snowincident

Feedback:

Send email

snowincident

Use the snowincident operator to create an incident in ServiceNow.

Syntax

`snowcategory=<string\|field>`	Optional. Specify a ServiceNow incident category, for example, `Phishing`, `Policy violation`.
`snowshort_description=<string\|field>`	Optional. Specify a short incident description.
`snowcontact_type=<string\|field>`	Optional. Specify a preferred contact type, for example, `Phone`, `Email`.
`snowurgency=<integer\|field>`	Optional. Specify an incident urgency.
`snowsubcategory=<string\|field>`	Optional. Specify an incident subcategory, for example, `Spear phishing`.
`snowstate=<string\|field>`	Optional. Specify an incident state, for example, `Analysis`.
`snowlocation=<string\|field>`	Optional. Specify an incident location, foe example, `California`.
`snowimpact=<integer\|field>`	Optional. Describe the incident's impact on the business.
`snowpriority=<integer\|field>`	Optional. Specify an incident priority.
`snowassignment_group=<string\|field>`	Optional. Specify a preferred assignment group.
`snowcomments=<string\|field>`	Optional. Specify additional comments separated with a comma.
`snowexternal_url=<string\|field>`	Optional. Specify URLs related to the incident.
`snowcorrelation_id=<string\|field>`	Optional. Specify an incident correlation ID.
`snowcustom_fields=<string\|field>`	Optional. Specify custom fields and their values separated with the `\|\|` symbol. All custom fields must be configured in the ServiceNow instance first. The parameters passed in custom fields must be configured in the ServiceNow Incident table and the appropriate transform map in ServiceNow. For example, `u_affected_user` and `u_caller_id` must be present in your ServiceNow Incident table.

Usage

You can use the snowincident operator to create ServiceNow incidents. As a result, you will get the Incident Link column containing the URL that you can use to navigate to the incident in ServiceNow.

Default values of the arguments depend on the default values that are configured in your ServiceNow instance. For example, if the Comment field in ServiceNow is configured to be an empty string by default, then the default value for the snowcomments argument will be an empty string as well.

Note: Using the operator with the same set of constant arguments one more time during single transaction will not create another ServiceNow incident.

Note: Avoid using this operator with large tables as creating a large number of events may take long.

Examples

Example 1: Create a ServiceNow incident with comprehensive field values.

Copy

|limit 1 | snowincident snowcategory="Denial of Service" snowshort_description="test description" snowcontact_type="Phone" snowurgency=1 snowsubcategory="Inbound DDos" snowstate="Analysis" snowlocation="New Castle" snowimpact=1 snowpriority=5 snowassignment_group="Security Incident Assignment" snowcomments="test comment

Example 2: Takes 2 OCSF events and creates a ServiceNow incident for each, populating category, urgency, impact, priority, assignment group, location, and custom fields.

Copy

ocsf | limit 2 | snowincident snowcategory='Denial of Service' snowshort_description=activity_name snowcontact_type='Phone' snowurgency=1 snowsubcategory='Inbound DDos' snowstate='Analysis' snowlocation='New Castle' snowimpact=1 snowpriority=5 snowassignment_group='Security Incident Assignment' snowcomments='test comment' snowexternal_url=metadata.product.name snowcorrelation_id='1' snowcustom_fields='caller=Meredith Ivrin'

`snowcategory=<string\|field>`	Optional. Specify a ServiceNow incident category, for example, `Phishing`, `Policy violation`.
`snowshort_description=<string\|field>`	Optional. Specify a short incident description.
`snowcontact_type=<string\|field>`	Optional. Specify a preferred contact type, for example, `Phone`, `Email`.
`snowurgency=<integer\|field>`	Optional. Specify an incident urgency.
`snowsubcategory=<string\|field>`	Optional. Specify an incident subcategory, for example, `Spear phishing`.
`snowstate=<string\|field>`	Optional. Specify an incident state, for example, `Analysis`.
`snowlocation=<string\|field>`	Optional. Specify an incident location, foe example, `California`.
`snowimpact=<integer\|field>`	Optional. Describe the incident's impact on the business.
`snowpriority=<integer\|field>`	Optional. Specify an incident priority.
`snowassignment_group=<string\|field>`	Optional. Specify a preferred assignment group.
`snowcomments=<string\|field>`	Optional. Specify additional comments separated with a comma.
`snowexternal_url=<string\|field>`	Optional. Specify URLs related to the incident.
`snowcorrelation_id=<string\|field>`	Optional. Specify an incident correlation ID.
`snowcustom_fields=<string\|field>`	Optional. Specify custom fields and their values separated with the `\|\|` symbol. All custom fields must be configured in the ServiceNow instance first. The parameters passed in custom fields must be configured in the ServiceNow Incident table and the appropriate transform map in ServiceNow. For example, `u_affected_user` and `u_caller_id` must be present in your ServiceNow Incident table.