Skip to main content

ServiceNow

Download With Dependencies

Use The ServiceNow IT Service Management (ITSM) solution to modernize the way you manage and deliver services to your users.

Cortex XSOAR interfaces with ServiceNow to help streamline security-related service management and IT operations.

The data in ServiceNow tickets can be mirrored to Cortex XSOAR so that you can track the status and information in the task.
You can also provide comments or attachments in Cortex XSOAR which will appear in ServiceNow.

What does this pack do?

  • View, create, update, or delete a ServiceNow ticket directly from Cortex XSOAR and enrich it with Cortex XSOAR data.
  • View, create, update, and delete records from any ServiceNow table.
  • Query ServiceNow data with the ServiceNow query syntax.
  • Enables users to fetch Events from ServiceNow platform into Cortex XSIAM.
  • Log Normalization - XDM mapping for key event types

As part of this pack, you will also get two out-of-the-box layouts so that you can visualize ServiceNow ticket information in Cortex XSOAR.

The Create ServiceNow Ticket playbook provides an example for how to use the Mirror ServiceNow Ticket playbook to mirror data and the ServiceNow Ticket State Polling sub-playbook to track when the ticket closes.

Pack Contributors:

  • Torbjørn Lium

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Cortex interfaces with ServiceNow to help streamline security-related service management and IT operations.

What does this pack do?

  • View, create, update, or delete a ServiceNow ticket directly from Cortex and enrich it with Cortex data.
  • View, create, update, and delete records from any ServiceNow table.
  • Query ServiceNow data with the ServiceNow query syntax.
  • Enables users to fetch Events from ServiceNow platform into Cortex XSIAM.
  • Log Normalization - XDM mapping for key event types

Supported Event Types

  • Audit
  • Syslog Transactions
  • Case

Configure ServiceNow Event Collector on XSIAM Tenant

  1. Go to Settings > Configurations > Automation & Feed Integrations.
  2. Search for ServiceNow Event Collector
  3. Click Add instance.
  4. Insert the ServiceNow URL.
  5. Insert your credentials (user name and password).
  6. Scroll down to the Collect section.
  7. Mark Fetch Events and select the desire event types to fetch (Audit and Syslog Transactions)

Important

To use ServiceNow on Cortex XSIAM, ensure your user account has the rest_api_explorer and web_service_admin roles.
These roles are required to make API calls. To use the Case API endpoint, users must have one of the following roles:

  • csm_ws_integration
  • sn_customerservice.customer
  • sn_customerservice.consumer

For more information on ServiceNow platform

Pack Contributors:

  • Torbjørn Lium

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

CertificationRead more
Supported ByCortex
CreatedJuly 7, 2020
Last ReleaseMay 25, 2026
WORKS WITH THE FOLLOWING INTEGRATIONS:
DISCLAIMER
By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.