ServiceNow ITSM

The ServiceNow IT Service Management (ITSM) focuses on streamlining and automating IT service delivery and management processes. It provides tools for incident, problem, change, and asset management, enhancing efficiency in IT operations.

Supported Actions and Example Prompts

The following table lists the supported actions and prompt examples for an action:

Action Name	Description	Prompt Example
Create Incident	This action creates a new incident in the incident table. For more information, see Action: Create Incident.	Create an incident with a description phishing email found with urgency set to 2, and impact set to 1 in ServiceNow ITSM.
Get Change Request Record	This action retrieves the details of the change request records. For more information, see Action: Get Change Request Record.	Get the change request record of the change request of the system ID 0a9cdf93dbd31010a3c28a1848961994 with the request type as normal from ServiceNow ITSM.
Get Incident Details by Incident Number	This action gets the incident details by the incident number. For more information, see Action: Get Incident Details by Incident Number.	Get the details of the incident inc04521 from ServiceNow ITSM.
Search Records From Table	This action performs a search for the records from the table. For more information, see Action: Search Records From Table.	Search records from the table test_table in ServiceNow ITSM.
Update Incident	This action updates an incident. For more information, see Action: Update Incident.	Update the incident with system ID57fe9b17dbd31010a3c28a18489619d1 with impact set to 2.

Install and Configure the App

Install and configure the required apps to enable Quarterback AI to perform various security-related tasks and provide relevant responses. After installing an app, you must create an instance that will be used to communicate with the app endpoints. An app can have multiple instances, and you can set a default instance from the configured instance list.

Before you Start

Ensure that you have the API token to authenticate with the ServiceNow ITSM app.

Steps

To install and configure an app, follow these steps:

Go to the application, in the left pane, select Quarterback AI.
In Apps, select ServiceNow ITSM and click Install.
After the app is installed, click Configure App and enter the following details to create an instance:
- Instance Name: Enter a name for the instance.
- Instance Description: Enter a description for the instance.
- Expiry: Select an expiry date for the instance.
- Set as default instance: Select this option to set this instance as the default instance. By default, this instance will be used to perform actions from this app.
- Base URL: Enter the base URL to access ServiceNow ITSM. For example, https://instancename.service-now.com/api.
- Username: Enter the username to connect to ServiceNow ITSM.
- Password: Enter the password for the provided ServiceNow ITSM account.
- Client ID: Enter the client ID.
- Client Secret: Enter the client secret to authorize communication with the application.
- Time-Based One-Time-Password Secret: Enter the secret password generated for MFA using the one-time password.
- Proxy Type: Enter the proxy type.
- Proxy URL: Enter the proxy URL.
- Proxy Username: Enter the proxy username.
- Proxy Password: Enter the proxy password.
- Verify: Select this option to Verify to verify SSL while making requests. It is recommended to select this option for a successful connection. By default, this option is not selected.
- Timeout: Enter the timeout value in seconds. This is the number of seconds that requests will wait to establish a connection with ServiceNow ITSM. You can enter values between 15 - 120 seconds. By default, 15 seconds is set.
Click Done.

The instance is created, and you can view it in Instances. To create another instance, click Add Instance.

Action: Create Incident

This action creates a new incident in the incident table.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Short Description	Provide a short description of the incident. Example: Sample description for reference	Text	Required
Urgency	Enter the urgency of the incident. Possible values are 1, 2 or 3. Example: 3	Text	Required	Allowed values: 1 2 3
Impact	Enter the impact of the incident. Possible values are 1, 2, or 3. Example: 3	Text	Required	Allowed values: 1 2 3
Caller ID	Enter the caller ID associated with the incident. Example: user	Text	Optional
Additional Data	Enter additional data to be added while creating the incident in ServiceNow ITSM.	Key Value	Optional

Example Request

[
    {
        "impact": "3",
        "urgency": "3",
        "caller_id": "user",
        "short_description": "sample description for reference"
    }
]

Action Response Parameters

Parameter	Field Type	Description
{app_instance}	Object	This parameter indicates the ID of the app instance configured in Orchestrate from which the response is retrieved.
app_instance.result.upon_approval	String	Action to be taken upon approval. Example: "proceed"
app_instance.result.location	String	Location information. Example: ""
app_instance.result.expected_start	String	Expected start time. Example: ""
app_instance.result.reopen_count	String	Number of times the incident was reopened. Example: "0"
app_instance.result.close_notes	String	Notes added upon closing the incident. Example: ""
app_instance.result.additional_assignee_list	String	List of additional assignees. Example: ""
app_instance.result.impact	String	Impact level. Example: "2"
app_instance.result.urgency	String	Urgency level. Example: "2"
app_instance.result.correlation_id	String	Correlation ID. Example: ""
app_instance.result.sys_tags	String	System tags. Example: ""
app_instance.result.sys_domain.link	String	URL to the system domain resource. Example: "https://instance.servicenow.com/api/now/table/sys_user_group/global"
app_instance.result.sys_domain.value	String	Value of the system domain. Example: "global"
app_instance.result.description	String	Description of the incident. Example: ""
app_instance.result.group_list	String	List of groups. Example: ""
app_instance.result.priority	String	Priority level. Example: "3"
app_instance.result.delivery_plan	String	Delivery plan. Example: ""
app_instance.result.sys_mod_count	String	System modification count. Example: "0"
app_instance.result.work_notes_list	String	List of work notes. Example: ""
app_instance.result.business_service	String	Business service associated with the incident. Example: ""
app_instance.result.follow_up	String	Follow-up information. Example: ""
app_instance.result.closed_at	String	Timestamp when the incident was closed. Example: ""
app_instance.result.sla_due	String	SLA due date. Example: ""
app_instance.result.delivery_task	String	Delivery task. Example: ""
app_instance.result.sys_updated_on	String	Timestamp when the incident was last updated. Example: "2016-01-22 14:28:24"
app_instance.result.parent	String	Parent incident ID. Example: ""
app_instance.result.work_end	String	Work end time. Example: ""
app_instance.result.number	String	Incident number. Example: "INC0010002"
app_instance.result.closed_by	String	User who closed the incident. Example: ""
app_instance.result.work_start	String	Work start time. Example: ""
app_instance.result.calendar_stc	String	Calendar static time. Example: ""
app_instance.result.category	String	Incident category. Example: "inquiry"
app_instance.result.business_duration	String	Business duration. Example: ""
app_instance.result.incident_state	String	State of the incident. Example: "1"
app_instance.result.activity_due	String	Activity due date. Example: ""
app_instance.result.correlation_display	String	Correlation display. Example: ""
app_instance.result.company	String	Company associated with the incident. Example: ""
app_instance.result.active	String	Indicates if the incident is active. Example: "true"
app_instance.result.due_date	String	Due date of the incident. Example: ""
app_instance.result.assignment_group.link	String	URL to the assignment group resource. Example: "https://instance.servicenow.com/api/now/table/sys_user_group/287ebd7da9fe198100f92cc8d1d2154e"
app_instance.result.assignment_group.value	String	Value of the assignment group. Example: "287ebd7da9fe198100f92cc8d1d2154e"
app_instance.result.caller_id	String	Caller ID. Example: ""
app_instance.result.knowledge	String	Indicates if the incident is a knowledge article. Example: "false"
app_instance.result.made_sla	String	Indicates if the SLA was met. Example: "true"
app_instance.result.comments_and_work_notes	String	Comments and work notes associated with the incident. Example: ""
app_instance.result.parent_incident	String	Parent incident ID. Example: ""
app_instance.result.state	String	State of the incident. Example: "1"
app_instance.result.user_input	String	User input related to the incident. Example: ""
app_instance.result.sys_created_on	String	Timestamp when the incident was created. Example: "2016-01-22 14:28:24"
app_instance.result.approval_set	String	Approval set information. Example: ""
app_instance.result.reassignment_count	String	Number of times the incident was reassigned. Example: "0"
app_instance.result.rfc	String	RFC (Request for Change) ID. Example: ""
app_instance.result.child_incidents	String	Number of child incidents. Example: "0"
app_instance.result.opened_at	String	Timestamp when the incident was opened. Example: "2016-01-22 14:28:24"
app_instance.result.short_description	String	Short description of the incident. Example: "Unable to connect to office wifi"
app_instance.result.order	String	Order information. Example: ""
app_instance.result.sys_updated_by	String	User who last updated the incident. Example: "admin"
app_instance.result.resolved_by	String	User who resolved the incident. Example: ""
app_instance.result.notify	String	Notification type. Example: "1"
app_instance.result.upon_reject	String	Action to be taken upon rejection. Example: "cancel"
app_instance.result.approval_history	String	Approval history. Example: ""
app_instance.result.problem_id	String	Problem ID associated with the incident. Example: ""
app_instance.result.work_notes	String	Work notes associated with the incident. Example: ""
app_instance.result.calendar_duration	String	Calendar duration. Example: ""
app_instance.result.close_code	String	Close code. Example: ""
app_instance.result.sys_id	String	System ID of the incident. Example: "c537bae64f411200adf9f8e18110c76e"
app_instance.result.approval	String	Approval status. Example: "not requested"
app_instance.result.caused_by	String	Cause of the incident. Example: ""
app_instance.result.severity	String	Severity level. Example: "3"
app_instance.result.sys_created_by	String	User who created the incident. Example: "admin"
app_instance.result.resolved_at	String	Timestamp when the incident was resolved. Example: ""
app_instance.result.assigned_to	String	User assigned to the incident. Example: ""
app_instance.result.business_stc	String	Business static time. Example: ""
app_instance.result.wf_activity	String	Workflow activity. Example: ""
app_instance.result.sys_domain_path	String	Path of the system domain. Example: "/"
app_instance.result.cmdb_ci	String	Configuration item. Example: ""
app_instance.result.opened_by.link	String	URL to the user who opened the incident. Example: "https://instance.servicenow.com/api/now/table/sys_user/6816f79cc0a8016401c5a33be04be441"
app_instance.result.opened_by.value	String	Value of the user who opened the incident. Example: "6816f79cc0a8016401c5a33be04be441"
app_instance.result.subcategory	String	Subcategory of the incident. Example: ""
app_instance.result.rejection_goto	String	Rejection goto information. Example: ""
app_instance.result.sys_class_name	String	Class name of the incident. Example: "incident"
app_instance.result.watch_list	String	List of watchers. Example: ""
app_instance.result.time_worked	String	Time worked on the incident. Example: ""
app_instance.result.contact_type	String	Type of contact. Example: "phone"
app_instance.result.escalation	String	Escalation level. Example: "0"
app_instance.result.comments	String	Comments on the incident. Example: ""

Action: Get Change Request Record

This action retrieves the details of the change request records.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Request type	Enter the request type of a record. Example: normal	Text	Required	Allowed values: "normal" "standard" "emergency"
Change request system ID	Enter the system ID of the change request. Example: 0a9cdf93dbd31010a3c28a1848961994	Text	Required

Parameter

Description

Field Type

Required/Optional

Comments

Request type

Enter the request type of a record.

Example:

normal

Text

Required

Allowed values:

"normal"
"standard"
"emergency"

Change request system ID

Enter the system ID of the change request.

Example:

0a9cdf93dbd31010a3c28a1848961994

Text

Required

Example Request

[
    {
        "request_type": "normal",
        "request_sys_id": "41f1550197843110b963bf1e6253afaa"
    }
]

Action Response Parameters

Parameter	Type	Description
app_instance.action_status	Number	Current action status of the associated change request. Possible values: 1 (Blocked internally), 2 (Blocked by customer), 3 (Blocked internally and by customer), 4 (Needs attention)
app_instance.active	Boolean	Flag indicating whether the change request is active. Possible values: true (Active), false (Not active). Default: true
app_instance.activity_due	String	Date and time for which the associated case is expected to be completed.
app_instance.additional_assignee_list	Array	List of sys_ids of additional persons assigned to work on the change request.
app_instance.approval	String	Type of approval process required. Default: not requested
app_instance.approval_history	String	Most recent approval history journal entry.
app_instance.approval_set	String	Date and time that the associated action was approved.
app_instance.assigned_to	String	Sys_id of the user assigned to the change request.
app_instance.assignment_group	String	Sys_id of the group assigned to the change request.
app_instance.backout_plan	String	Description of the plan to execute if the change must be reversed.
app_instance.business_duration	String	Length in scheduled work hours, work days, and work weeks that it took to complete the change.
app_instance.business_service	String	Sys_id of the business service associated with the change request. Located in the Service [cmdb_ci_service] table.
app_instance.cab_date	String	Date on which the Change Advisory Board (CAB) meets.
app_instance.cab_delegate	String	Sys_id of the user that can substitute for the CAB manager during a CAB meeting. Located in the User [sys_user] table
app_instance.cab_recommendation	String	Description of the CAB recommendations for the change request. Maximum length: 4,000
app_instance.cab_required	Boolean	Flag indicating whether the CAB is required. Possible values: true (Required), false (Not required). Default: false
app_instance.calendar_duration	String	Not currently used by Change Management.
app_instance.category	String	Category of the change, for example hardware, network, or software. Default: Other
app_instance.change_plan	String	Activities and roles for managing and controlling the change request.
app_instance.chg_model	String	Sys_id of the change model that the associated change request was based on. Located in the Change Model [chg_model] table.
app_instance.close_code	String	Code assigned to the change request when it was closed. For example, Successful, Successful with issues, and Unsuccessful.
app_instance.close_notes	String	Notes that the person entered when closing the change request.
app_instance.closed_at	String	Date and time that the associated change request was closed.
app_instance.closed_by	String	Sys_id of the person that closed the change request. Located in the User [sys_user] table.
app_instance.cmdb_ci	String	Sys_id of the configuration item associated with the change request. Located in the Configuration Item [cmdb_ci] table.
app_instance.comments	Array	List of customer-facing work notes entered in the associated change request.
app_instance.comments_and_work_notes	Array	List of both internal and customer-facing work notes entered for the associated change request. Maximum length: 4,000
app_instance.company	String	Sys_id of the company associated with the change request. Located in the Company [core_company] table.
app_instance.conflict_last_run	String	Date and time that the conflict detection script was last run on the change request.
app_instance.conflict_status	String	Current conflict status as detected by the conflict detection script, such as Conflict and Not Run. Maximum length: 40. Default: Not Run
app_instance.contact_type	String	Method in which the change request was initially requested. Possible values: chat, email, phone, social, web
app_instance.contract	String	Sys_id of the contract associated with the change request. Located in the Contract [ast_contract] table.
app_instance.correlation_display	String	User-friendly name for the correlation_id. Maximum length: 100
app_instance.correlation_id	String	Globally unique ID (GUID) of a matching change request record in a third-party system. Maximum length: 100
app_instance.delivery_plan	String	No longer in use. Sys_id of the delivery plan associated with the change request. Located in the Execution Plan [sc_cat_item_delivery_plan] table.
app_instance.delivery_task	String	No longer in use. Sys_id of the delivery task associated with the change request. Located in the Execution Plan Task [sc_cat_item_delivery_task] table.
app_instance.description	String	Detailed description of the change request. Maximum length: 4,000
app_instance.due_date	String	Task due date. Not used by change request process.
app_instance.due_date	String	Task due date. Not used by change request process.
app_instance.end_date	String	Date and time when the change request is to be completed.
app_instance.escalation	Number (Integer)	Current escalation level. Possible values: 0 (Normal), 1 (Moderate), 2 (High), 3 (Overdue). Default: 0
app_instance.expected_start	String	Date and time when the task is to start. Not used by the change request process.
app_instance.follow_up	String	Date and time when a user followed-up with the person requesting the change request.
app_instance.group_list	Array	List of sys_ids and names of the groups associated with the change request. Maximum length: 4,000
app_instance.impact	Number (Integer)	Impact the change request will have on the customer. Possible values: 1 (High), 2 (Medium), 3 (Low). Default: 3
app_instance.implementation_plan	String	Sequential steps to execute to implement this change. Maximum length: 4,000
app_instance.justification	String	Benefits of implementing this change and the impact if this change is not implemented. Maximum length: 4,000
app_instance.knowledge	Boolean	Flag indicating whether there are any knowledge base (KB) articles associated with the change request. Possible values: true (Associated KB articles), false (No associated KB articles)
app_instance.location	String	Sys_id and name of the location of the equipment referenced in the change request. Located in the Location [cmn_location] table.
app_instance.made_sla	Boolean	No longer used. Flag indicating whether the change request was implemented in alignment with the associated service level agreement.
app_instance.needs_attention	Boolean	Flag indicating whether the change request needs attention. Possible values: true (Needs attention), false (Does not need attention). Default: false
app_instance.number	String	Change number assigned to the change request by the system, such as CHG0040007.
app_instance.on_hold	Boolean	Flag indicating whether the change request is currently on hold. Possible values: true (On hold), false (Not on hold). Default: false
app_instance.on_hold_reason	String	If the on_hold parameter is "true", description of the reason why the change request is being held up. Maximum length: 4,000
app_instance.on_hold_task	String	If the on_hold parameter is "true", list of the sys_ids of the tasks that must be completed before the hold is released. Maximum length: 4,000
app_instance.opened_at	String	Date and time that the change release was created.
app_instance.opened_by	String	Sys_id and name of the user that created the change release. Located in the User [sys_user] table.
app_instance.order	Number (Integer)	Not used by Change Management. Optional numeric field by which to order records, such as when retrieving them from a database.
app_instance.outside_maintenance_schedule	Boolean	Flag indicating whether maintenance by an outside company has been scheduled for the change request. Possible values: true (Outside maintenance scheduled), false (No outside maintenance scheduled). Default: false
app_instance.parent	String	Sys_id and name of the parent task to this change request, if any. Located in the Task [task] table.
app_instance.phase	String	Current phase of the change request. Possible values: accept, build, plan, requested.
app_instance.phase_state	String	Change_phase records that should be created for a change. Possible values: complete, on hold, open, rejected, requested, work in progress.
app_instance.priority	Number (Integer)	Priority of the change request. Possible values: 1 (Critical), 2 (High), 3 (Moderate), 4 (Low). Default: 4
app_instance.production_system	Boolean	Flag indicating whether the change request is for a ServiceNow instance that is in a production environment. Possible values: true (Production environment), false (Non-production environment).
app_instance.reason	String	Description of why the change request was initiated.
app_instance.reassignment_count	Number (Integer)	Number of times that the change request has been reassigned to a new owner. Default: 0
app_instance.rejection_goto	String	Sys_id of the task to perform if the change request is rejected. Located in the Task [table].
app_instance.requested_by	String	Sys_id of the user that requested the change. Located in the User [sys_user] table.
app_instance.requested_by_date	String	Date and time when the change is requested to be implemented by.
app_instance.result	Array	List containing one or more change request record objects. Each object describes a change request. Each element in the change request object corresponds to a field in its associated record in the Change Request [change_request] table. All elements contain value and display_value name-value pairs. Date fields also contain display_value_internal name-value pairs.
app_instance.review_comments	String	Comments entered when the change request was reviewed. Maximum length: 4,000
app_instance.review_date	String	Date that the change request was reviewed.
app_instance.review_status	String	Current status of the requested change request review.
app_instance.risk_impact_analysis	String	Description of the risk and analysis of implementing the change request. Maximum length: 4,000
app_instance.route_reason	Number (Integer)	Not currently used by Change Management. Reason that the change request was transferred. Possible values: 1 (Transfer with Resolution), 9 (Transfer without Resolutions)
app_instance.scope	Number (Integer)	Size of the change request. Possible values: 1 (Massive), 2 (Large), 3 (Medium), 4 (Small), 5 (Tiny). Default: 3
app_instance.service_offering	String	Sys_id of the service offering associated with the change request. Located in the Offering [service_offering] table.
app_instance.short_description	String	Description of the change request. Maximum length: 40
app_instance.skills	Array	List of the sys_ids of all of the skills required to implement the change request. Located in the Skill [cmn_skill] table.
app_instance.sla_due	String	No longer in use. Date and time that the change request must be completed based on the associated service level agreement.
app_instance.sn_esign_document	String	Sys_id of any E-signed document attached to the change request. Located in the Attachment [sys_attachment] table.
app_instance.sn_esign_esignature_configuration	String	Sys_id of the E-signed signature template used for the associated document. Located in the E-signature Template [sn_esign_configuration] table.
app_instance.start_date	String	Date and time that the change request is planned to start implementation.
app_instance.state	Number (Integer)	Current state of the change request. Possible values are defined in the change model.
app_instance.std_change_producer_version	String	Sys_id of the record producer and change proposal associated with the change request. Located in the Standard Change Template Version [std_change_producer_version] table.
app_instance.sys_class_name	String	Name of the table in which the change request is located.
app_instance.sys_created_by	String	Name of the user that initially created the change request. Maximum length: 40
app_instance.sys_created_on	String	Date and time that the associated change request record was originally created.
app_instance.sys_domain	String	If using domains in the instance, the name of the domain to which the change module record is associated.
app_instance.sys_domain_path	String	If using domains in the instance, the domain path in which the associated change module record resides.
app_instance.sys_id	String	Unique identifier of the associated change request record.
app_instance.sys_mod_count	Number (Integer)	Number of updates to the case since it was initially created.
app_instance.sys_updated_by	String	Person that last updated the case. Maximum length: 40
app_instance.sys_updated_on	String	Date and time when the case was last updated.
app_instance.task_effective_number	String	Universal request number. Maximum length: 40
app_instance.task_for	String	Not used by Change Management. Sys_id of the user that the task was created for. Located in the User [sys_user] table.
app_instance.test_plan	String	Description of the associated test plan for the change. Maximum length: 4,000
app_instance.time_worked	String	Total amount of time worked on the change request.
app_instance.type	String	Change request type. Possible values: emergency, normal, standard. Maximum length: 40
app_instance.unauthorized	Boolean	Flag indicating whether the change request is unauthorized. Possible values: true (Unauthorized), false (Authorized)
app_instance.universal_request	String	Sys_id of the Parent Universal request to which this change request is a part of. Located in the Task [task] table.
app_instance.upon_approval	String	Action to take if the change request is approved. Possible values: do_nothing, proceed. Maximum length: 40
app_instance.upon_reject	String	Action to take if the change request is rejected. Possible values: cancel, goto. Maximum length: 40
app_instance.urgency	Number (Integer)	Urgency of the change request. Possible values: 1 (High), 2 (Medium), 3 (Low). Default: 3
app_instance.user_input	String	Additional user input. Maximum length: 4,000
app_instance.variables	String	Name-value pairs of variables associated with the change request. Maximum length: 40
app_instance.watch_list	Array	List of sys_ids of the users who receive notifications about this change request when additional comments are added or if the state of a change request is changed to Resolved or Closed. Located in the User [sys_user] table.
app_instance.wf_activity	String	Sys_id of the workflow activity record associated with the change request. Located in the Workflow Activity [wf_activity] table.
app_instance.work_end	String	Date and time work ended on the change request.
app_instance.work_notes	String	Information about how to resolve the change request, or steps taken to resolve it. Maximum length: 4,000

Action: Get Incident Details by Incident Number

This action gets incident details by the incident number.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Incident number	Enter the incident number to get details. Example: inc04521	Text	Required

Parameter

Description

Field Type

Required/Optional

Comments

Incident number

Enter the incident number to get details.

Example:

inc04521

Text

Required

Example Request

[
    {
        "incident_number": "inc04521"
    }
]

Action Response Parameters

Parameter	Type	Description
{app_instance}	Object	This parameter indicates the ID of the app instance configured in Orchestrate from which the response is retrieved.
app_instance.upon_approval	String	Action to take upon approval. Example: "Escalate".
app_instance.location	Object	Location information with link and value.
app_instance.expected_start	String	Expected start time. Example: "2024-06-17 10:00:00".
app_instance.reopen_count	String	Number of times the incident was reopened. Example: "2".
app_instance.close_notes	String	Notes added upon closing the incident. Example: "Issue resolved".
app_instance.additional_assignee_list	String	List of additional assignees. Example: "user1, user2".
app_instance.impact	String	Impact level of the incident. Example: "1" (High).
app_instance.urgency	String	Urgency level of the incident. Example: "3" (Low).
app_instance.correlation_id	String	Correlation ID for related incidents. Example: "CORR12345".
app_instance.sys_tags	String	System tags for the incident. Example: "tag1, tag2".
app_instance.sys_domain	Object	Domain information with link and value.
app_instance.description	String	Detailed description of the incident. Example: "User cannot access software".
app_instance.group_list	String	List of groups associated with the incident. Example: "group1, group2".
app_instance.priority	String	Priority level of the incident. Example: "3" (Low).
app_instance.delivery_plan	String	Delivery plan for the incident. Example: "Plan A".
app_instance.sys_mod_count	String	Number of times the record was modified. Example: "4".
app_instance.work_notes_list	String	List of work notes for the incident. Example: "Note 1, Note 2".
app_instance.business_service	String	Business service affected by the incident. Example: "Email Service".
app_instance.follow_up	String	Follow-up actions required. Example: "Check after 24 hours".
app_instance.closed_at	String	Timestamp when the incident was closed. Example: "2024-06-18 15:30:00".
app_instance.sla_due	String	SLA due date. Example: "2015-11-11 22:04:15".
app_instance.delivery_task	String	Delivery task associated with the incident. Example: "Task 123".
app_instance.sys_updated_on	String	Timestamp when the incident was last updated. Example: "2015-11-01 22:37:27".
app_instance.parent	String	Parent incident ID. Example: "INC0000045".
app_instance.work_end	String	Timestamp when the work ended. Example: "2024-06-17 17:00:00".
app_instance.number	String	Unique number of the incident. Example: "INC0000046".
app_instance.closed_by	String	User who closed the incident. Example: "admin".
app_instance.work_start	String	Timestamp when the work started. Example: "2024-06-17 09:00:00".
app_instance.calendar_stc	String	Calendar time spent on the incident. Example: "3 hours".
app_instance.category	String	Category of the incident. Example: "software".
app_instance.business_duration	String	Business duration of the incident. Example: "2 days".
app_instance.incident_state	String	State of the incident. Example: "1" (Open).
app_instance.activity_due	String	Due date for the next activity. Example: "2024-06-18 12:00:00".
app_instance.correlation_display	String	Display value for the correlation ID. Example: "CORR12345".
app_instance.company	String	Company associated with the incident. Example: "ABC Corp".
app_instance.active	String	Active status of the incident. Example: "true".
app_instance	String	Due date of the incident. Example: "2024-06-18 17:00:00".
app_instance.assignment_group	Object	Assignment group information with link and value.
app_instance.caller_id	Object	Caller ID information with link and value.
app_instance.knowledge	String	Knowledge article status. Example: "false".
app_instance.made_sla	String	SLA met status. Example: "false".
app_instance.comments_and_work_notes	String	Comments and work notes associated with the incident. Example: "Initial analysis done".
app_instance.parent_incident	String	Parent incident ID. Example: "INC0000045".
app_instance.state	String	State of the incident. Example: "1" (Open).
app_instance.user_input	String	User input associated with the incident. Example: "User input details".
app_instance.sys_created_on	String	Timestamp when the incident was created. Example: "2015-11-01 22:05:30".
app_instance.approval_set	String	Approval set for the incident. Example: "Approval set details".
app_instance.reassignment_count	String	Number of times the incident was reassigned. Example: "1".
app_instance.rfc	String	RFC associated with the incident. Example: "RFC12345".
app_instance.child_incidents	String	Child incidents associated with this incident. Example: "INC0000047, INC0000048".
app_instance.opened_at	String	Timestamp when the incident was opened. Example: "2015-11-02 22:04:15".
app_instance.short_description	String	Short description of the incident. Example: "Can't access SFA software".
app_instance.order	String	Order associated with the incident. Example: "Order123".
app_instance.sys_updated_by	String	User who last updated the incident. Example: "glide.maint".
app_instance.resolved_by	String	User who resolved the incident. Example: "resolver1".
app_instance.notify	String	Notification status of the incident. Example: "1".
app_instance.upon_reject	String	Action to take upon rejection. Example: "Reassign".
app_instance.approval_history	String	History of approvals for the incident. Example: "Approval history details".
app_instance.problem_id	Object	Problem ID information with link and value.
app_instance.work_notes	String	Work notes associated with the incident. Example: "Work note details".
app_instance.calendar_duration	String	Calendar duration of the incident. Example: "2 hours".
app_instance.close_code	String	Code indicating the reason for closing the incident. Example: "Resolved".
app_instance.sys_id	String	System ID of the incident. Example: "a9e30c7dc61122760116894de7bcc7bd".
app_instance.approval	String	Approval status of the incident. Example: "not requested".
app_instance.caused_by	String	Cause of the incident. Example: "Network issue".
app_instance.severity	String	Severity level of the incident. Example: "3" (Low).
app_instance.sys_created_by	String	User who created the incident. Example: "admin".
app_instance.resolved_at	String	Timestamp when the incident was resolved. Example: "2024-06-18 10:30:00".
app_instance.assigned_to	String	User assigned to the incident. Example: "assignee1".
app_instance.business_stc	String	Business stc details. Example: "Business STC info".
app_instance.wf_activity	String	Workflow activity details. Example: "Workflow activity info".
app_instance.sys_domain_path	String	System domain path. Example: "/".
app_instance.cmdb_ci	Object	Configuration item information with link and value.
app_instance.opened_by	Object	User who opened the incident with link and value.
app_instance.subcategory	String	Subcategory of the incident. Example: "Software issue".
app_instance.rejection_goto	String	Action to take if rejected. Example: "Escalate".
app_instance.sys_class_name	String	Class name of the incident. Example: "incident".
app_instance.watch_list	String	List of users watching the incident. Example: "user1, user2".
app_instance.time_worked	String	Total time worked on the incident. Example: "2 hours".
app_instance.contact_type	String	Type of contact for the incident. Example: "phone".
app_instance.escalation	String	Escalation status of the incident. Example: "0" (Not escalated).
app_instance.comments	String	Comments associated with the incident. Example: "Additional comments".

Action: Search Records From Table

This action searches for records from a table.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Table name	Enter the table name for which records must be retrieved. Example: u_co_test_table	Text	Required
Number of records	Enter the maximum number of records to return. Example: 100	Integer	Optional	Default value: 1000
Offset number	Enter the starting record index to begin retrieving records. Use this value to paginate record retrieval.	Integer	Optional
Query string	Enter the encoded query used to filter the result set.	Text	Optional
Query params	Enter query parameters as key value pairs to filter the results.	Key Value	Optional

Example Request

[
    {
        "table_name": "u_co_test_table"
    }
]

Action Response Parameters

Parameter	Field Type	Description
`{app_instance}`	JSON Object	This parameter indicates the ID of the app instance configured in Orchestrate from which the response is retrieved.
`app_instance.response`	JSON Object	Includes the details of the response retrieved from the action.
`app_instance.response.result`	Array of JSON Objects	returns a list of JSON objects. Each JSON object that includes the details of a record.
`app_instance.response.result.active`	Boolean	A boolean indicating whether the record is active.
`app_instance.response.result.assigned_to`	String	The user assigned to the record.
`app_instance.response.result.caller_id`	JSON Object	The associated caller ID of the record.
`app_instance.response.result.impact`	String	The impact level of the record.
`app_instance.response.result.made_sla`	Boolean	A boolean indicating whether the record met its Service Level Agreement.
`app_instance.response.result.number`	String	The ServiceNow unique identifier of the record.
`app_instance.response.result.opened_by`	JSON Object	An object containing a link to the user who opened the record and the user's identifier.
`app_instance.response.result.parent`	String	The parent incident of the record created, if any.
`app_instance.response.result.state`	String	The current state of the record.
`app_instance.response.result.short_description`	String	A brief description of the record.
`app_instance.response.result.description`	String	A detailed description of the record.
`app_instance.response.result.sys_class_name`	String	The class of the record
`app_instance.response.result.contact_type`	String	The type of contact related to the record.
`app_instance.response.result.urgency`	String	The urgency level of the record.
`app_instance.response.result.approval`	String	The approval status of the record.
`app_instance.response.result.priority`	String	The priority level of the record.
`app_instance.response.result.sys_created_on`	String	The system created date and time of the record.
`app_instance.response.result.sys_updated_on`	String	The system updated date and time of the record.
`app_instance.response.result.closed_at`	String	The system closed date and time of the record.
`app_instance.response.result.comments`	String	The comments added to the record.
`app_instance.response.result.resolved_by`	String	ServiceNow ID of the user who resolved the record.
`app_instance.response.result.close_code`	String	ServiceNow close code of the record.

Action: Update Incident

This action updates an incident.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
System ID	Enter the system ID of the incident to be updated. Example: 57fe9b17dbd31010a3c28a18489619d1	Text	Required
Additional parameters	Enter the additional parameters to update in the incident in the form of key-value pairs. Example: "urgency": "1"	Key Value	Required

Parameter

Description

Field Type

Required/Optional

Comments

System ID

Enter the system ID of the incident to be updated.

Example:

57fe9b17dbd31010a3c28a18489619d1

Text

Required

Additional parameters

Enter the additional parameters to update in the incident in the form of key-value pairs.

Example:

"urgency": "1"

Key Value

Required

Example Request

[
    {
        "sys_id": "a3da1c0197c03110b963bf1e6253af53",
        "post_params": {
           "urgency": "1"
        }
    }
]

Action Response Parameters

Parameter	Field Type	Description
`{app_instance}`	JSON Object	This parameter indicates the ID of the app instance configured in Orchestrate from which the response is retrieved.
`app_instance.response`	JSON Object	Includes the details of the response retrieved from the action.
`app_instance.response.result`	JSON Object	The JSON object that includes the details of the incident.
`app_instance.response.result.active`	Boolean	A boolean indicating whether the incident is active.
`app_instance.response.result.assigned_to`	String	The user assigned to the incident.
`app_instance.response.result.caller_id`	JSON Object	The associated caller ID of the incident.
`app_instance.response.result.impact`	String	The impact level of the incident.
`app_instance.response.result.made_sla`	Boolean	A boolean indicating whether the incident met its Service Level Agreement.
`app_instance.response.result.number`	String	The ServiceNow unique identifier of the incident.
`app_instance.response.result.opened_by`	JSON Object	An object containing a link to the user who opened the incident and the user's identifier.
`app_instance.response.result.parent`	String	The parent incident of the incident created, if any.
`app_instance.response.result.state`	String	The current state of the incident.
`app_instance.response.result.short_description`	String	A brief description of the incident.
`app_instance.response.result.description`	String	A detailed description of the incident.
`app_instance.response.result.sys_class_name`	String	The class of the incident
`app_instance.response.result.contact_type`	String	The type of contact related to the incident.
`app_instance.response.result.urgency`	String	The urgency level of the incident.
`app_instance.response.result.approval`	String	The approval status of the incident.
`app_instance.response.result.priority`	String	The priority level of the incident.
`app_instance.response.result.sys_created_on`	String	Created date and time of the incident.
`app_instance.response.result.comments`	String	The comments added to the incident.
`app_instance.response.result.resolved_by`	String	ServiceNow ID of the user who resolved the incident.
`app_instance.response.result.close_code`	String	ServiceNow close code of the incident.

Quarterback AI

ServiceNow ITSM

Install and Configure the App

Action: Create Incident

Action: Get Change Request Record

Action: Get Incident Details by Incident Number

Action: Search Records From Table

Action: Update Incident

Search results