Create Service Now ticket from New Investigation

Hey All,
I Currently have this workflow working, I am looking into if anyone has worked out what variable is required to populate the “Caller ID” with the Affected user dynamically as requests come in? It looks to me like the Info should be {{[“Alert Trigger”].[actors].[users]}} although this currently leaves my tickets with no caller ID. would anyone else be having this issue?

This field in ServiceNow is called User ID. It is found under the sys_user table.

Screenshot 2024-07-03 at 8.09.04 AM

Assuming an email address is something you are able to get from your alert payload, or in a later step with something like an LDAP query, you can pass the email to ServiceNow Search CI plugin step.

The ServiceNow search CI action does return data, but so far it is only returning all data from the table, not the specific search I am looking for. With all data being returned it is still possible to parse out what you are looking for though. I am attaching a snippet that you can test it with.

The Snippet has an input section, that is where you would pass the email to.

It then uses JQ plugin that will lookup the email, find out of all returned data a match, and then return the username for the matched user email.

I was having an issue if the case didn’t match the email exactly, but managed to get around that with the help of @Eric-Wilson.

The file says .icon, but it needs to be changed to .snpt in order to upload as a snippet and use it. Let me know if that solves your issue.

I don’t know how ServiceNow works, but if the caller receives an email confirmation when they submit a ticket, maybe having the impacted user being the caller wouldn’t be the best option. You could setup a user that is tied to ICON automation created tickets, and put the user attributed in another field. Again though, I don’t know if that is even an issue in your scenario.

ServiceNow.icon (4.6 KB)

Hey Darrick,

I am looking into the Snippert now, How do you get the Workflow to run the Snippert so it is all automated?

Currently, There is as IDR Investigation created, IT is picked up by a webhook and it then creates a SNOW ticket.

Somewhere in the middle i want this snippert to then find the USER NAME (which the workflow has) and place it as the user.

At this point, i want to alert the user that there is an investigation on their account so we get a layer of visibility to the users.

You would need to add the Snippet into your environment first. Once it is added into your environment then you decide where in your workflow you want to use it.

Select a new step type

Choose Snippet

Name the step

Choose the snippet that you imported

In the User Email input section you would choose the email address to lookup.

Screenshot 2024-07-08 at 3.38.37 PM

Sorry about the delayed response. I was out on vacation. Let me know if this makes sense.