Skip to main content

Send incidents to ServiceNow

You can enable bidirectional communication between Moogsoft Cloud Incidents and your ServiceNow incident management system. After you complete the integration, the two systems keep information synchronized so that:

  • A ServiceNow incident can be created automatically from a Moogsoft Cloud incident.

  • The ServiceNow incident contains a link back to the Moogsoft Cloud incident.

  • When the Moogsoft Cloud incident is updated, updates may be passed to the ServiceNow incident.

  • The initial incident creation, as well as subsequent updates, may pass a list of Affected CIs to add to the incident ticket.

  • When the Moogsoft Cloud incident is either resolved or closed, the ServiceNow incident can be automatically resolved.

  • When the ServiceNow incident is assigned, the Moogsoft Cloud incident will also be assigned, provided that a user exists in Moogsoft Cloud with a matching email address.

  • Work notes added to the ServiceNow incident can be passed as comments to the Moogsoft Cloud incident.

  • When the ServiceNow incident is resolved, the corresponding Moogsoft Cloud incident can be automatically resolved.

  • ServiceNow Change Requests can create and maintain Moogsoft Cloud maintenance windows.

  • ServiceNow Change requests can be manually linked to impacted Moogsoft Cloud incidents.

See the ServiceNow documentation for details on ServiceNow components.

Before you begin

The ServiceNow integration has been validated with the ServiceNow Tokyo, San Diego, Rome and Quebec releases. Before you set up your ServiceNow integration:

  • Note the URL of your ServiceNow incident management instance.

  • Make sure you have a valid Moogsoft Cloud API Key. To create a new API Key:

    1. Within Moogsoft Cloud, navigate to Settings > API Key Management.

    2. Click on the plus (+) button to create a new API key.

    3. Provide a name and description for the API key. Then click Create.

    4. Copy your new API key and save it for future use.

  • Make sure you have an email address for a Moogsoft Cloud integration user (optional).

  • Make sure you have the UUID for your Moogsoft Cloud instance (to enable the ability to manually link ServiceNow changes to Moogsoft Cloud incidents).

Configure ServiceNow

To configure the integrations user and XML update set for ServiceNow:

  1. Download the XML update set file, which you can find here.

  2. In the ServiceNow UI, import the update set and open it. Refer to the ServiceNow documentation for detailed instructions.

  3. Preview the update set. The preview attempts to load and fails with an error message similar to: "Preview problems for Moogsoft. To commit this update set you must address all problems". Close the message to view the list of preview problems.

  4. Select all preview problems and then accept the remote update.

  5. Commit the update set. Ignore the dictionary error that appears and proceed with the commit.

  6. To verify that the update is successful, type "moogsoft" into the filter navigator and confirm that the Moogsoft Cloud Integration update set is displayed.

  7. Now that the update set is installed, you can choose to do one of the following:

Configure automatically

To perform the remaining configuration automatically using the update set:

  1. Locate "Moogsoft Properties" using the filter navigator in ServiceNow and edit the properties as follows. Set all the checkboxes to "true" and supply the required details. This will automatically complete the remaining configuration steps in both ServiceNow and Moogsoft Cloud:

    Property name


    Moogsoft Integration ServiceNow User


    Create the ServiceNow Integration User Account

    Automatically create the ServiceNow user for the Moogsoft Cloud integration. Disabled by default.

    ServiceNow Integration Password

    The password to use for the ServiceNow integration user, if using automated configuration.

    Moogsoft Instance

    Moogsoft API Key

    The Moogsoft Cloud API Key. Must be supplied for bi-directional communication.

    Moogsoft UUID

    The UUID of your Moogsoft Cloud instance, which is displayed in the URL when logged into the Moogsoft Cloud UI. Example:{uuid}/incidents

    You must fill out this property in order to allow ServiceNow change records to be manually linked to Moogsoft Cloud incidents. For more information about this feature, see this page.

    Moogsoft API Retry Limit

    The number of times to attempt a Moogsoft Cloud API call. Default is 3.

    Moogsoft API Timeout (In Seconds)

    Request waiting time in the ECC Queue in seconds. Default is 10 seconds.

    Note: To configure this property for more than 30 seconds, add or update the ServiceNow glide.http.outbound.max_timeout.enabled system property to false.

    Enable Moogsoft Incident Integration

    Automatically create the catalog and workflow in Moogsoft Cloud for the Maintenance Windows integration.

    Name of Moogsoft Credential Set used for Outbound Webhook

    The name of a preconfigured Moogsoft Cloud credential set containing the username and password of the ServiceNow integration user.

    Enable to append rather than replace the Affected CI list on update

    When processing affected_cis passed from Moogsoft Cloud, this option will merge the CI data from the initial incident creation with the data from subsequent updates. If disabled, the affected_cis from the last received update will replace the Affected CI list in the incident. Enabled by default.

    Enable closing of Moogsoft Incident

    Enable to automatically close a Situation when you close the associated ticket in ServiceNow. Disabled by default.

    Moogsoft Assignee Email

    The email address of a Moogsoft Cloud user that can be used for automated assignment. Optional - defaults to the owner of the API key.

    Create Moogsoft Assignee

    Automatically create a new user if a user doesn’t already exist, using the assignee email address supplied. Disabled by default.

    Enable Moogsoft Maintenance Window integration

    Enable automatic creation and removal of Moogsoft Cloud catalog entries for maintenance window management. Disabled by default.

    Enable Incident Assignment

    When incidents are assigned to a user in ServiceNow, corresponding incidents in Moogsoft Cloud will be assigned to a matching Moogsoft Cloud user, whenever possible.

    User email addresses must be the same in both ServiceNow and Moogsoft Cloud.

    Forward Work Notes

    Allow work notes added to ServiceNow incidents to be forwarded as comments to the corresponding incident in Moogsoft Cloud.

    Priority Mappings:

    Map Moogsoft Cloud Severity to ServiceNow Priority values.

    Priority for Critical


    Priority for Major


    Priority for Minor


    Priority for Warning


    Priority for Unknown


    Priority Settings:

    Adjust each priority to match the corresponding Impact and Urgency values for your environment. For example, setting "Priority High" to "Medium:High" maps a P2 (High priority) to an Impact of Medium and an Urgency of High.

    Priority Critical


    Priority High


    Priority Moderate


    Priority Low


  2. Within Moogsoft Cloud:

    1. Update any correlation definitions to filter out incidents under maintenance.

    2. Review the payload in the outbound webhook and adjust as required.

    3. See next steps.


    If you are using a credential set in Moogsoft Cloud to hold the ServiceNow integration user details, you will need to create this credential set manually before you set the Enable Moogsoft Cloud Incident Integration property.

Priority mapping and priority settings

The priority mapping section of the properties allows mapping from Moogsoft Cloud Incident severity to ServiceNow Impact and Urgency. By selecting a priority value for each severity, any incidents with the matching severity will create a ServiceNow incident with equivalent Impact and Urgency. By default, the Priority values map to Urgency and Impact as follows:
















These default assignments can be modified to reflect the local customizations in the Priority Settings section.

Configure manually

To perform the remaining configuration manually:

  1. Add a ServiceNow user:

    1. Create an integration user in ServiceNow. The user name should match the configured Moogsoft Integration ServiceNow User property. For example: "moogint"

    2. Assign the following roles to the user:

      • x_moogs_incident_m.import: Allows Moogsoft Cloud to create and resolve incidents.

      • x_moogs_incident_m_properties_user: Allows the ServiceNow user to edit Moogsoft Cloud properties.

      • incident_manager: Allows the auto-assign feature to assign new incidents to the logged in user.

  2. Create a user in Moogsoft Cloud:

    1. Navigate to Settings > User Management.

    2. Click on the plus (+) button to invite a new user.

    3. Provide a first and last name for the new user.

    4. For the email field, use the email matching the configured Moogsoft Assignee Email property in ServiceNow.

    5. Set the role as "operator" and click Invite.

  3. Configure the Moogsoft Cloud Outbound Webhook:

    1. Log into Moogsoft Cloud and navigate to Outbound Integrations > Webhook.

    2. Click Add a Webhook, and complete each section according to the following:

      1. Name and scope:

        1. Provide a unique name and select a type of “Incident”.

        2. Within the filter section, add conditions to control which incidents or updates are forwarded to ServiceNow.

      2. CREATE operations and HTTP configuration:

        1. Set the request method as "POST".

        2. Make sure that the URL is in the following form:

          https://<servicenow instance>/api/now/v1/import/x_moogs_incident_m_moog_inbound_incident

          For example:

        3. Select Basic Auth for authorization.

        4. Create a new credential set with the username and password for the ServiceNow integration user you created.

        5. Set the header to the following:

          Content-Type: application/json
      3. Payload body for CREATE operation:

        1. Paste the following into the Key/Value Editor box:

              "u_inc_id": "$id",
              "u_payload": '{"short_description":"$description","assignment_group":"Software","category":"software","subcategory":"os","cmdb_ci":"CMS App FLX","caller_id":"moogint"}',
              "u_affected_cis": "$tags.affected_ci",
              "u_inc_url" : "$incident_url",
              "u_severity": "$severity"

          The u_payload section is a JSON string containing the ServiceNow fields you want to populate. You should customize this object for your environment. It needs to be a string, hence the surrounding single quotes.

      4. UPDATE notifications:

        1. Enable update notifications to open up the remaining sections. The Method and URL should be pre-populated with the values entered in section 1.

        2. For the Ticket identifier, set the External Webhook Target to "User-Defined".

        3. Add the following regex into the Attribute Key with External ID text box:

        4. Extract the Ticket number by adding the following regex into the Attribute Key with External Name text box:

        5. Select the conditions that should trigger update notifications. Initially, just start with Status Change to allow for resolution of the ServiceNow incident when the Moogsoft Cloud incident closes.

      5. Payload body for UPDATE operation:

        1. Paste the following into the Key/Value Editor box:

              “u_inc_id”: “$id”,
              “u_payload”: ‘{“short_description”:“$description”,“assigned_to”:“$assignee”}’,
              “u_affected_cis”: “$tags.affected_ci”,
              “u_snc_id”: “$external_id”,
              “u_inc_url” : “$incident_url”,
              “u_severity”: “$severity”

          The u_payload section is a JSON string containing the optional ServiceNow fields you want to update. You should customize this string for your environment. It needs to be a string, hence the surrounding single quotes.


          You can use the $assignee token to populate assigned_to in a ServiceNow incident when a corresponding incident is assigned in Moogsoft Cloud. For this to work, there are two requirements:

          • You must have an email assigned to your ServiceNow account that matches your email address in Moogsoft Cloud.

          • If the ServiceNow Assignment group is set, you must be a member of that group.

    3. Test and then save your changes.

Next Steps

Once you have finished configuring your ServiceNow integration, you can learn more about how to: