Menu
Documentationbreadcrumb arrow Grafana Cloudbreadcrumb arrow Alerts and IRMbreadcrumb arrow IRMbreadcrumb arrow Configurebreadcrumb arrow Integrationsbreadcrumb arrow Integration referencebreadcrumb arrow OnCall integrationsbreadcrumb arrow ServiceNow
Grafana Cloud

ServiceNow integration for Grafana IRM

Integrate ServiceNow with Grafana IRM for bidirectional functionality that automatically creates and updates incidents in ServiceNow based on Grafana IRM alert groups, and vice versa. Whether your alerts originate from ServiceNow or another integration like Alertmanager or Grafana Alerting, you can manage updates and status changes directly from ServiceNow.

Use this integration to automate the following processes:

  • Create an incident in ServiceNow when an alert group is created in IRM
  • Update the incident state in ServiceNow when the alert group status changes in IRM
  • Create an alert group in IRM when an incident is created in ServiceNow
  • Update the alert group status in IRM when the incident state changes in ServiceNow

Before you begin

Before configuring the integration, ensure you or your ServiceNow Admin have created a Service account specifically for Grafana IRM integration.

Follow these steps to create a ServiceNow user for Grafana IRM:

  1. In ServiceNow, navigate to User Administration > Users and click New
  2. Fill in the following details:
    • Username: grafana-irm
    • First name: Grafana IRM
    • Active: ✔
    • Web service access only: ✔
  3. After creating the user, generate a password using the Set Password button. Securely store the password for later use
  4. Navigate to the Roles tab and grant the following roles to the user:
    • itil (for incident creation and updates)
    • personalize_choices (to fetch the list of available incident states)

Configure ServiceNow integration

Create integration

  1. In Grafana IRM, navigate to IRM > Integrations > Monitoring Systems
  2. Click + New integration
  3. Select ServiceNow from the list of available integrations
  4. Enter a name and description for the integration
  5. Enter ServiceNow credentials (instance URL, username, and password of the Grafana IRM user) and verify the connection
  6. Ensure Create default outgoing webhooks is enabled to create necessary webhooks in Grafana IRM for sending alerts to ServiceNow
  7. Click Create integration

Map incident states

Map ServiceNow incident states to IRM alert group statuses.

Example:

  • Firing -> New
  • Acknowledged -> In Progress
  • Resolved -> Resolved
  • Silenced -> Not Selected

Generate Business Rule script

Generate a ServiceNow Business Rule script to enable your ServiceNow instance to send updates to Grafana IRM.

Note

You can’t view the script again after closing the dialog, but you can regenerate it at any time in integration settings.

  1. Generate a new ServiceNow Business Rule script and copy it to your clipboard
  2. In ServiceNow, navigate to System Definition > Business Rules and click New
  3. Fill in the following details:
    • Name: grafana-irm
    • Table: incident
    • Active: ✔
    • Advanced: ✔
    • When to run > When: before
    • When to run > Insert: ✔
    • When to run > Update: ✔
    • Advanced > Script: Paste the generated script
  4. Click Submit to save the Business Rule

In Grafana IRM, click Proceed to complete the integration setup.

Test the integration

  1. Create a new incident in ServiceNow
  2. Verify that a new alert group is created in Grafana IRM
  3. Acknowledge the alert group in Grafana IRM, and verify that the incident state is updated in ServiceNow
  4. Resolve the incident in ServiceNow, and verify that the alert group status is updated in Grafana IRM

Connect other integrations

You can connect other integrations such as Alertmanager, Grafana Alerting, and others to your ServiceNow integration for a consolidated workflow. When connected, Grafana IRM sends alerts from the connected integrations to ServiceNow and update alert groups on the connected integrations based on incident state changes in ServiceNow. Connected integrations utilize the same ServiceNow credentials and outgoing webhooks as the ServiceNow integration they are connected to.

To connect other integrations:

  1. Navigate to the Outgoing tab of an existing ServiceNow integration
  2. Use the Send data from other integrations section to connect other integrations
  3. Enable the backsync option if you want alert groups from connected integrations to be updated from ServiceNow. If disabled, Grafana IRM will only send alerts to ServiceNow, but not receive updates back
  4. Test the connection by creating a demo alert for the connected integration
    • Verify that an incident is created in ServiceNow
    • Verify that incident state changes in ServiceNow are reflected in Grafana IRM, and vice-versa

Advanced usage

Customize the integration behavior according to your needs by editing the outgoing webhooks on the Outgoing tab of the integration.

Custom incident fields

You can set custom fields on ServiceNow incidents. To do so, edit the Alert group created webhook on the Outgoing tab of the integration.

Example: Set the “urgency” field based on alert group labels, add the provided JSON to Data template:

json 
{
  ...,
  "urgency": "{{ alert_group.labels.urgency }}"
}