1. Home
  2. Integrations
  3. VictorOps to ServiceNow Integration Guide

VictorOps to ServiceNow Integration Guide

This integration is currently in BETA. If you have any questions, concerns or feedback please contact victorops-support@splunk.com.

The ServiceNow Enterprise Suites integration enables incidents and incident updates from the VictorOps timeline to be reflected in ServiceNow.

ServiceNow Versions Supported

Istanbul, Jakarta, Kingston, London, Madrid

  • ServiceNow Account: Requires SNOW Administrative Privileges to create the application registry and an Active, “Web Service Access” only user
  • VictorOps Version Required: Full Stack level of Service
  • Need to Know: Currently manual incident creation in VictorOps will not send to SNOW

In ServiceNow

Create Application Registry

As an admin, navigate to System OAuth >> Application Registry and select New.

Click Create an OAuth API endpoint for external clients

Fill in the required fields:

  • Name: VictorOps
  • Client ID: defined automatically
  • Client Secret: Create your own or leave blank to have a secret generated for you upon saving.

Click Save.

Create a User

Create or select an active user with Web service access only. This user will serve as the conduit for the integration between VictorOps and ServiceNow incidents.

Create Roles for User

Once you’ve created a User you’ll want to assign that User three specific roles with ServiceNow. From the Roles Collection, select itil, itil_admin, and personalize_choice.

To do this please select the User in question, and then select the edit button from the Roles tab as depicted below.

From the Roles Collection, select itil, itil_admin, (these let VictorOps update tickets after ServiceNow ingestion) and “personalize_choice” lets us get the list of ServiceNow ticket states for State Mappings.

In VictorOps

As an admin, navigate to Settings >> Alert Behavior >> Integrations >> ServiceNow (Enterprise Suites).

Click Enable Integration

Referring to the details of your System OAuth Application Registry previously created in ServiceNow, copy and paste the details into the respective fields in VictorOps. Your Host is found as the sub-domain in your SNOW URL bar:

The integration also requires a client username and password. If there is not one available, create one using the ServiceNow user section. If the user will only be used for integration purposes, the user can be marked as non-interactive in the user account record.

Click Connect to ServiceNow.

Incident State Mapping

To update VictorOps incident states and conditions within ServiceNow, select the Edit Integration. Here you may also reconfigure your ServiceNow Connection Details.

Mapping ServiceNow Assignment Groups

Upon validating credentials, you should now be able to map VictorOps Escalation Policies to ServiceNow Assignment Groups.

Select Add Mapping to see available choices.

When the mapping is set, the ServiceNow Assignment Group field will be updated based on the Escalation Policy being paged. This field will also update when an incident is rerouted to another Escalation Policy. If the incident reroutes to a specific user, the assignment group will be cleared.


Next, navigate to Settings >> Alert Behavior >> Transmogrifier. Two alert rules will need to be created to complete the integration.

First, add a rule which defines a matching condition on which to send VictorOps incidents to ServiceNow. For example, to send all critical incidents to ServiceNow, use “when message_type matches CRITICAL then transform ServiceNow_Integration to true“. If an incident in ServiceNow has mandatory fields, these fields must also be added in this rule with the syntax ‘transform ServiceNowCustomField_<field_name> to ${{victorops_field_name}}‘. For ServiceNow field name syntax, see below.

Last, create a rule for when monitoring_tool matches ServiceNow then transform ServiceNow_Integration to false. This rule prevents infinite loops between VictorOps incidents and ServiceNow incidents — this is required if the ServiceNow (legacy) integration is enabled.

Supplemental Field Syntax

When passing additional fields to ServiceNow from VictorOps beyond what is included out of the box (perhaps for a mandatory field) a special syntax must be employed using the Transmogrifier. For each field, the underlying field name first needs to be determined within ServiceNow.

In the Transmogrifier, these fields are referenced as ServiceNowField_<field_name> and may be assigned any desired value. See field expansion for more tips on dynamic assignment.

Updated on April 26, 2019

Was this article helpful?

Related Articles