional) Location of the security incident that you want to create in ServiceNow.
Category	(Optional) Category of the security incident that you want to create in ServiceNow. You can choose from one of the following categories: Confidential personal identity data exposure, Criminal activity/investigation, Denial of Service, Digital Millennium Copyright Act (DMCA) violation, Equipment loss, Malicious code activity, No Incident, Policy violation, Privilege Escalation, Reconnaissance activity, Rogue server or service, Spam source, Phishing, Un-patched vulnerability, Unauthorized access, Web/BBS defacement, Shared Intelligence, Failed Login, Lost or stolen laptop, Malware, or Insider Breach. If you choose the 'Confidential personal identity data exposure' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Credit card information, Social Security Numbers with or without names, etc. If you choose the 'Criminal activity/investigation' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Child pornography, Online theft, fraud, Physical theft, break-in, Threatening communication, etc. If you choose the 'Denial of Service' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Inbound DDos, Outbound Dos, etc. If you choose the 'Digital Millennium Copyright Act (DMCA) violation' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Illegal distribution of copyrighted or licensed material, Illegal possession of copyrighted or licensed material, etc. If you choose the 'Equipment loss' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between the following options: Lost Equipment or Stolen Equipment. If you choose the 'Malicious code activity' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Botnet, Rootkit, etc. If you choose the 'No Incident' category, then from the Subcategory drop-down list choose the When investigation of suspicious activity finds no evidence of a security incident option. If you choose the 'Policy violation' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Company policy violation, Violation of code of conduct, etc. If you choose the 'Privilege Escalation' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between the following options: Active Directory Domain Admin or Application Admin. If you choose the 'Reconnaissance activity' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Port scanning, Unauthorized monitoring, etc. If you choose the 'Rogue server or service' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Botnet controller, Phishing scam web server, etc. If you choose the 'Spam source' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between the following options: Spam host or Spam Relay. If you choose the 'Phishing' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Spear phishing, Large campaign, etc. If you choose the 'Un-patched vulnerability' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Vulnerable application, Weak or no password on an account, etc. If you choose the 'Unauthorized access' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Brute force password cracking attempts, Abuse of access privileges, etc. If you choose the 'Web/BBS defacement' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Defacement of web site, Redirected web site, etc. If you choose the 'Malware' category, then from the Subcategory drop-down list choose the subcategory of the security incident that you want to create in ServiceNow. You can choose between subcategories such as Ransomeware, C&C Communication inbound, etc. The Shared Intelligence, Failed Login, and Lost or stolen laptop categories have no subcategories.
Severity	(Optional) Severity of the security incident that you want to create in ServiceNow.You can select one of the following severities: 1-High, 2-Medium, or 3-Low.
State	(Optional) State of the security incident that you want to create in ServiceNow. You can select one of the following states: Draft, Analysis, Contain, Eradicate, Recover, Review, Closed, or Cancelled.
Risk Score	(Optional) Risk score of the security incident that you want to create in ServiceNow. The default value is 40.
Impact	(Optional) Impact of the security incident that you want to create in ServiceNow. You can select one of the following impacts: 1-High, 2-Medium, or 3-Low.
Work Notes	(Optional) Work Notes that you want to add to the security incident that you want to create in ServiceNow.
Urgency	(Optional) Urgency of the security incident that you want to create in ServiceNow. You can select one of the following urgencies: 1-High, 2-Medium, or 3-Low.
Other Fields	(Optional) JSON field provided to enable you to enter other fields for the security incident that you want to create in ServiceNow.

Output

The output contains the following populated JSON schema:
{
"result": [
{
"pir": "",
"risk": "",
"spam": "",
"asset": "",
"order": "",
"state": "",
"active": "",
"caller": "",
"impact": "",
"number": "",
"parent": "",
"skills": "",
"sys_id": "",
"cmdb_ci": "",
"company": "",
"dest_ip": "",
"problem": "",
"sla_due": "",
"urgency": "",
"approval": "",
"billable": "",
"category": "",
"comments": "",
"contract": "",
"due_date": "",
"incident": "",
"location": "",
"made_sla": "",
"priority": "",
"severity": "",
"substate": "",
"sys_tags": "",
"template": "",
"work_end": "",
"closed_at": "",
"closed_by": "",
"follow_up": "",
"knowledge": "",
"opened_at": "",
"opened_by": {
"link": "",
"value": ""
},
"other_ioc": "",
"source_ip": "",
"alert_rule": "",
"close_code": "",
"department": "",
"escalation": "",
"group_list": "",
"is_catalog": "",
"mitre_tool": "",
"opened_for": {
"link": "",
"value": ""
},
"prediction": "",
"risk_score": "",
"sys_domain": {
"link": "",
"value": ""
},
"user_input": "",
"watch_list": "",
"work_notes": "",
"work_start": "",
"assigned_to": {
"link": "",
"value": ""
},
"close_notes": "",
"description": "",
"malware_url": "",
"mitre_group": "",
"phish_email": "",
"risk_change": "",
"subcategory": "",
"time_worked": "",
"upon_reject": "",
"activity_due": "",
"alert_sensor": "",
"approval_set": "",
"contact_type": "",
"expected_end": "",
"external_url": "",
"malware_hash": "",
"mitre_tactic": "",
"referrer_url": "",
"request_type": "",
"route_reason": "",
"secure_notes": "",
"task_created": "",
"affected_user": "",
"attack_vector": "",
"delivery_plan": "",
"delivery_task": "",
"estimated_end": "",
"mitre_malware": "",
"security_tags": "",
"sla_suspended": "",
"sys_mod_count": "",
"upon_approval": "",
"change_request": "",
"correlation_id": "",
"expected_start": "",
"initiated_from": "",
"mitre_platform": "",
"previous_agent": "",
"sys_class_name": "",
"sys_created_by": "",
"sys_created_on": "",
"sys_updated_by": "",
"sys_updated_on": "",
"assigned_vendor": "",
"mitre_technique": "",
"pir_respondents": "",
"sys_domain_path": "",
"work_notes_list": "",
"approval_history": "",
"assignment_group": {
"link": "",
"value": ""
},
"business_service": "",
"confidence_score": "",
"request_category": "",
"requested_due_by": "",
"service_offering": "",
"sla_suspended_on": "",
"vendor_reference": "",
"business_duration": "",
"calendar_duration": "",
"mitre_data_source": "",
"short_description": "",
"sla_suspended_for": "",
"universal_request": "",
"reassignment_count": "",
"automation_activity": "",
"correlation_display": "",
"new_pir_respondents": "",
"qualification_group": "",
"risk_score_override": "",
"special_access_read": "",
"business_criticality": "",
"sla_suspended_reason": "",
"special_access_write": "",
"task_effective_number": "",
"security_incident_self": {
"link": "",
"value": ""
},
"comments_and_work_notes": "",
"additional_assignee_list": "",
"parent_security_incident": "",
"template_workflow_invoked": ""
}
]
}

operation: Search Security Incident Record

Input parameters

Parameter	Description
Table Name	Name of the table (in the ServiceNow database) in which you want to search for a record. For example, sn_si_incident.
Advance Search Query	Parameters such as the System ID, description, and state of a ServiceNow record, using which you can create a generalized query to search for multiple fields in ServiceNow. For example, Table Name: incident Record Information: {"category=Phishing&number=INC0000059"}
Limit	(Optional) Maximum number of results, per page, that this operation should return. By default, this is set as 10000.

Output

The output contains the following populated JSON schema:
{
"result": [
{
"pir": "",
"risk": "",
"spam": "",
"asset": "",
"order": "",
"state": "",
"active": "",
"caller": "",
"impact": "",
"number": "",
"parent": "",
"skills": "",
"sys_id": "",
"cmdb_ci": "",
"company": "",
"dest_ip": "",
"problem": "",
"sla_due": "",
"urgency": "",
"approval": "",
"billable": "",
"category": "",
"comments": "",
"contract": "",
"due_date": "",
"incident": "",
"location": "",
"made_sla": "",
"priority": "",
"severity": "",
"substate": "",
"sys_tags": "",
"template": "",
"work_end": "",
"closed_at": "",
"closed_by": "",
"follow_up": "",
"knowledge": "",
"opened_at": "",
"opened_by": {
"link": "",
"value": ""
},
"other_ioc": "",
"source_ip": "",
"alert_rule": "",
"close_code": "",
"department": "",
"escalation": "",
"group_list": "",
"is_catalog": "",
"mitre_tool": "",
"opened_for": {
"link": "",
"value": ""
},
"prediction": "",
"risk_score": "",
"sys_domain": {
"link": "",
"value": ""
},
"user_input": "",
"watch_list": "",
"work_notes": "",
"work_start": "",
"assigned_to": {
"link": "",
"value": ""
},
"close_notes": "",
"description": "",
"malware_url": "",
"mitre_group": "",
"phish_email": "",
"risk_change": "",
"subcategory": "",
"time_worked": "",
"upon_reject": "",
"activity_due": "",
"alert_sensor": "",
"approval_set": "",
"contact_type": "",
"expected_end": "",
"external_url": "",
"malware_hash": "",
"mitre_tactic": "",
"referrer_url": "",
"request_type": "",
"route_reason": "",
"secure_notes": "",
"task_created": "",
"affected_user": "",
"attack_vector": "",
"delivery_plan": "",
"delivery_task": "",
"estimated_end": "",
"mitre_malware": "",
"security_tags": "",
"sla_suspended": "",
"sys_mod_count": "",
"upon_approval": "",
"change_request": "",
"correlation_id": "",
"expected_start": "",
"initiated_from": "",
"mitre_platform": "",
"previous_agent": "",
"sys_class_name": "",
"sys_created_by": "",
"sys_created_on": "",
"sys_updated_by": "",
"sys_updated_on": "",
"assigned_vendor": "",
"mitre_technique": "",
"pir_respondents": "",
"sys_domain_path": "",
"work_notes_list": "",
"approval_history": "",
"assignment_group": {
"link": "",
"value": ""
},
"business_service": "",
"confidence_score": "",
"request_category": "",
"requested_due_by": "",
"service_offering": "",
"sla_suspended_on": "",
"vendor_reference": "",
"business_duration": "",
"calendar_duration": "",
"mitre_data_source": "",
"short_description": "",
"sla_suspended_for": "",
"universal_request": "",
"reassignment_count": "",
"automation_activity": "",
"correlation_display": "",
"new_pir_respondents": "",
"qualification_group": "",
"risk_score_override": "",
"special_access_read": "",
"business_criticality": "",
"sla_suspended_reason": "",
"special_access_write": "",
"task_effective_number": "",
"security_incident_self": {
"link": "",
"value": ""
},
"comments_and_work_notes": "",
"additional_assignee_list": "",
"parent_security_incident": "",
"template_workflow_invoked": ""
}
]
}

operation: Get Location

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"result": [
{
"country": "",
"parent": {
"link": "",
"value": ""
},
"cmn_location_type": "",
"city": "",
"latitude": "",
"primary_location": "",
"managed_by_group": "",
"sys_updated_on": "",
"sys_id": "",
"sys_updated_by": "",
"life_cycle_stage_status": "",
"stock_room": "",
"street": "",
"sys_created_on": "",
"contact": "",
"phone_territory": "",
"company": {
"link": "",
"value": ""
},
"lat_long_error": "",
"state": "",
"sys_created_by": "",
"longitude": "",
"zip": "",
"sys_mod_count": "",
"duplicate": "",
"sys_tags": "",
"time_zone": "",
"cmn_location_source": "",
"full_name": "",
"fax_phone": "",
"phone": "",
"name": "",
"life_cycle_stage": "",
"coordinates_retrieved_on": ""
}
]
}

operation: Update Security Incident

Input parameters

Parameter	Description
Sys ID	System ID of the ServiceNow security incident that you want to update. The system ID for a security incident is generated when you create an incident in ServiceNow.
State	(Optional) State of the security incident that you want to update in ServiceNow. You can select one of the following states: Draft, Analysis, Contain, Eradicate, Recover, Review, Closed, or Cancelled.
Severity	(Optional) Severity of the security incident that you want to update in ServiceNow. You can select one of the following severities: 1-High, 2-Medium, or 3-Low.
Description	(Optional) The description that you want to add to the ServiceNow security incident that you want to update in ServiceNow.
Work Notes	(Optional) Work Notes that you want to add to the security incident that you want to update in ServiceNow.
Risk Score	(Optional) Risk score of the security incident that you want to update in ServiceNow. The default value is 47.
Other Fields	(Optional) JSON field provided to enable you to enter other fields for the security incident that you want to update in ServiceNow.

Output

The output contains the following populated JSON schema:
{
"result": [
{
"pir": "",
"risk": "",
"spam": "",
"asset": "",
"order": "",
"state": "",
"active": "",
"caller": "",
"impact": "",
"number": "",
"parent": "",
"skills": "",
"sys_id": "",
"cmdb_ci": "",
"company": "",
"dest_ip": "",
"problem": "",
"sla_due": "",
"urgency": "",
"approval": "",
"billable": "",
"category": "",
"comments": "",
"contract": "",
"due_date": "",
"incident": "",
"location": "",
"made_sla": "",
"priority": "",
"severity": "",
"substate": "",
"sys_tags": "",
"template": "",
"work_end": "",
"closed_at": "",
"closed_by": "",
"follow_up": "",
"knowledge": "",
"opened_at": "",
"opened_by": {
"link": "",
"value": ""
},
"other_ioc": "",
"source_ip": "",
"alert_rule": "",
"close_code": "",
"department": "",
"escalation": "",
"group_list": "",
"is_catalog": "",
"mitre_tool": "",
"opened_for": {
"link": "",
"value": ""
},
"prediction": "",
"risk_score": "",
"sys_domain": {
"link": "",
"value": ""
},
"user_input": "",
"watch_list": "",
"work_notes": "",
"work_start": "",
"assigned_to": {
"link": "",
"value": ""
},
"close_notes": "",
"description": "",
"malware_url": "",
"mitre_group": "",
"phish_email": "",
"risk_change": "",
"subcategory": "",
"time_worked": "",
"upon_reject": "",
"activity_due": "",
"alert_sensor": "",
"approval_set": "",
"contact_type": "",
"expected_end": "",
"external_url": "",
"malware_hash": "",
"mitre_tactic": "",
"referrer_url": "",
"request_type": "",
"route_reason": "",
"secure_notes": "",
"task_created": "",
"affected_user": "",
"attack_vector": "",
"delivery_plan": "",
"delivery_task": "",
"estimated_end": "",
"mitre_malware": "",
"security_tags": "",
"sla_suspended": "",
"sys_mod_count": "",
"upon_approval": "",
"change_request": "",
"correlation_id": "",
"expected_start": "",
"initiated_from": "",
"mitre_platform": "",
"previous_agent": "",
"sys_class_name": "",
"sys_created_by": "",
"sys_created_on": "",
"sys_updated_by": "",
"sys_updated_on": "",
"assigned_vendor": "",
"mitre_technique": "",
"pir_respondents": "",
"sys_domain_path": "",
"work_notes_list": "",
"approval_history": "",
"assignment_group": {
"link": "",
"value": ""
},
"business_service": "",
"confidence_score": "",
"request_category": "",
"requested_due_by": "",
"service_offering": "",
"sla_suspended_on": "",
"vendor_reference": "",
"business_duration": "",
"calendar_duration": "",
"mitre_data_source": "",
"short_description": "",
"sla_suspended_for": "",
"universal_request": "",
"reassignment_count": "",
"automation_activity": "",
"correlation_display": "",
"new_pir_respondents": "",
"qualification_group": "",
"risk_score_override": "",
"special_access_read": "",
"business_criticality": "",
"sla_suspended_reason": "",
"special_access_write": "",
"task_effective_number": "",
"security_incident_self": {
"link": "",
"value": ""
},
"comments_and_work_notes": "",
"additional_assignee_list": "",
"parent_security_incident": "",
"template_workflow_invoked": ""
}
]
}

operation: Delete Security Incident

Input parameters

Parameter	Description
Security Incident System ID	(Optional) System ID of the security incident that you want to delete from ServiceNow. The system ID for a security incident is generated when you create an incident in ServiceNow.

Output

The output contains the following populated JSON schema:
{
"Status": "",
"Message": ""
}

operation: Submit Attachment

Input parameters

Parameter	Description
Table Name	Name of the table (in the ServiceNow database) in which you want to submit the file.
Table Sys ID	System ID of the table (in the ServiceNow database) you want to submit the file.
Type	Type of file that you want to submit to ServiceNow. Type can be an Attachment ID or a File IRI. You can choose from the following options: Attachment IRI: Specify the attachment ID, which is used to access the attachment metadata from the FortiSOAR™ Attachments module, in the Attachment IRI field. File IRI: Specify the filename and File IRI in the following fields: File IRI: Specify the file IRI, used to access the file metadata from the FortiSOAR™ Attachments module File Name: Specify the name of the file to be submitted.

Output

The output contains the following populated JSON schema:

{
    "result": {
        "hash": "",
        "state": "",
        "sys_id": "",
        "sys_tags": "",
        "file_name": "",
        "compressed": "",
        "size_bytes": "",
        "table_name": "",
        "image_width": "",
        "content_type": "",
        "image_height": "",
        "table_sys_id": "",
        "download_link": "",
        "sys_mod_count": "",
        "sys_created_by": "",
        "sys_created_on": "",
        "sys_updated_by": "",
        "sys_updated_on": "",
        "size_compressed": "",
        "chunk_size_bytes": "",
        "encryption_context": "",
        "average_image_color": ""
    }
}

operation: Delete Attachment

Input parameters

Parameter	Description
File Sys ID	System ID of the file that you want to delete from ServiceNow.

Output

The output contains the following populated JSON schema:

{
    "Status": "Success",
    "Message": "Executed successfully"
}

Included playbooks

The Sample-ServiceNow-3.3.0 playbook collection comes bundled with the ServiceNow connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the ServiceNow connector.

• Advanced Search
• Cart: Add Item to Cart
• Cart: Delete Cart Item
• Cart: Get Cart
• Cart: Update Cart Item
• Change: Create Change Request
• Change: Create Change Request Task
• Change: Delete Change Request
• Change: Delete Change Request Task
• Change: Get All Change Requests
• Change: Get Change Request Details
• Change: Get Change Request Tasks
• Change: Update Change Request
• Change: Update Change Request Task
• Download Attachment
• Get Assignment Groups
• Get Attachments
• Get Catalog Categories
• Get Catalogs
• Get Items
• Get Location
• Get Users
• Incident: Create Incident
• Incident: Update ServiceNow Incident
• SIR: Create Security Incident
• SIR: Search Security Incident Record
• SIR: Update Security Incident
• SIR: Delete Security Incident
• > ServiceNow > Create Incident
• > ServiceNow > Fetch
• ServiceNow > Ingest
• >>ServiceNow > Init Macros
• ServiceNow On Incident Update
• Table: Create Table Record
• Table: Search Table Record
• Table: Update ServiceNow Table Record
• Submit Attachment
• Delete Attachment

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Getting the Client ID and Client Secret from ServiceNow

To support OAuth Authentication for ServiceNow, you need to get a Client ID and Client Secret from ServiceNow. To get the Client ID and Client Secret, open ServiceNow and search for OAuth in the ServiceNow navigation. Then, in the System OAuth menu, click Application Registry, then click the Create an OAuth API endpoint for external clients option.

Now, you are using OAuth Authentication for ServiceNow.

Next, you need to create an application registry for OAuth as shown in the following image:

After creating the application registry for OAuth you will get the Client ID and the Client Secret.

Note: Version 3.1.0 and later of the connector supports OAUTH with ServiceNow as an OAUTH Provider.

Getting the Security Incident Response (SIR) module

If the Security Incident Response (SIR) module does not appear in your ServiceNow instance, then you need to get the SIR module from the 'Plugins' section. To get the SIR module, log on to your ServiceNow instance, and go to the filter navigator, and search 'plugin'. In the System Definition menu section, click the Plugins item. On the Plugins page search for 'security incident response', and install the “Security Incident Response” and “Security Incident Response Dependencies” plugins:

Creating or editing a business rule to use HMAC Authentication

To leverage FortiSOAR's Custom API Endpoint to integrate with ServiceNow, or manually trigger FortiSOAR playbooks from your third-party products, you must create a business rule or edit a current business rule to use HMAC authentication instead of Basic authentication. A business rule is a server-side script that runs when a record is inserted, updated, or deleted, or when a table is queried. ServiceNow's outbound REST functionality allows you to retrieve, create, update, or delete data on a web services server that supports the REST architecture. A REST message can be sent by a REST workflow activity or by using the RESTMessageV2 script API.

Steps to create and configure a business rule

1. Log into ServiceNow to create a business rule or edit an existing business rule
   1. Use the ‘Filter navigator’ to search for ‘Business Rule’. In the ‘System Definition’ you will get ‘Business Rule’.
   2. To create a new business rule, click Business Rule and then click New. To edit an existing business rule, click on that particular business rule.
   3. Configure the business rule as shown in the following images:
      
      
      
      Click the Advanced tab, and in the Script box, add the following business rule:

      DEFAULT_ALGORITHM = "sha256";
      public_key = "PUBLIC KEY";
      private_key = "PRIVATE KEY";
      var HexUtil = 
      {
        convertByteArrayToHex : function(byteArray)
        {
          var hex = "";
          byteArray.forEach(function(byteValue) { hex += HexUtil.convertByteToHex(byteValue); });
          return hex;  
        },
        convertByteToHex : function(b) 
        {
          var hexChar = ["0", "1", "2", "3", "4", "5", "6", "7","8", "9", "a", "b", "c", "d", "e", "f"];
          return hexChar[(b >> 4) & 0x0f] + hexChar[b & 0x0f];
        }
      };
      var timestamp = new Date().toISOString().slice(0, 19).replace('T', ' ');	
      method = "POST";
      payload = {"name": "test tasks"};
      fullURL = "https://server_url.com/api/triggers/1/hmac_based"; // Add the full URL here
      var inputstring = JSON.stringify(payload);
      var digest = new GlideDigest();
      var hashed_payload = digest.getSHA256Hex(inputstring).toLowerCase();
      var raw_fingerprint = DEFAULT_ALGORITHM + "." + method + "." + timestamp + "." + fullURL + "." + hashed_payload;
      var mac = new GlideCertificateEncryption;
      key = GlideStringUtil.base64Encode(private_key);
      var hash = mac.generateMac(key, "HmacSHA256", raw_fingerprint);
      var bytes = GlideStringUtil.base64DecodeAsBytes(hash);
      var hashed_fingerprint = HexUtil.convertByteArrayToHex(bytes);
      var header = GlideStringUtil().base64Encode(DEFAULT_ALGORITHM + ";" + timestamp + ";" + public_key + ";" + hashed_fingerprint);
      header = 'CS ' + header;
      var request = new sn_ws.RESTMessageV2();
      request.setEndpoint(fullURL);         //Scripted rest api
      request.setHttpMethod('POST');
      request.setRequestHeader("Authorization",header);
      request.setRequestBody(inputstring);
      request.setRequestHeader("Accept","application/json");
      var response = request.execute();
      response.haveError();
      request.getRequestHeader();
      request.getRequestBody();
      request.getEndpoint();
      request.getRequestHeaders();
      response.getErrorMessage();
      response.getQueryString();
      var responseBody = response.getBody();
      var httpStatus = response.getStatusCode();
      

2. Once you have added the script to configure the business rule, click Update to save the business rule. For detailed information on creating a business rule, see the Business Rule documentation included in ServiceNow's Product documentation.

Now, when an incident is created in ServiceNow, the business rule gets triggered, and the data of that incident gets pushed to your FortiSOAR instance. At FortiSOAR's end, you must create a playbook with an API trigger on token-based authentication (HMAC) to pull the data from ServiceNow as shown in the following image:

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling incidents from ServiceNow. Currently, "incidents" in ServiceNow are mapped to "incidents" in FortiSOAR™. For more information on the Data Ingestion Wizard, see the "Connectors Guide" in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the “Data Ingestion Wizard” to seamlessly map the incoming ServiceNow "Incidents" to FortiSOAR™ "Incidents".

The Data Ingestion Wizard enables you to configure scheduled pulling of data from ServiceNow into FortiSOAR™. It also lets you pull some sample data from ServiceNow using which you can define the mapping of data between ServiceNow and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users are mostly required to only map any custom fields that are added to the ServiceNow incident.

1. To begin configuring data ingestion, click Configure Data Ingestion on the ServiceNow connector’s "Configurations" page.
   Click Let’s Start by fetching some data, to open the “Fetch Sample Data” screen.
   
   Sample data is required to create a field mapping between ServiceNow data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.
2. On the Fetch Data screen, provide the configurations required to fetch ServiceNow data.
   Users can choose to pull data from ServiceNow by specifying the table name from which they want to pull incidents from ServiceNow. You can also specify a query using which you can filter data retrieved from ServiceNow and can also specify additional parameters such as the maximum number of incidents to be fetched, and the last X minutes in which the incidents have been updated in ServiceNow. The fetched data is used to create a mapping between the ServiceNow data and FortiSOAR™ incidents.
   
   Once you have completed specifying the configurations, click Fetch Data.

3. On the Field Mapping screen, map the fields of a ServiceNow incident to the fields of an incident present in FortiSOAR™.
   To map a field, click the key in the sample data to add the “jinja” value of the field. For example, to map the state parameter of a ServiceNow incident to the status parameter of a FortiSOAR™ alert, click the Status field and then click the state field to populate its keys:
   
   For more information on field mapping, see the Data Ingestion chapter in the "Connectors Guide" in the FortiSOAR™ product documentation. Once you have completed the mapping of fields, click Save Mapping & Continue.

4. Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to ServiceNow, so that the content gets pulled from the ServiceNow integration into FortiSOAR™.
   On the Scheduling screen, from the Do you want to schedule the ingestion? drop-down list, select Yes.
   In the “Configure Schedule Settings” section, specify the Cron expression for the schedule. For example, if you want to pull data from ServiceNow every morning at 5 am, click Daily, and in the hour box enter 5 , and in the minute box enter 0:
   
   Once you have completed scheduling, click Save Settings & Continue.

5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.