ServiceNow (incidents)

What the connector does

TechWatchAlert creates a ServiceNow incident or, if your instance has the Vulnerability Response module, a vulnerable item linked to the CVE. Urgency and impact follow the case's decision; ServiceNow computes the priority with its own matrix. The state comes back through a signed business rule you add to the instance, and through regular re-reads.

What comes into TechWatchAlert

• One incident per CVE and per project, with severity, EPSS, exploitation, component, fixed versions and a link to the alert
• Or a Vulnerability Response vulnerable item, linked to the CVE record in your instance
• The assignment group, caller, category and subcategory of your choice
• The status in the case: incident resolved, the case moves to “Fixed”, pending verification; canceled, you are offered an exception
• Optionally, the incident resolved with your resolution code once the fix is verified (Vulnerability Response items stay closed by the module)

Setup

1. In ServiceNow, create an integration account with the “itil” role and no web interface access, or a “client credentials” OAuth client tied to such a user
2. In the project settings, Integrations › Ticketing tools, add ServiceNow, choose Incidents or Vulnerability Response, then “Test and save”
3. Optional: add the provided business rule, signed with the secret given by TechWatchAlert, so the state comes back immediately