IntegrationService: ServiceNow Integration...TableofContents Introduction 1...

Integration Service: ServiceNowIntegrationVersion 1.3.0

Table of Contents

Introduction 1List of Applications Included 1Incident Sync Solution Prerequisites 2Version Prerequisites 2Installation Prerequisites 2

CMDB Sync Solution Prerequisites 3Version Prerequisites 3Installation Prerequisites 3

Incident Sync Integration 4Installing the ScienceLogic Update Set in ServiceNow 5Installing the ServiceNow PowerPack 7Event Data Flow: Integration Service to ServiceNow 8Event Data Flow: SL1 to Integration Service 10Validating Network Communications 11Checking DNS 11Checking HTTPS and JSON 12HTTP Codes 12

Creating a ServiceNow Group 13Creating a ServiceNow User 14

Creating an Integration Service Credential 16Configuring Run Book Automation 18Aligning Run Book Action Snippet Credentials 19Enabling Run Book Action Policies 19Customizing Run Book Action Policies 21Enabling Run Book Automation Policies 24

Incident Sync Setup 25Viewing Incidents and Events 26Hyper-linking Events 28ServiceNow Hyper-linking 28

Viewing the Incident Import Table in ServiceNow 29ServiceNow, ScienceLogic Event, and Incident Priority Matrix 30Adding Additional Fields to the Transform Map 33

CMDB Sync Integration 39Installing the ScienceLogic Update Set in ServiceNow 39Manually Running the Hierarchy Delete and Configuration Hierarchy Jobs 41Installing the ScienceLogic Identification Engine Update Set in ServiceNow 42Installing the CMDB Plugin on ServiceNow 43The ServiceNow CMDB Identification and Reconciliation Module 44CMDB Sync Integration Setup 45Mapping SL1 Organizations to ServiceNow Companies 45Mapping SL1 Devices to ServiceNow 45

Introduction

Chapter

1Introduction

Overview

This manual describes how to configure the Integration Service solution for ServiceNow integration. Theintegration includes the Incident Sync and Configuration Management Database (CMDB) Sync solutions.

This chapter covers the following topics:

List of Applications Included 1

Incident Sync Solution Prerequisites 2

Version Prerequisites 2

Installation Prerequisites 2

CMDB Sync Solution Prerequisites 3

Version Prerequisites 3

Installation Prerequisites 3

List of Applications Included

The following integration applications are included with the ServiceNow integration:

l Bulk Update ScienceLogic Events

l Cache ServiceNow CIs and ScienceLogic Device Classes

l Cache ScienceLogic Devices using GraphQL

l Cache ScienceLogic Devices using REST

l Cache ServiceNow CI entries

1

1

2

l Clear ServiceNow Device Cache

l Create or Update ServiceNow Incident from ScienceLogic Event

l Create ServiceNow CI

l Delete ServiceNow CIs

l Delete a Single Interface CI from ServiceNow

l ScienceLogic To ServiceNow Device Sync using GraphQL

l ScienceLogic To ServiceNow Device Sync using REST

l Sync ServiceNow Incident State to ScienceLogic Event

l Template App

l Update ServiceNow Incident when ScienceLogic Event is Acknowledged

l Update ServiceNow Incident when ScienceLogic Event is Cleared

Incident Sync Solution Prerequisites

This section describes the prerequisites that apply when you integrate ServiceNow with the ScienceLogic platformusing the Incident Sync solution.

Version Prerequisites

The ScienceLogic ServiceNow Incident Sync integration solution requires you to run the following minimumversions of the platforms:

l The ScienceLogic platform version 8.7.0 or newer

l ServiceNow version Kingston or newer with Web Services enabled

Installat ion Prerequisites

To install the ScienceLogic ServiceNow Incident Sync integration solution, you must have administrator access toboth the the ScienceLogic platform Management Platform and ServiceNow. Specifically, you will need:

l ScienceLogic root SSH access

l ScienceLogic administrator access to the Administration Portal

l ServiceNow administrator access

You must also have TCP ports 80, 443, and 7706 open on the Integration Service for communication to theScienceLogic platform and the ServiceNow instance. No inbound TCP ports are required to be open.

ScienceLogic highly recommends that you disable all firewall session limiting policies. Firewalls will drop HTTPSrequests, which results in data loss.

Introduction

Introduction

Finally, you must install the following files:

l Install the ServiceNow Base Pack in the ScienceLogic platform

l Install the ScienceLogic Update Set in ServiceNow

CMDB Sync Solution Prerequisites

This section describes the prerequisites that apply when you integrate ServiceNow with the ScienceLogic platformusing the CMDB Sync solution.

Version Prerequisites

The ScienceLogic ServiceNow CMDB Sync integration solution requires you to run the following minimumversions of the platforms:

l The ScienceLogic platform version 8.7.0 or newer

l ServiceNow version Kingston or newer with Web Services enabled

Installat ion Prerequisites

To install the ScienceLogic ServiceNow CMDB Sync integration solution, you must have administrator access toboth the ScienceLogic platform Management Platform and ServiceNow. Specifically, you will need:

l ScienceLogic root SSH access

l ScienceLogic administrator access to the Administration Portal

l ServiceNow administrator access

You must also have TCP ports 80, 443, and 7706 open on the Integration Service for communication to theScienceLogic platform and the ServiceNow instance. TCP port 443 inbound needs to be open for the run bookaction on the platform to trigger Integration Service applications that perform incident-related tasks.

ScienceLogic highly recommends that you disable all firewall session limiting policies. Firewalls will drop HTTPSrequests, which results in data loss.

Finally, you must perform the following steps in ServiceNow:

l Install the ScienceLogic Update Set

l Install the ScienceLogic Identification Engine Update Set

l Activate the Configuration Management for Scoped Apps (CMDB) plug-in

3

1

Incident Sync Integration

Chapter

2Incident Sync Integration

Overview

This chapter describes how to configure the ScienceLogic platform and ServiceNow to use the Incident SyncIntegration Solution.

NOTE: For information about version and installation prerequisites for the Incident Sync Integration Solution,see the Introduction chapter.


Installing the ScienceLogic Update Set in ServiceNow 5

Installing the ServiceNow PowerPack 7

Event Data Flow: Integration Service to ServiceNow 8

Event Data Flow: SL1 to Integration Service 10

Validating Network Communications 11

Checking DNS 11

Checking HTTPS and JSON 12

HTTP Codes 12

Creating a ServiceNowGroup 13

Creating a ServiceNow User 14

Creating an Integration Service Credential 16

Configuring Run Book Automation 18

Aligning Run Book Action Snippet Credentials 19

4

2

5

Enabling Run Book Action Policies 19

Customizing Run Book Action Policies 21

Enabling Run Book Automation Policies 24

Incident Sync Setup 25

Viewing Incidents and Events 26

Hyper-linking Events 28

ServiceNow Hyper-linking 28

Viewing the Incident Import Table in ServiceNow 29

ServiceNow, ScienceLogic Event, and Incident Priority Matrix 30

Adding Additional Fields to the TransformMap 33

Installing the ScienceLogic Update Set in ServiceNow

The ServiceNow Update Set is the only component that you must install on the ServiceNow instance. An updateset is an XML file containing a group of customizations that can be moved from one ServiceNow instance toanother.

NOTE: To ensure that incidents are linked to a configuration item (CI), you must run the ScienceLogic ToServiceNow Device Sync using GraphQL integration application on a fresh Integration Servicesystem at least twice before running Incident Sync.

Retrieve the update set from your representative and download the file. Click the file name for the update set XMLto download the set to your computer.

To install the ScienceLogic update set in ServiceNow:

1. Log in to ServiceNow as an administrator, then navigate to System Update Sets > Retrieved Update Setson the left menu.

2. Click Import Update Set from XML.



3. Click the [Choose File] button, then navigate to the update set XML file you downloaded. Select the XML fileand click [Upload].

4. After the file is imported, the Retrieved Update Sets page appears. Click the ScienceLogic update set andthen click [Preview Update Set].

5. After the preview set runs, a status page appears. "Success" appears in the Completion code field.

WARNING: If "Success" does not appear in the Completion code field, contact ScienceLogic Support toassist with reviewing any conflicts that might exist. Do not proceed until all conflicts are resolvedand "Success" appears in the Completion code field.

6. Click Commit Update Set to apply the changes in the update set to your ServiceNow system. AScienceLogic option is added tothe ServiceNow left menu.

6

2

7

Installing the ServiceNow PowerPack

For the ScienceLogic ServiceNow Incident Sync integration solution, you must install the most recent version of theServiceNow Base Pack.

NOTE: If you are upgrading from SyncServer, you must disable the old SyncServer Run Book Actions and RunBook Automation policies before installing the new ServiceNow Base Pack.

To install the ServiceNow Base Pack:

1. Log in to the ScienceLogic platform as an administrator, then navigate to the PowerPack Manager page(System >Manage > PowerPacks).

2. Click [Actions] and select Import PowerPack.

3. Click [Browse]and navigate to the ServiceNow Base Pack file.

4. Select the PowerPack file and click [Import].



5. The PowerPack Installermodal page displays a list of the PowerPack contents. Click the [Install] button.

6. After the installation is complete, the ServiceNow Base Pack appears on the PowerPack Manager page.

Event Data Flow: Integration Service to ServiceNow

The following chart and steps illustrate the event data flow from the Integration Service to a ServiceNow instance:

1. Workers are subscribed to the Integration Service task queue.

2. When a new event to be synced is placed on the Integration Service task queue, it is assigned and pushed toa worker.

8

2

9

3. The worker processes and transforms the necessary ScienceLogic event data into a ServiceNow incident andPOSTs the incident to the ServiceNow endpoint.

l If the resulting status code matches the expected status code for the request, the original message isacknowledged and removed from the queue.

l If the worker crashes while processing the event, the queue senses the unexpected disconnect, andthe same event message is re-delivered to a new worker.

NOTE: The above results are performed through the "late acknowledgment" of tasks. With this settingenabled, an Integration Service worker will not remove a message from the queue until the messagehas been fully processed by the worker. This setting can be enabled or disabled with the environmentvariable "task_acks_late".

4. If ServiceNow responds with an unexpected status code when POSTing the incident, the message will beplaced back in the queue with specified re-try parameters.

NOTE: You can configure re-try parameters on a per-task basis. You may want to manually alter your re-tryparameters for tasks depending on the action the task is taking. The configuration of retries includesthe maximum number of times a task is retried after consistently failing, and the delay length betweenretries.



Event Data Flow: SL1 to Integration Service

The following chart and steps illustrate the event data flow from SL1 to the Integration Service:

1. The ScienceLogic platform identifies an event that should be synced to ServiceNow.

2. A Run Book Action executes a POST action to the Integration Service API to let the Integration Service knowthat an integration should be run to sync the event.

l If the Run Book Action? is successful and the POST responds with a 200, then the event data is storedin the Integration Service queue for syncing.

l If the POST does not respond with a 200, then the Run Book Action inserts the missed event into atable in the ScienceLogic database so that it can be retrieved later.

3. In parallel, a scheduled Integration Service event continuously checks the ScienceLogic database for anymissed events. If any missed events are found, they will be pulled from the database and inserted into theIntegration Service queue.

NOTE: The Integration Service queue is persistently saved to disk, so if the Integration Service stopsunexpectedly, any events that existed in the queue prior to the failure will still exist in the queue afterthe Integration Service is running again.

10

2

11

4. Missed are not removed from the ScienceLogic database until after they are inserted into the IntegrationService queue.

Validating Network Communications

All communication between ScienceLogic and ServiceNow is done through TCP port 443. To allowcommunication between ScienceLogic and ServiceNow, the ScienceLogic Database Server, Data Collector, orAll-In-One Appliance must have external access to the ServiceNow instance. No inbound TCP ports are requiredto be open to the ScienceLogic server. Outbound communication may use NAT or be direct.

NOTE: All firewall session-limiting policies must be disabled. If firewall session-limiting policies are enabled,HTTPS requests might be dropped by the firewall, resulting in data loss. Check with your security orfirewall administrator to make sure there are no session limiting policies on TCP port 443 for yourScienceLogic servers.

Checking DNS

Because ServiceNow is a cloud-based service, DNS must be configured on all ScienceLogic servers thatcommunicate with your ServiceNow instance.

NOTE: ServiceNow instances are generally named as: your-instance.service-now.com, where your-instance is the name of your ServiceNow server. The examples below usemycompany.service-now.com. Your instance name will be unique to your subscription.

To validate that your ScienceLogic server has proper DNS name resolution configured, test network connectivityand name resolution using the nmap command, which is available from the command line of any ScienceLogicserver:

nmap -sT -p 443 mycompany.service-now.com

If the test was successful, you will see a message similar to the following:

Starting Nmap 5.51 ( http://nmap.org ) at 2013-11-12 20:22 UTCNmap scan report for mycompany.service-now.com (199.91.136.100)Host is up (0.067s latency).PORT STATE SERVICE443/tcp open https

If domain name resolution fails, you will see a message similar to:

Failed to resolve given hostname/IP: mycompany.service-now.com.



Checking HTTPS and JSON

You can administer a simple test to determine if the ServiceNow JSON Plug-in web service is configured andoperating using the Basic Authentication method on your ServiceNow instance. To do so, run the followingcommand from the ScienceLogic Central Database or All-In-One Appliance:

NOTE: In the example below, replace the admin:admin username and password key/value pair with yourServiceNow administrator username and password and mycompany.service-now.com with yourServiceNow instance name.

curl --location -vu admin:admin -H "Accept: application/json" -H "Content-Type:application/json"'https://mycompany.service-now.com/api/now/table/incident'

If not successful, the following message appears:

HTTP/1.1 401 Unauthorized

If successful, a JSON encoded string starting with the "result" variable appears:

{"result":[{"upon_approval":"","location":"1083361cc611227501b682158cabf646",….

HTTP Codes

HTTP codes are necessary for identifying specific problems. The following table lists typical HTTP codes that mightoccur when testing the ServiceNow JSONWeb Service.

Code Definition

401 Unauthorized. Check that the username and password are correct and properly formatted.

403 Forbidden. ServiceNow understood the request, but either the URL is incorrect, or the user accountdoes not have permission to see the requested object.

404 The ServiceNow server has not found anything matching the requested URL. Check to make sure thereis data in the target table.

200 Success.

201 Success. Data is posted.

TIP: For more information about the ServiceNow JSONWeb Service and the Table API, seehttp://wiki.servicenow.com/index.php?title=Table_API. If you continue to have problems, please contacteither ScienceLogic or ServiceNow customer support.

12

2

http://wiki.servicenow.com/index.php?title=Table_API

13

Creating a ServiceNow Group

For best practice and security, create a dedicated ServiceNow account that has restricted access to only thegroups, access control lists (ACLs), and roles needed for ScienceLogic incident management.

To create a ServiceNow Account for ScienceLogic Incident management:

1. In ServiceNow, go to the Groups page (User Administration > Groups).

2. Click [New]. ANew record page appears.

3. In the New record page, type the group name and any additional information. Name is the only requiredfield.

4. Right-click the Group bar and click Save to save the record.

5. At the bottom of the Group form, select the [Roles] tab and click [Edit].



6. Search for ScienceLogic Admin and move it to the right-hand column using the arrow buttons. Click [Save].

When finished, your Group will have an assigned Role.

Creating a ServiceNow User

To create a ServiceNow Account for ScienceLogic Incident management:

1. In ServiceNow, go to the Users page (User Administration > Users).

2. Click [New].

14

2

15

3. In the New record page, complete the following fields:

l User ID. Type a user ID.

l First Name. Type the user's first name.

l Last Name. Type the user's last name.

l Password. Type a password.

l Active. Select this checkbox.

l Web Service Access Only. Select this checkbox.

l Time Zone. SelectGMT.

l Date Format. Select System (yyyy-MM-dd).

4. Right-click the header and click Save to save the user.

5. Select the [Groups] tab at the bottom of the record.

6. Find the group you created previously and move the group to the right-hand column using the arrow buttons.Click [Save].



After the user has been added to the group, you should see their Roles and Groups in their record.

NOTE: See the Create a User page of the ServiceNow Product Documentation for more information oncreating a ServiceNow user account.

Creating an Integration Service Credential

To configure the ScienceLogic platform to communicate with ServiceNow, you must first create a SOAP/XMLcredential. This credential allows the Run Book Automation scripts and the Dynamic Applications in theServiceNow Base Pack PowerPack to connect with your ServiceNow instance. An example SOAP/XML credentialthat you can edit for your own use is included in the ServiceNow Base Pack PowerPack.

To create a SOAP/XML credential to access the Integration Service:

1. Go to the Credential Management page (System >Manage > Credentials).

2. Locate the ServiceNow RBA - Example credential, then click its wrench icon ( ). The Edit SOAP/XMLCredentialmodal page appears.

16

2

http://wiki.servicenow.com/index.php?title=Creating_Users_and_Associating_to_a_Group#Creating_a_User

17

3. Complete in the following fields:

l Profile Name. Type a new name for the ServiceNow credential.

l Content Encoding. Make sure text/xml is selected.

l Method. Make sure POST is selected.

l HTTP Version. SelectHTTP/1.1.

l URL. Type the URL for your Integration Service instance.

l HTTP Auth User. Type the username of your Integration Service instance.

l HTTP Auth Password. Type the password of your Integration Service instance.

l Timeout. Type "5".

4. Click [Save As].

5. When the confirmation message appears, click [OK].



Configuring Run Book Automation

You can configure Run Book Automation to ensure that whenever the ScienceLogic platform detects an event, acorresponding incident is created or updated in ServiceNow.

The ScienceLogic platform features three Run Book Action policies that facilitate this process:

l ServiceNow: Add/Update Incident

l ServiceNow: Event Acknowledged

l ServiceNow: Event Cleared

Each Run Book Action policy calls a single action in the ScienceLogic platform. Ensure that the integrationapplication points to the relevant ScienceLogic system and ServiceNow instance. The action then calls anintegration application on the Integration Service that determines the workflow to execute.

18

2

19

Events in the ScienceLogic platform frequently occur and resolve due to fluctuations in the network and otherchanging conditions. However, the Run Book Action policies above use a de-duplication algorithm whereby only asingle open ServiceNow incident exists per device. Therefore, if a device already has an existing ServiceNowincident, the following updates are made to the ServiceNow incident record:

l The "Work Notes" activity log in the incident record is updated with information about the secondary event(s).

l If a secondary event is of a higher severity than the event that originally created the ServiceNow incident, thenthe Impact, Urgency, and Priority fields are updated automatically in the ServiceNow incident record. If thesecondary event is of a lesser severity, those fields are not updated.

l If an event is cleared in the ScienceLogic platform and then later reoccurs before the incident has been"Closed" in ServiceNow, then the subsequent events appear in the original ServiceNow incident record forthat device. If an incident record has been "Closed," then ServiceNow will create a new incident record whena cleared event reoccurs in the ScienceLogic platform.

l By default, if an event is acknowledged in the ScienceLogic platform, the ServiceNow incident record will beupdated with the work notes and the acknowledging user. Clearing a ScienceLogic event will move theServiceNow incident record state to "Resolved". If all ScienceLogic events associated with a ServiceNowincident record are clear, the ServiceNow incident record will, by default, move to a "Resolved" state.

NOTE: You can edit the Run Book Action Snippet code to adjust the behavior for changing states when aScienceLogic event is acknowledged or cleared.

Aligning Run Book Action Snippet Credentials

The Run Book Automation policy is initially aligned to an example credential. You will need to align the previouslycreated credential to the Run Book Action.

Enabling Run Book Act ion Polic ies

The ServiceNow Run Book Action policies are disabled on the ScienceLogic platform by default. To enable them,you must enable and align the ServiceNow credential to each policy.

To enable Run Book Action policies:

1. Log in to your ScienceLogicAdministration Portal as an administrator, and then go to the Action PolicyManager page (Registry > Run Book > Actions).

2. Locate the ServiceNow: Add/Update/Clear Incident policy and click its wrench icon ( ).



3. The Action Policy Editor page appears. Complete the following fields:

l Action State. Select Enabled.

l Snippet Credential. Select the credential that you created in the section Creating an IntegrationService Credential.

l Snippet Code. If you want to customize the Run Book Action script, make changes as necessary. Formore information, see the section Customizing Run Book Action Policies.

4. Click [Save].

20

2

21

Customizing Run Book Act ion Polic ies

You can customize several default values that are embedded into the ScienceLogic Run Book Action snippets forServiceNow.

To edit Run Book Action snippets:

1. Log in to your ScienceLogicAdministration Portal as an administrator and go to the Action Policy Managerpage (Registry > Run Book > Actions).

2. Click the wrench icon ( ) of the Run Book Action you want to edit. The Policy Editormodal page appears:

3. Edit the Snippet Code as necessary, using the information that follows as a guide. When you are finished,click [Save].

CAUTION: ScienceLogic Run Book Action snippets are written in Python. In the event of a syntax error, thepolicies will no longer run. As a result, you must ensure that all edits adhere to Python standards.

TIP: True and False options are case-sensitive and must not contain quotes.



Customizing the "Add/Update/Clear Incident" Run Book Action Script

NOTE: Previous SyncServer users had three separate Run Book Action scripts for add/update, acknowledge,and clear. These have been rolled into a single Run Book Action in the Integration Service, but thereare still three Run Book policies.

You can customize the following items in the "ServiceNow: Add/Update/Clear Incident" Run Book Action snippetcode:

l CORRELATION_TYPE = 5

o This is an integer value and possible values are 1, 2, 3, 4, or 5. Default value is 5.

o All RBA Scripts should use the same value, otherwise correlation will fail.

o 1 = Correlate all duplicate incidents by ScienceLogic ID only.

o 2 = Correlate all duplicate incidents by Event Policy ID only.

o 3 = Correlate all duplicate incidents by device ID only.

o 4 = Correlate all duplicate incidents by Interface ID only. NOTE: This correlation requires that theScienceLogic event has an interface aligned. If there is no interface aligned to the event, the returnedInterface ID will be 0.

o 5 = Correlate all duplicate incidents by device ID and Event Policy ID.

l NEW_SNOW_STATE = 1

o This is an integer value and possible values are 1, 2, 3, 6, 7, or 8. Default value is 1.

o 1 = Incident state is "New".

o 2 = Incident state is "In Progress".

o 3 = Incident state is "On Hold".

o 6 = Incident state is "Resolved".

o 7 = Incident state is "Closed".

o 8 = Incident state is "Canceled".

l ACK_SNOW_STATE =

o This is an integer value and possible values are 1, 2, 3, 6, 7, or 8. There is no default value.







22

2

23

l CLEAR_SNOW_STATE = 6

o This is an integer value and possible values are 1, 2, 3, 6, 7, or 8. Default value is 6.







l You can use the following Passthrough Dictionaries to pass hard-coded mappings through the IntegrationService to ServiceNow.

o NEW_PASSTHROUGH= {}

o ACK_PASSTHROUGH= {}

o CLEAR_PASSTHROUGH= {}

l A hard-coded value for the variable EM7_ID must be set to uniquely identify the ScienceLogic instance. Thiscan be used for domain separation.

o EM7_ID= "EM71"

l You can set the assignment group that New, Acknowledged, and Cleared incidents are mapped to. Todisable this feature, ensure no values are set. Once an incident is created, the assignment group value willnot be changed by the Run Book Action. To assign an assignment group, set the variable value to the sys_idof the ServiceNow Assignment Group.

o NEW_ASSIGNMENT_GROUP

o ACK_ASSIGNMENT_GROUP

o CLEAR_ASSIGNMENT_GROUP

Customizing Logging on Run Book Action Script

You can customize the following logging-related items in the ServiceNow Run Book Action snippet code:

l logfile = /data/tmp/ServiceNow_add_update_clear_incident.log

o Location for Logging output.

o Will be created if it does not exist.

o Will be appended with each RBA job.

o Is case-sensitive.



l do_debug_logging = True

o True is on, False is off.

o Is case-sensitive.

o For troubleshooting, these can be enabled or changed.

o Writes logs to /data/tmp/servicenow_rba.log.

Enabling Run Book Automation Polic ies

After you have enabled the ServiceNow Run Book Action policies, you must enable the corresponding ServiceNowRun Book Automation policies.

To enable the ServiceNow Run Book Automation policies:

1. Log in to your ScienceLogicAdministration Portal as an administrator, and then go to the Automation PolicyManager page (Registry > Run Book > Automation).

2. Locate the ServiceNow: Add/Update Incident policy and click its wrench icon ( ).

3. The Automation Policy Editor page appears. Make entries in the following fields:

l Policy State. Select Enabled.

l Available Actions. If it is not already selected, select the corresponding ServiceNow Run Book Actionpolicy.

24

2

25

TIP: By default, the automation policy will create ServiceNow incidents for all devices. You can limit thedevices affected by making changes to theOrganization, Severity,Match Logic, Aligned Devices,and/or Aligned Events fields.

WARNING: ScienceLogic highly recommends that you do not make changes to the Policy Type, RepeatTime, or Align With fields or the And event is NOT acknowledged setting.

4. Click [Save].

5. Repeat steps 2-4 for the ServiceNow: Event Acknowledged and ServiceNow: Event Cleared Run BookAutomation policies.

Incident Sync Setup

To configure Incident Sync, you will need to add the newly updated configuration file to the Integration Serviceapplications triggered by the run book actions in the ScienceLogic Platform that you have installed and enabled.

1. Log in to the Integration Service with the username isadmin and the password that you set duringinstallation.

2. The configuration file supplies the login credentials to execute the application's steps. For the followingapplications, you must save the configuration file to run with that application:

l Update ServiceNow Incident when ScienceLogic Event is Acknowledged

l Create or Update ServiceNow Incident from ScienceLogic Event

l Update ServiceNow incident when ScienceLogic Event is Cleared

l Bulk Update ScienceLogic Events

l Sync ServiceNow Incident State to ScienceLogic Event

3. For each of the above applications, open the application and click the [Configuration] button.

4. From the Configurations drop-down, select the configuration file you previously uploaded and click [Save].



You will see that the configuration items are updated with the correct fields:

NOTE: The Sync ServiceNow Incident State to ScienceLogic Event Application does not have an associatedrun book action that triggers Incident Sync. This application must be scheduled to run every minute, orto a time suitable for your requirements. A cron job may be used to trigger this schedule.

Viewing Incidents and Events

To view ScienceLogic-created incidents in ServiceNow, go to the Incidents page (Incident >Open) in theServiceNow application. All ScienceLogic incidents use the event message from the ScienceLogic event consoleas the incident description in ServiceNow.

26

2

27

For more information about ServiceNow incident management, seehttps://wiki.servicenow.com/index.php?title=Incident_Management.

The ScienceLogic platform and ServiceNow use slightly different methods for designating the severity or priority ofan event/incident. To handle the conversion, a transformation script that translates ScienceLogic event severity intothe following ServiceNow Impact, Urgency, and Priority fields automatically deploys with the Update Set:

ScienceLogic ServiceNow

Event Severity Impact Urgency Priority

Critical High High Critical

Major High Medium High

Minor Medium Medium Moderate

Notice Low Medium Low

If a secondary event for the same ScienceLogic device occurs and it has a higher severity level than the existingServiceNow incident, the ServiceNow incident automatically updates to indicate the severity change. If asecondary event has a lower severity level, then the severity is not updated.

When ScienceLogic Run Book Automation creates a ServiceNow incident, the "Working Notes" activity log isupdated each time an action occurs with the incident. The following example illustrates that the initial event thatcreated the ServiceNow incident was of Major severity. Minutes later, a Critical event occurred and the incidentupdated accordingly. Minutes later, the event was acknowledged in the ScienceLogic platform and the incidentstate was then set to "active," letting ServiceNow users know that the problem isbeing researched.


https://wiki.servicenow.com/index.php?title=Incident_Management


Hyper-linking Events

Both ServiceNow and the ScienceLogic platform provide mechanisms for hyper-linking to multiple active eventsand incidents. This section describes those processes.

ServiceNow Hyper-linking

In ServiceNow, each incident created by the ScienceLogic platform includes a ScienceLogic URL field with ahyperlink back to the ScienceLogic event.

By default, the ScienceLogic URL field does not appear on the incident form. To add the link:

1. In the ScienceLogic platform, go to the Behavior Settings page (System > Settings > Behavior).

2. In the Interface URL field, enter the URL of your ScienceLogic system.

The ScienceLogic URL link is dynamic to the actively aligned ScienceLogic event. Because of this, the link mightchange multiple times during the life cycle of a ServiceNow incident.

28

2

29

For instance, if the event is cleared or resolved in the ScienceLogic platform, the ScienceLogic URL is removedbecause the event no longer exists in the ScienceLogic Events console. If a duplicate or correlated event is laterdetected and aligned with the ServiceNow incident, the link will be updated to match the new ScienceLogic event.

Viewing the Incident Import Table in ServiceNow

Each time the ScienceLogic platform creates or changes an incident in ServiceNow, data is inserted into atemporary import table on the ServiceNow system. This table displays all inbound data from the ScienceLogicplatform and is a useful tool to determine what data is being sent and imported. The incident import table iscreated automatically when you install the ServiceNow Update Set.

To view the data and the status of the import process, in ServiceNow, go to the ScienceLogic Events page(ScienceLogic > Import Tables > Incident Import):



You can view a complete audit of all import data and transforms by going to the Transform Histories page(System Import Sets > Advanced > Transform History):

ServiceNow, ScienceLogic Event, and Incident Priority Matrix

By default, when the ScienceLogic platform triggers an event, it is sent to ServiceNow through the IntegrationService. The following mappings are currently in place for ScienceLogic events to Incidents in ServiceNow:

SL1 Event SNOW Priority

Critical P2

Major P3

Minor P4

A transformation script that translates the ScienceLogic event severity into the ServiceNow Impact, Urgency, andPriority fields automatically deploys with the Update Set.

By default, the Priority field is read-only and must be set by selecting the Impact andUrgency values.

Priority is calculated according to the following data lookup rules:

30

2

31

Impact Urgency Priority

1 - High 1 - High 1 - Critical

1 - High 2 - Medium 2 - High

1 - High 3 - Low 3 - Moderate

2 - Medium 1 - High 2 - High

2 - Medium 2 - Medium 3 - Moderate

2 - Medium 3 - Low 4 - Low

3 - Low 1 - High 3 - Moderate

3 - Low 2 - Medium 4 - Low

3 - Low 3 - Low 5 - Planning

To edit the transform script:

1. Go to your ServiceNow instance and search for "Transform Map".

2. Under Administration > Transform Maps, select the "ScienceLogic Incident" map.

3. In the Transform Scripts tab, open theOnBefore transform script with theOrder of 200.



4. Edit the Impact and Urgency in the following code, as needed:

//Setting impact and urgency off Event Severity on the import table.switch(source.u_event_severity.toString()){

case '1': //Sciencelogic Event (Critical)impact = 1;urgency = 2;break;

case '2': //Sciencelogic Event (High)impact = 2;urgency = 2;break;

case '3': //Sciencelogic Event (Minor)impact = 2;

32

2

33

urgency = 3;break;

case '4': //Sciencelogic Event (Notice)impact = 3;urgency = 3;break;

default:break;

}

For example, if you want to raise a P1 from a Critical event, you would set it as impact=1 and urgency=1.

Alternatively, using the defaults provided in the ScienceLogic transform script, you can add a business rule whichautomatically changes the Priority to a custom preset.

Adding Additional Fields to the Transform Map

If you require additional mandatory fields to be filled out to resolve an incident, you can add those fields to thetransform map. For example, if you require four mandatory fields in the ServiceNow Incident—AssignmentGroup, IT Service, Service Component, andDescription—to be filled out before that incident can be resolvedin the ScienceLogic platform, you would perform the following steps:

To add an assignment group:

1. Navigate toUser Administration > Groups.

2. Select the assignment group you want to add. Right-click on the gray task bar at the top and elect Copy sys_id.



3. Go to the "ServiceNow: Add/Update/Clear Incident" run book action in the ScienceLogic Platform. Edit therun book action to add your sys_id:

NEW_ASSIGNMENT_GROUP= ''ACK_ASSIGNMENT_GROUP= ''CLEAR_ASSIGNMENT_GROUP= 'ADD SYS_ID HERE'

Add the sys_id to assign the group to Clear, Ack, or trigger a New event which is sent to ServiceNow.

The IT Service, Service Component, andDescription fields in our example must be filled in before an Incidentcan be closed. To do this, changes must be made in the transform maps that are provided in the form of updatesets from ScienceLogic.

To add the Description field:

1. In your ServiceNow instance, search for "transform map" in the left-hand menu. Click Transform Maps.

2. In the list of transform maps, search for "ScienceLogic" in the field above the Name column.

3. Open the "ScienceLogic Incident" map.

34

2

35

4. The Field Maps table at the bottom of the page allows you to edit or create mappings from the ScienceLogicIncident Import table to the ServiceNow Incident table. Click on [New] to create a new field mapping.

5. The Source table field should contain the ScienceLogic Incident Import and the Target table should includethe ServiceNow Incident table.

6. To create a new mapping to copy the contents of the Short description field to the Description field, selectShort description from the Source field drop-down menu.

7. In the Target field drop-down menu, selectDescription.

8. ClickUpdate to save your changes.

The IT Service and Service Component fields in our example are set in the Transform Script in the "ScienceLogicEvent" transform map. To set the fields:

1. Make sure you have the sys_id for the target fields. These can be found in ServiceNow. If a field contains amagnifying glass, it will require a sys_id. If a field has a drop-down, then type in the field you wish to applyfrom the drop-down. In the case of our example, the sys_ids of the two fields are required.

2. In your ServiceNow instance, navigate to the Transform Maps table and select "ScienceLogic Event".

3. In the ScienceLogic Event transform map page, click the Transform Script tab and open the "onAfter" script.



3. Add the following under the "//Update target record when the Event was cleared from Sciencelogic" text:

sl_INT.(target field) = '[sys_id of the source field]'; //(IT service field)sl_INT.(target field) = '[sys_id of the source field]'; //(Service component)

36

2

37

4. To find the target field, make a temporary mapping to see what the target field is. This mapping can bedeleted once you know the target field.



5. Click [Update] to save your changes. The selected fields will be added into an Incident on closure.

38

2

CMDB Sync Integration

Chapter

3CMDB Sync Integration

Overview

This chapter describes how to configure the ScienceLogic platform and ServiceNow to use the CMDB SyncIntegration Solution.

NOTE: For information about version and installation prerequisites for the CMDB Sync Integration Solution,see the Introduction chapter.


Installing the ScienceLogic Update Set in ServiceNow 39

Manually Running the Hierarchy Delete and Configuration Hierarchy Jobs 41

Installing the ScienceLogic Identification Engine Update Set in ServiceNow 42

Installing the CMDB Plugin on ServiceNow 43

The ServiceNow CMDB Identification and Reconciliation Module 44

CMDB Sync Integration Setup 45

Mapping SL1Organizations to ServiceNow Companies 45

Mapping SL1 Devices to ServiceNow 45

Installing the ScienceLogic Update Set in ServiceNow

The ScienceLogic Update Set must be installed on the ServiceNow instance. An update set is an XML filecontaining a group of customizations that can be moved from one ServiceNow instance to another.

39

3

40

Retrieve the update set from your ScienceLogic representative and download the file. Click the XML file name forthe update set to download the set to your computer.


1. Log in to ServiceNow as an administrator, and then navigate to System Update Sets > Retrieved UpdateSets on the left menu.

2. Click the Import Update Set from XML link.

3. Click [Choose File], and then navigate to the update set XML file you downloaded. Select the XML file andclick [Upload].


After the preview set runs, a status page appears. "Success" should appear in the Completion code field.

WARNING: If "Success" does not appear in the Completion code field, contact ScienceLogic Support toassist with reviewing any conflicts that might exist. Do not proceed until those conflicts areresolved and "Success" appears in the Completion code field.

6. Click the Commit Update Set link to apply the changes in the update set to your ServiceNow system. Whenyou do so, a ScienceLogic option appears on the ServiceNow left menu.



Manually Running the Hierarchy Delete and ConfigurationHierarchy Jobs

Before you can sync devices, you must manually run the ScienceLogic Hierarchy Delete and ScienceLogicConfiguration Hierarchy scheduled jobs on your ServiceNow instance.

Tomanually run the scheduled jobs:

1. Log in to your ServiceNow instance.

2. In the filter navigator, search for scheduled jobs.

3. Under System Definition, select Scheduled Jobs.

4. In the Name column, search for "ScienceLogic". You will see "ScienceLogic Configuration Hierarchy" and"ScienceLogic Hierarchy Delete".

5. Run the "ScienceLogic Hierarchy Delete" scheduled job first by opening the job and selecting [ExecuteNow].

41

3

42

6. When the "ScienceLogic Hierarchy Delete" job finishes, run the "ScienceLogic ConfigurationHierarchy" scheduled job by opening the job and selecting [Execute Now].

Installing the ScienceLogic Identif ication Engine Update Setin ServiceNow

The ScienceLogic Identification Engine Update Setmust be installed on the ServiceNow instance if you plan onusing the Identification/Reconciliation engine.

Retrieve the update set from your ScienceLogic representative and download the file. Click the XML file name forthe update set to download the set to your computer.


1. Log in to ServiceNow as an administrator, and then navigate to System Update Sets > Retrieved UpdateSets on the left menu.

2. Click the Import Update Set from XML link.



3. Click [Choose File], and then navigate to the update set XML file you downloaded. Select the XML file andclick [Upload].


5. After the preview set runs, a status page appears. "Success" should appear in the Completion code field.

WARNING: If "Success" does not appear in the Completion code field, contact ScienceLogic Support toassist with reviewing any conflicts that might exist. Do not proceed until those conflicts areresolved and "Success" appears in the Completion code field.

Installing the CMDB Plugin on ServiceNow

Installing the ServiceNow Configuration Management for Scoped Apps (CMDB) Plugin is required tomanage your Configuration Items. This involves activating the Configuration Management For Scoped Apps(CMDB) Plugin on your ServiceNow instance.

To activate the Configuration Management for Scoped Apps (CMDB) plugin:

1. Log in to ServiceNow as an administrator, and then navigate to Plugins (System Definition > Plugins).

2. Search forConfiguration Management For Scoped Apps (CMDB) and click on it.

43

3

44

3. Click Activate/Upgrade in the Related Links section.

4. In the Activate Plugin notification, click [Activate].

The ServiceNow CMDB Identif ication and ReconciliationModule

The Integration Service builds a JSON-formatted string that is sent to the ServiceNow Identification Reconciliationmodule. The following link provides additional detail about the formatting of the JSON-formatted string:IdentificationEngineScriptableApi.

NOTE: The string is encoded to BASE64 before being sent.

The JSON-formatted string is sent to a custom field on a custom table in ServiceNow. After the record is inserted,the custom field that includes the BASE64-encoded JSON string is decoded and run through theidentificationEnginescriptable API.

Identification (Insert or Update) of configuration items is handled by the Identification Reconciliation module inServiceNow. For more information about the Identification Reconciliation module, see CMDB Identify andReconcile.

For more information about Identification engine error messages, see Identification engine error messages.


https://docs.servicenow.com/bundle/kingston-application-development/page/app-store/dev_portal/API_reference/IdentificationEngineScriptableApi/concept/c_IdentEngineScriptAPI.htmll

https://docs.servicenow.com/bundle/kingston-servicenow-platform/page/product/configuration-management/concept/c_CMDBIdentifyandReconcile.html

https://docs.servicenow.com/bundle/kingston-servicenow-platform/page/product/configuration-management/concept/c_CMDBIdentifyandReconcile.html

https://docs.servicenow.com/bundle/jakarta-servicenow-platform/page/product/configuration-management/reference/id-engine-error-messages.html


CMDB Sync Integration Setup

The following sections describe how SL1 devices to be synced in SNOW.

NOTE: As of the 1.3.0 release, attribute mappings such as CPU, RAM, and Memory are not available.

Mapping SL1 Organizat ions to ServiceNow Companies

Before beginning, ensure that you have created the companies created in ServiceNow, and that you have the sys_id for each company.

1. In SL1, go to theOrganizational Account Administration page (Registry > Accounts> Organizations).

2. Select the wrench icon ( ) next to your organization. TheOrganizational Summary Page appears.

3. Click the Properties tab to open theOrganization Properties page.

4. In theOrganization Properties page, enter the sys_id into the CRM ID field and click [Save].

When the Integration Service Sync runs, it will automatically map the correct devices to the correctorganizations/companies in ServiceNow.

Mapping SL1 Devices to ServiceNow

Before you begin, add the VMware update set to ServiceNow and commit the VMware pre-set update set toServiceNow.

1. In ServiceNow, go to the Scheduled Jobs table and search for "ScienceLogic" in the Name column.

45

3

46

2. Open "ScienceLogic Configuration Hierarchy" and click the Execute Now button. This script is used to createrelationship mappings from the metadata containment rules in ServiceNow. If any changes are made in thecontainment rules of ServiceNow, then the "ScienceLogic Hierarchy Delete" script must be run first, followedby the "ScienceLogic Configuration Hierarchy" script.

3. To check the relationships that are being built by this script, go to ScienceLogic > Configuration Hierarchy> Configuration Management in ServiceNow to view the ScienceLogic Configuration Managementstable.

4. Once the script has completed, run the "Cache ServiceNow CIs and ScienceLogic Device Class" applicationin Integration Service. This application will get the device classes from ServiceNow and SL1 and will cachethem. It is recommended that you schedule this application to run on a regular basis.NOTE: Prior to runningthe application, ensure you have chosen the correct configuration file to populate the credential details.

5. Once that application has finished running, open the "ScienceLogic To ServiceNow Device Sync usingGraphQL" application and click [Configure]. Select the necessary configuration file from theConfiguration drop-down. Click [Save].

6. Once you have added the configuration file, you will supply the mappings to map the SL1 Device Classes tothe ServiceNow CI Classes. You can do this using the Integration Service UI or Postman. To add themappings using the UI, open the "Cache ScienceLogic Devices Using GraphQL" application, and click[Configure].

7. Select the necessary configuration file from the [Configuration] drop-down. Click [Save] and run theapplication.NOTE: This step must complete without errors in order for the mappings to work.

8. Open the "ScienceLogic To ServiceNow Device Sync using GraphQL" application. Click the [Configure]button. In the Configuration pane for this application, you can map your device classes. The following imagedisplays one type of mapping. Create your mapping for each of the SL1 device classes that have beendiscovered.



To add the mappings using Postman:

1. In Postman, post the following JSON file which will trigger the required applications in Integration Service tomodel SL1 devices to ServiceNow.

NOTE: This example only maps VMware device classes to ServiceNow, SL1 devices and a few CiscoDevices. If the customer environment has other device classes, then you must manually create themappings.

{"name": "device_sync_sciencelogic_to_servicenow","params": {

"mappings": {"cmdb_ci_ip_switch":[

47

3

48

"Cisco Systems | Catalyst 3850-48P","Cisco Systems | Nexus 9372PX"

],"cmdb_ci_linux_server": [

"ScienceLogic, Inc. | EM7 Message Collector","ScienceLogic, Inc. | EM7 Customer Portal","ScienceLogic, Inc. | EM7 All-In-One","ScienceLogic, Inc. | EM7 Integration Server","ScienceLogic, Inc. | EM7 Admin Portal","ScienceLogic, Inc. | EM7 Database","ScienceLogic, Inc. | OEM","ScienceLogic, Inc. | EM7 Data Collector","NET-SNMP | Linux","RHEL | Redhat 5.5"

],"cmdb_ci_esx_resource_pool": ["VMware | Resource Pool"],"cmdb_ci_esx_server": [

"VMware | ESXi 5.1 w/HR","VMware | Host Server","VMware | ESX(i) 4.0","VMware | ESX(i) w/HR","VMware | ESX(i) 4.0 w/HR","VMware | ESX(i)","VMware | ESX(i) 4.1 w/HR","VMware | ESXi 5.1 w/HR","VMware | ESXi 5.0 w/HR","VMware | ESX(i) 4.1","VMware | ESXi 5.1","VMware | ESXi 5.0"

],"cmdb_ci_vcenter_datacenter": ["VMware | Datacenter"],"cmdb_ci_vcenter_datastore": ["VMware | Datastore", "VMware | DatastoreCluser"],"cmdb_ci_vcenter_dv_port_group": ["VMware | Distributed Virtual Portgroup"],"cmdb_ci_vcenter_dvs": ["VMware | Distributed Virtual Switch"],"cmdb_ci_vcenter_folder": ["VMware | Folder"],"cmdb_ci_vcenter_network": ["VMware | Network"],"cmdb_ci_vmware_instance": ["VMware | Virtual Machine"],"cmdb_ci_vcenter": ["VMware | vCenter", "Virtual Device | Windows Services"],"cmdb_ci_vcenter_cluster": ["VMware | Cluster"]

},"configuration": "template_snow_integration" #name your configuration file}

}

The following image displays an example of using Postman to sent the mapping data to Integration Service:


CMDB Sync Integration 49

3

© 2003 - 2018, ScienceLogic, Inc.

All rights reserved.

LIMITATION OF LIABILITY ANDGENERAL DISCLAIMER

ALL INFORMATION AVAILABLE IN THIS GUIDE IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANYKIND, EITHER EXPRESS OR IMPLIED. SCIENCELOGIC™ AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES,EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OFMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.

Although ScienceLogic™ has attempted to provide accurate information on this Site, information on this Sitemay contain inadvertent technical inaccuracies or typographical errors, and ScienceLogic™ assumes noresponsibility for the accuracy of the information. Information may be changed or updated without notice.ScienceLogic™ may also make improvements and / or changes in the products or services described in thisSite at any time without notice.

Copyrights and Trademarks

ScienceLogic, the ScienceLogic logo, and EM7 are trademarks of ScienceLogic, Inc. in the United States,other countries, or both.

Below is a list of trademarks and service marks that should be credited to ScienceLogic, Inc. The ® and ™symbols reflect the trademark registration status in the U.S. Patent and Trademark Office and may not beappropriate for materials to be distributed outside the United States.

l ScienceLogic™l EM7™ and em7™l Simplify IT™l Dynamic Application™l Relational Infrastructure Management™

The absence of a product or service name, slogan or logo from this list does not constitute a waiver ofScienceLogic’s trademark or other intellectual property rights concerning that name, slogan, or logo.

Please note that laws concerning use of trademarks or product names vary by country. Always consult alocal attorney for additional guidance.

Other

If any provision of this agreement shall be unlawful, void, or for any reason unenforceable, then thatprovision shall be deemed severable from this agreement and shall not affect the validity and enforceabilityof any remaining provisions. This is the entire agreement between the parties relating to the matterscontained herein.

In the U.S. and other jurisdictions, trademark owners have a duty to police the use of their marks. Therefore,if you become aware of any improper use of ScienceLogic Trademarks, including infringement orcounterfeiting by third parties, report them to Science Logic’s legal department immediately. Report as muchdetail as possible about the misuse, including the name of the party, contact information, and copies orphotographs of the potential misuse to: [email protected]

800-SCI-LOGIC (1-800-724-5644)

International: +1-703-354-1010

Date post:	24-Apr-2020
Category:	Documents
Upload:	others
View:	27 times
Download:	0 times

IntegrationService: ServiceNow Integration...TableofContents Introduction 1...

Documents