Configure ServiceNow to integrate with Arctic Wolf

You can configure ServiceNow® to synchronize incident tickets with Arctic Wolf®.

Note: The Arctic Wolf ServiceNow® integration only integrates with your Incident table.
These resources are required:
  • These ServiceNow accounts:
    • An account with the first name AWN, last name Integration, and user ID AWN.Integration that is used for a business rule filter.
    • A service account
      Note: The service account and the AWN.Integration account can either be the same account or separate accounts. Both accounts can have Web service access only selected in their user settings.
  • This information provided by Arctic Wolf:
    • ServiceNow update sets
    • A webhook URL and security token
These actions are required:
  • Contact your Concierge Security® Team (CST) at security@arcticwolf.com to determine if ServiceNow Data Policy settings that are applied to the Incident table will impact integration.

Download ServiceNow update sets

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Organization Profile > Integrations.
  3. Click the ITSM tab.
  4. Click ServiceNow.
  5. Click Update Sets.
  6. Unzip the downloaded file.

Import ServiceNow update sets

Note: An AWN.Integration account must be created before completing this procedure. For prerequisites, see Configure ServiceNow to integrate with Arctic Wolf.
  1. Sign in to your ServiceNow instance with administrator permissions.
  2. In the Filter navigator search bar, enter Retrieved Update Sets.
  3. In the search results, in the System Update Sets section, select Retrieved Update Sets.
  4. For each update set received from Arctic Wolf, complete these steps:
    1. On the Retrieved Update Sets page, in the Related Links section, click Import Update Set from XML.
    2. On the Import XML page, click Choose File.
    3. Select the Arctic Wolf update set that you downloaded as a prerequisite action.
    4. Click Upload.
    5. On the Retrieved Update Sets page, select the name of the Arctic Wolf update set.
    6. Click Preview Update Set.
    7. If there are conflicts between sys_properties in the update set and your ServiceNow instance, click Skip Remote Update to maintain your existing sys_properties configuration.
    8. For any remaining conflicts, select Accept Remote Update to accept the new changes.
    9. Click Close.
    10. Click Commit Update Set.
    11. When you are prompted by the "Succeeded 100%" message, click Close.

Assign integration account role

  1. In the Filter navigator search bar, enter User Administration.
  2. In the search results, in the User Administration section, select Users.
  3. Select the user ID for the service account that will be used for the Arctic Wolf integration.
    Note: If one account is used for both the service account and for business rule filtering, then the user ID must be AWN.Integration. For prerequisites, see Configure ServiceNow to integrate with Arctic Wolf.
  4. Click the Roles tab.
  5. Click Edit.
  6. In the Collection section, select AWN Integration Role.
  7. Click > Add to add the role from Collection to the Roles List.
  8. Click Save.

Configure your ServiceNow ticketing integration

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Organization Profile > Integrations.
  3. Click the ITSM tab.
  4. Click ServiceNow.
    Note: You can change your integration at any time, for example, to ConnectWise. In the Integration Type section, click Change Integration, and then in the Change Integration window, click Remove Integration. Your ITSM integration settings are removed and you can select a different integration option.
  5. In the Account Information section:
    • Select I acknowledge that I have downloaded and installed the prerequisite requirements.
    • ServiceNow URL — Enter the URL of the production ServiceNow tenant.
      Note: The URL must include https://. For example, https://instance_name.service-now.com.
    • ServiceNow Username — Enter the user ID for the service account that you updated in Assign integration account role.
    • ServiceNow Password — Enter a password for the service account.
  6. Click Validate Credentials.
  7. After receiving a "Validation Success" confirmation message, click Next: Sync Settings.
  8. In the Sync Settings section:
    • Assignment Group Sys ID — Enter the Assignment group sys ID.
    • ServiceNow Company Sys ID — Enter the ServiceNow company sys ID.
      Note: This field does not appear if you are an MSP. MSPs fill in this field during Synchronize tenants for ServiceNow.
  9. Optional: In the Status for Ticket Routing section, select a ServiceNow ticket status that you will use to stop syncing tickets with Arctic Wolf.
    The ServiceNow status you select to stop syncing tickets cannot be used for status mapping.
    Note: When a ticket is unlinked, Arctic Wolf can no longer update the ticket. Unlinked tickets cannot be synced again.
  10. In the Priority Mapping section, for each Arctic Wolf priority level, select a corresponding ServiceNow ticket ServiceNow Impact and ServiceNow Urgency.
  11. In the Status Mapping section:
    • Solved — Select the ServiceNow ticket status that Arctic Wolf should use to mark a ticket as resolved.
    • Unresolved — Select the ServiceNow ticket status that Arctic Wolf should use to mark a ticket that gets reopened after it is marked as Solved.
  12. Click Next: Webhook URL & Token.
    A webhook URL and client token is provided.
    Note: You will need the webhook URL and client token to complete the ServiceNow integration process.
  13. Click Done.

Update ServiceNow system properties

  1. In the Filter navigator bar, type sys_properties.list, and then press Enter.
  2. On the System Properties page, click ArcticWolf_ENDPOINT_WEBHOOK_URL.
  3. In the Value field, replace TO_DO_GET_FROM_ARCTIC_WOLF with the webhook URL provided by Arctic Wolf.
  4. Select Ignore cache, if it is not already selected.
  5. Click Update.
  6. Repeat this process to update the ArcticWolf_ENDPOINT_WEBHOOK_TOKEN system property with the security token provided by Arctic Wolf.

Complete the ServiceNow integration process

Complete the appropriate task:

Enable synchronization

  1. In the Unified Portal, toggle Sync Enabled on.
  2. Click Request Sync Test.
    The Sync Test dialog appears.
  3. Select a recipient.
    Tip: The list of recipients are the contacts in your contact directory. For more information, see User permissions.
  4. Click Start Sync Test.
    The Arctic Wolf server checks for integration errors.

Synchronize tenants for ServiceNow

In the Unified Portal, after you configure your ServiceNow ticketing integration, the organizations you manage in ServiceNow appear in the Customer List section. To complete your ServiceNow integration, you must synchronize at least one tenant.

Note: This task is for MSPs.
  1. In the Customer List section, for each organization, enter the corresponding ServiceNow company ID.
  2. Under Actions, click Save.
  3. Toggle Sync Enabled on for at least one customer.
    The Sync Test dialog opens the first time that you toggle this on.
  4. Repeat these steps to enable synchronization for each organization:
    1. Under Actions, click > Request Sync Test.
      The Sync Test dialog appears.
    2. Select a recipient.
    3. To complete your ServiceNow integration, click Start Sync Test.
      The Arctic Wolf server checks for integration errors.