A Quick Service Now Exercise - How can I search for an incident?

InsightConnect
1
  1. I want to match a string in the short description. This is a simple hash value that comes from the trigger JSON body.
    I keep using short_description = {threat.filecontenthash} and it comes up with nothing.

I even see where the query should be matching the string, yet it does not.

EDIT: It works when I first put the {threat.filecontenthash} in a artifact. Then I match against that string. SMH

  1. How can you NOT filter the results of a Read Incident step in the SNOW plugin?
    In other words I do not want to filter at all, just want the whole enchilada.
2

For searching incidents I usually create the search in SNOW and then copy it over to ICON. I think you can right click on the search and get the fields.

For reading an incident the fields you wan to return is required so there is no current way to return all fields.

1 Like
3

Thanks Eric. About to try that. The new issue is short_description=hashANDassignment_group=groupiwant is not matching.

4

That was it Eric, mostly. ^AND

found by copying the query and also trying the example input in icon.

Now I just need to figure out how to do a path decision based on if the search was a success lol.

{{[“Search for Existing Tickets”].[system_ids]}} != “”

That does not work. I want to determine if any system ids were returned or not.

5

You can use length to determine if any IDS were returned. This works best when looking at arrays.

Example: length({{[Search For Sale].[sale_posting]}}) = 0 or length({{[Search For Sale].[sale_posting]}}) < 1

docs: Format Query Language | InsightConnect Documentation

1 Like
6

That did it!