Configure ServiceNow to integrate with Arctic Wolf

You can configure ServiceNow® to synchronize incident tickets with Arctic Wolf®.

Requirements

• These ServiceNow accounts:
  • An account with the first name AWN, last name Integration, and User ID AWN.Integration that is used for a business rule filter.
  • A service account

    Note: The service account and the AWN.Integration account can either be the same account or separate accounts. Both accounts can have Web service access only selected in their user settings.

• This information provided by Arctic Wolf:
  • ServiceNow update sets
  • A webhook URL and security token

Before you begin

• Contact your Concierge Security® Team (CST) at security@arcticwolf.com to determine if ServiceNow Data Policy settings that are applied to the Incident table will impact integration.

Steps

1. Download ServiceNow update sets.
2. Import ServiceNow update sets.
3. Configure your ServiceNow ticketing integration.
4. Assign integration account role.
5. Update ServiceNow system properties.
6. Complete the ServiceNow integration process.

Step 1: Download ServiceNow update sets

1. Sign in to the Arctic Wolf Unified Portal.
2. Click Organization Profile.
3. In the navigation menu, click Integrations.
4. Click ServiceNow.
5. Click Update Sets.

Step 2: Import ServiceNow update sets

1. Sign in to your ServiceNow instance with administrator permissions.
2. In the Filter navigator search bar, enter Retrieved Update Sets.
3. In the search results, in the System Update Sets section, select Retrieved Update Sets.
4. For each update set received from Arctic Wolf, complete these steps:
   1. On the Retrieved Update Sets page, in the Related Links section, click Import Update Set from XML.
   2. On the Import XML page, click Browse.
   3. Select the Arctic Wolf update set that you downloaded in Before you begin.
   4. Click Upload.
   5. On the Retrieved Update Sets page, select the name of the Arctic Wolf update set.
   6. Click Preview Update Set.
   7. If there are conflicts between sys_properties in the update set and your ServiceNow instance, click Skip Remote Update to maintain your existing sys_properties configuration.
   8. For any remaining conflicts, select Accept Remote Update to accept the new changes.
   9. Click Close.
   10. Click Commit Update Set.
   11. Click Close when you are prompted by the "Succeeded 100%" message.

Step 3: Configure your ServiceNow ticketing integration

1. Sign in to the Arctic Wolf Unified Portal.

2. Click Organization Profile.

3. In the navigation menu, click Integrations.

4. Click ServiceNow.

5. In the Account Information section:

   • Select I acknowledge that I have downloaded and installed the prerequisite requirements.
   • ServiceNow URL — Enter the URL of the production ServiceNow tenant.

     Note: The URL must include https://. For example, https://<instance_name>.service-now.com.

   • ServiceNow Username — Enter the User ID for the service account that will be used for the Arctic Wolf integration.

     Note: If one account is used for both the service account and for business rule filtering, then the User ID must be AWN.Integration. See Requirements for more information.

   • ServiceNow Password — Enter a password for the service account.

6. Click Validate Credentials.

7. After receiving a “Validation Success” confirmation message, click Next: Sync Settings.

8. In the Sync Settings section:

   • Assignment Group Sys ID — Enter the Assignment group sys ID.
   • ServiceNow Company Sys ID — Enter the ServiceNow company sys ID.

     Note: This field only appears for customers that are not MSPs. MSPs enter this field during Synchronize tenants.

9. Under Priority Mapping, for each Arctic Wolf priority level, select a corresponding ServiceNow ticket ServiceNow Impact and ServiceNow Urgency.

10. Under Status Mapping, fill in these fields:

    • Solved — Select the ServiceNow ticket status that Arctic Wolf should use to mark a ticket as resolved.
    • Unresolved — Select the ServiceNow ticket status that Arctic Wolf should use to mark a ticket that gets reopened after it is marked as Solved.

11. Click Next: Webhook URL & Token.

    A webhook URL and client token is provided.

    Tip: You will need the webhook URL and client token to complete the ServiceNow integration process.

12. Click Done.

Step 4: Assign integration account role

1. In the Filter navigator search bar, enter User Administration.
2. In the search results, in the User Administration section, select Users.
3. Select the service account that was submitted in Provide your ServiceNow credentials to Arctic Wolf.
4. Click the Roles tab.
5. Click Edit.
6. In the Collection section, select AWN Integration Role.
7. Click > Add to add the role from Collection to the Roles List.
8. Click Save.

Step 5: Update ServiceNow system properties

1. In the Filter navigator bar, enter sys_properties.list.
2. On the System Properties page, click ArcticWolf_ENDPOINT_WEBHOOK_URL.
3. In the Value field, replace TO_DO_GET_FROM_ARCTIC_WOLF with the webhook URL provided by Arctic Wolf.
4. Select Ignore cache, if it is not already selected.
5. Click Update.
6. Repeat this process to update the ArcticWolf_ENDPOINT_WEBHOOK_TOKEN system property with the security token provided by Arctic Wolf.

Step 6: Complete the ServiceNow integration process

• Complete the appropriate task:
  • If you are not an MSP — Enable synchronization.
  • If you are an MSP — Synchronize tenants.

Enable synchronization

1. Toggle Sync Enabled on.

2. Click Request Sync Test.

   The Sync Test dialog appears.

3. Select a recipient.

   Tip: The list of recipients are the contacts in your contact directory. For more information, see User permissions.

4. To complete your ConnectWise integration, click Start Sync Test.

   The Arctic Wolf server checks for integration errors.

Synchronize tenants

In the Unified Portal, after you configure your ServiceNow ticketing integration, the organizations you manage in ServiceNow appear in the Customer List section. To complete your ServiceNow integration, you must synchronize at least one tenant.

1. In the Customer List section, for each organization, enter the corresponding ServiceNow company ID.

2. Under Actions, click Save.

3. Toggle Sync Enabled on for at least one customer.

   The Sync Test dialog opens the first time that you toggle this on.

4. Repeat these steps to enable synchronization for each organization:

   1. Under Actions, click > Request Sync Test.

      The Sync Test dialog appears.

   2. Select a recipient.

   3. To complete your ServiceNow integration, click Start Sync Test.

      The Arctic Wolf server checks for integration errors.

Next steps

• Complete Verifying ServiceNow Permissions.

See also

• ITSM integration