ServiceNow alert method

Reading time: 0 minute(s) (0 words)

Using this method, Nobl9 automatically creates a ServiceNow event whenever your SLO reporting meets the conditions defined in your alert policy. You can also use this method for manually configured no-data anomaly notifications. If the generated event qualifies for a ServiceNow alert, the notification is sent.

Prerequisites

The ServiceNow alert method integration with Nobl9 requires the following prerequisites:

1. Authentication details. Your ServiceNow alert method must be linked to a ServiceNow instance. Nobl9 connects to your target instance and creates events there. To find your required instance name, check its <instanceURL>/stats.do page. You can authenticate to your target instance using one of the two authentication methods:

   • Basic authentication requires your ServiceNow user account credentials.
   • Token-based authentication requires a ServiceNow REST API key token.

2. A dedicated Access Control List.
   To integrate ServiceNow with Nobl9, set up an Access Control List (ACL) for your ServiceNow users.

   Required permissions

   To create a new ACL, you must have the security_admin permission assigned.

   Configure the new ACL with the following values:

   • Type: record
   • Operation: create
   • Name: Event [em_event]
   • Requires role: Assign new/existing role

   After submitting your new ACL, assign the following roles to the users who must have access to the ServiceNow integration with Nobl9:

   • api_event_create
   • at least evt_mgmt_integration level role

For more details on ACLs, see ServiceNow documentation.

Adding the ServiceNow alert method

You can add the ServiceNow alert method directly in the Nobl9 Web application.

Alternatively, utilize the SLOs-as-code approach by:

• Applying an alert method YAML configuration with the sloctl apply command.
• Configuring the ServiceNow alert method definition programmatically using the Nobl9 Terraform provider.

Nobl9 Web

1. Navigate to Integrations > Alert methods.
2. Click .
3. Select ServiceNow.

4. Select the authentication method: Basic (default) or Token.
   • Depending on the selected method, enter your ServiceNow account credentials or the REST API token (mandatory).

Changing the authentication method

Changing the authentication method replaces the values in the Username and Password or ServiceNow REST API token fields with masked placeholders. If you want to save the changes, re-enter the original credentials or token, or provide the values for the newly selected authentication method.

5. Enter your target Instance name (mandatory).
   For more information, refer to the Authentication section.

6. Select a Project (mandatory).
   Projects provide the structure for organizing Nobl9 resources and managing access permissions.
   If a project is not specified, Nobl9 assigns the default project value automatically.
7. Enter a Display Name (optional).
   Spaces are allowed.
8. Enter a Name (mandatory).
   It can only contain lowercase, alphanumeric characters, and dashes (for example, my-alert-method-1). Nobl9 auto-populates this field based on the display name you enter, transforming it into the supported format. You can edit the result.
9. Enter a Description (optional).
   Provide extra details, such as the purpose and responsible personnel.
   Up to 1050 characters.

10. Configure Alert resolution (optional) to receive a closing event when a no-data anomaly resolves or, for alert policy notifications, after the cooldown period is over.
    The optional message will be sent in the closing event notification.

11. Click Add alert method.

ServiceNow event severity mapping

For alert policy notifications, Nobl9 maps the alert policy severity to a ServiceNow event severity:

ServiceNow	Nobl9
Warning	Low
Minor	Medium
Major	High

Event field properties populated in ServiceNow events

For alert policy notifications, Nobl9 populates the ServiceNow event fields as follows:

Name	Populated Value
em_event.source	[Source]: Nobl9
em_event.node	[Node]: Service display name and/or name
em_event.type	[Type]: Alert or Test (in case of test notification)
em_event.resource	[Resource]: SLO display name and/or name
em_event.resolution_state	[Resolution state]: New
em_event.state	[State]: Ready
em_event.description	[Description]: • SLO display name and/or name • Alert policy display name and/or name • Objective display name and/or name • Project display name and/or name • Organization name • Service display name and/or name
em_event.additional_info	[Additional Information]: • Service name • SLO name • SLO details link • Alert policy conditions • Labels for SLO, service, alert policy, project (if defined)
metric_name	[Metric Name]: Alert ID
em_event.severity	[Severity]: Alert policy severity

No data anomaly notifications

To receive no-data notifications in ServiceNow, select your ServiceNow alert method under No data anomaly alert in the SLO wizard. Set the time Nobl9 should wait for data before sending a notification. You can also configure this in the SLO YAML or with Terraform. See No data manual configuration.

Enable Alert resolution on the ServiceNow alert method to receive a closing event when the anomaly resolves. In YAML, include sendResolution: {} under spec.servicenow to enable resolution notifications without a message, or set spec.servicenow.sendResolution.message to include a custom message. If you omit spec.servicenow.sendResolution, Nobl9 sends only the detection event.

No-data events use the following fields:

Field	Value
source	Nobl9
node	Service display name or name
type	Anomaly
resource	SLO display name or name
severity	3 (Minor)
resolution_state	New on detection; Closing on resolution
state	Ready
metric_name	Anomaly ID
message_key	A key shared by detection, retries, and resolution for the same anomaly and alert method

The message_key stays the same if you move the SLO to another project while keeping the same alert method. This lets ServiceNow correlate the detection and closing events.

The event description includes the anomaly status, SLO, objective, project, organization, service, configured no-data duration, and last fetched data point timestamp. The additional_info JSON includes:

• service, slo, and sloDetailsLink
• anomalyType (NoData) and anomalyStatus (Detected or Resolved)
• noDataAlertAfter and lastFetchedDataPoint
• labels for the SLO, service, and project, when defined
• resolutionMessage on closing events, when a message is configured

The SLO details link opens a custom time range. For detection events, the range runs from the last received data point to anomaly detection. For closing events, it runs from anomaly detection to resolution.

YAML configuration

General YAML

General YAML sample for ServiceNow alert method

apiVersion: n9/v1alpha
kind: AlertMethod
metadata:
  name: servicenow-notification # Mandatory
  displayName: string # Optional
  project: default # Mandatory
  # Optional
  # The key value: only alphanumeric characters, `-`, `_`, or `.` are allowed.
  # The key value must start and end with an alphanumeric character.
  # An optional DNS subdomain prefix followed by `/` is allowed.
  annotations:
    key: value
spec:
  description: string # Optional
  servicenow:
    # Provide exactly one authentication method: either basic (username/password) or token-based (apiToken).
    # Basic authentication (default example; use these fields for basic auth):
    username: string # Required for basic authentication
    password: string # Required with username, secret
    # Token-based authentication (alternative to basic auth; use this instead of username/password):
    # apiToken: string # Required for token-based authentication, secret
    instanceName: string # Mandatory
    sendResolution:
      message: string

Working YAML: basic auth

Working YAML sample for ServiceNow alert method with the basic authentication method

apiVersion: n9/v1alpha
kind: AlertMethod
metadata:
  name: servicenow
  displayName: ServiceNow method with basic auth
  project: default
  annotations:
    area: latency
    env: prod
    region: us
    team: sales
spec:
  description: Sends HTTP request to ServiceNow using basic authentication
  servicenow:
    username: Sam
    password: secret
    instanceName: servicenow-instance-name
    sendResolution:
      message: Alert is now resolved

Working YAML: token-based auth

Working YAML sample for ServiceNow alert method with the token-based authentication method

apiVersion: n9/v1alpha
kind: AlertMethod
metadata:
  name: servicenow
  displayName: ServiceNow method with token auth
  project: default
  annotations:
    area: latency
    env: prod
    region: us
    team: sales
spec:
  description: Sends HTTP request to ServiceNow using API token authentication
  servicenow:
    apiToken: servicenow-rest-api-token
    instanceName: servicenow-instance-name
    sendResolution:
      message: Alert is now resolved

Testing alert methods

You can test alert methods for all notification services supported by the Nobl9 platform through the UI.

To verify the correctness of your alert method configuration:

1. Navigate to Integrations > Alert methods.
2. Click the required alert method.
   Its Details page opens.
3. Click Test under the alert method name:
   
   
   • When the configuration is correct, Nobl9 displays Test completed successfully! under the button.
   • Otherwise, the Test failed message appears. It contains the details of incorrect settings.

Useful links

Check out these related guides and references:

ServiceNow alert methodTerraform provider