Introduction and operation

This plugin enables the automatic creation, update and closure of Service Now incidents from Pandora FMS. 

Creation of incidents

In case an altered status (e.g. Critical, Warning) is detected for the modules configured in Pandora, the integration plugin will be executed to create an incident in Service Now, or to update it in case it already exists.

The information used to create the incidents in Service Now is:

• Name of the failed asset. Must match the name specified in Service Now. It is recommended to use the agent's alias or name for this. 

• In case a valid asset with that name is not found, the incident will be generated with a generic asset “PandoraAPI”.

• Title of the incident, indicating the names of the affected agent and module.

• Descriptive message of the error. Fully customizable, being able to indicate, among others:

• Name of agent.

• Name and ID of the affected module.

• Condition and value of the affected module.

• Date and time of the problem.

• Indication that the incident has been generated with a generic asset, if so.

• Other data necessary for the generation of the incidence, such as:

• Prioritizing advocacy

• The opening group 

• If applicable, data required by the SN itself, such as environment, object and operational type. 

When the incident is created, Pandora stores its ID in the custom_id field of the affected module for its later use in updates or for its closing. This implies that each module can only have one open incident in Service Now.

Update of incidences

In case the plugin acts on a module that already has an issue registered in its custom_id, this reference is taken to update the open ticket, which can:

• Add an internal note to the ticket with the relevant changes in the module (e.g. change of status from Critical to Warning).

• Change the priority of the issue

Closing of incidents

The integration can also be used to close incidents associated to modules, as long as they have an incident ID in their custom_id. In this case the purpose of such execution is the validation of the issue in Service Now. For this purpose the plugin:

• Acquires the ID of the open issue for the module in its custom_id field.

• Remotely closes the Service now incident, adding a resolution epilogue to indicate that the incident has been closed automatically from Pandora FMS.

• It empties the custom_id of the affected module in Pandora FMS, so a new problem in this module will start the process from the beginning, with a new incident.

The flow for creating and updating requests is shown in the diagram below.