External DocumentationTo learn more, visit the ServiceNow documentation.
Parameters
| Parameter | Description |
|---|---|
| Incident Fields | A JSON map of fields to apply on the incident. ”urgency”/“impact” fields may contain the values “1” (High), “2” (Medium), “3”(Low). “assigned_to” field contains the username/ID of the user that the incident will be assigned to. |
| System ID | The ID assigned to the record. |
| Table Name | The name of the table, such as “incident” or “asset”. |
Example Output
{
"result": {
"parent": "",
"u_vendor_name": "<string>",
"u_related_edr_record": "<string>",
"watch_list": "",
"related_party_users": "<string>",
"sys_updated_on": "2022-12-21 04:08:52",
"u_search_id": "<string>",
"u_source_ip": "<string>",
"environment_type": "<string>",
"skills": "<string>",
"u_mttdrv": "<string>",
"u_wba_dsep": "<string>",
"state": "In Progress",
"sys_created_by": "admin",
"knowledge": "false",
"u_subcategory": "<string>",
"u_incident_type": "<string>",
"impact": "1 - High",
"active": "true",
"auto_created_case": "<string>",
"log_source_type": "<string>",
"first_response_time": "<string>",
"group_list": "",
"platform_enablement_phase": "<string>",
"u_vendor_ref_number": "<string>",
"u_cis_control": "<string>",
"correlation_display": "",
"u_mtt_detect": "<string>",
"u_user": "<string>",
"follow_up": "",
"u_customer_reference_number": "<string>",
"contact_local_time": "<string>",
"u_customer_declared_incident": "<string>",
"u_last_additional_comment": "<string>",
"u_vsoc_detect": "<string>",
"u_case_type": "<string>",
"u_alert_time": "<string>",
"u_planned_start_date": "<string>",
"story_points": "<string>",
"priority_changed": "<string>",
"u_splunk_link": "<string>",
"u_first_assigned_on": "<string>",
"u_category": "<string>",
"partner": "<string>",
"stage": "<string>",
"u_reopen_count": "<string>",
"escalation": "Normal",
"correlation_id": "",
"u_exclude_from_torq_auto_closure": "<string>",
"u_soar_link": "<string>",
"made_sla": "true",
"u_destination_ip": "<string>",
"project": "<string>",
"u_first_assigned_engineer": "<string>",
"u_security_incident": "<string>",
"user_input": "",
"sys_created_on": "2022-12-21 04:08:52",
"contact": "<string>",
"impact_changed": "<string>",
"route_reason": "",
"u_event_name": "<string>",
"closed_at": "",
"u_dw_correlation": "<string>",
"follow_the_sun": "<string>",
"u_qa_notes": "<string>",
"u_documentation_link": "<string>",
"business_impact": "",
"u_agent_type": "<string>",
"time_worked": "",
"work_end": "",
"u_related_mdr_record": "<string>",
"u_qa_assignee": "<string>",
"subcategory": null,
"u_hosts": "<string>",
"assignment_group": {
"link": "<string>",
"value": "<string>"
},
"customer_updated_by": "<string>",
"u_request_issue": "<string>",
"u_marked_for_sanitization": "<string>",
"description": "Example long description",
"proactive": "<string>",
"u_data_source": {
"link": "<string>",
"value": "<string>"
},
"u_mtta": "<string>",
"x_virta_mitre_tactic_list": "<string>",
"sys_id": "a39da5d387f7d1105e5cfd57dabb35e5",
"probable_cause": "<string>",
"urgency": "1 - High",
"major_case_state": "<string>",
"u_dw_escalated_by": "<string>",
"approval": "Not Yet Requested",
"u_event_time": "<string>",
"u_soar_incident_id": "<string>",
"u_dw_mttca": "<string>",
"project_task": "<string>",
"internal_user": "<string>",
"sys_tags": "",
"u_file_path": "<string>",
"u_declared_incident_time": "<string>",
"u_mtti": "<string>",
"u_mttd": "<string>",
"u_mttc": "<string>",
"u_customer_validation_state": "<string>",
"u_mttn": "<string>",
"related_party_consumers": "<string>",
"u_mttca": "<string>",
"upon_reject": "Cancel all future Tasks",
"support_manager": "<string>",
"approval_history": "",
"u_schedule_type": "<string>",
"feedback": "<string>",
"number": "INC0010034",
"u_destination_port": "<string>",
"u_mitre_tactic": "<string>",
"u_mttcw": "<string>",
"u_mttcv": "<string>",
"case": "<string>",
"order": "",
"u_event_of_interest": "<string>",
"u_splunk_search": "<string>",
"u_mttdi": "<string>",
"contract": "",
"priority": "1 - Critical",
"sys_domain_path": "/",
"u_customer_ack_time": "<string>",
"business_duration": "",
"child_case_creation_progress": "<string>",
"sync_driver": "<string>",
"u_customer_validation_time": "<string>",
"x_pd_integration_incident_id": "<string>",
"universal_request": "",
"short_description": "Example Incident Title",
"work_start": "",
"additional_assignee_list": "",
"notify": "Do Not Notify",
"sys_class_name": "Incident",
"closed_by": {
"link": "<string>",
"value": "<string>"
},
"reassignment_count": "0",
"contact_time_zone": "<string>",
"contributor_users": "<string>",
"notes_to_comments": "<string>",
"u_related_fw_record": "<string>",
"assigned_to": "<string>",
"u_search_name": "<string>",
"u_source_hostname": "<string>",
"product": "<string>",
"u_customer_assignment_time": "<string>",
"u_mitre_technique": "<string>",
"sla_due": "UNKNOWN",
"u_file_name": "<string>",
"u_customer_notification_group": {
"link": "<string>",
"value": "<string>"
},
"u_mttdwv": "<string>",
"upon_approval": "Proceed to Next Task",
"partner_contact": "<string>",
"customer_updated": "<string>",
"asset": "<string>",
"u_mitre_sub_technique_list": "<string>",
"feedback_submitter": "<string>",
"u_threat_hunt_outcomes": "<string>",
"u_jira_ref_number": "<string>",
"sprint_status": "<string>",
"task_effective_number": "INC0010034",
"resolved_by": {
"link": "<string>",
"value": "<string>"
},
"sys_updated_by": "admin",
"u_mttca_2": "<string>",
"opened_by": {
"link": "https://dev125455.service-now.com/api/now/table/sys_user/6816f79cc0a8016401c5a33be04be441",
"value": "<string>"
},
"u_suppress_email_notifications": "<string>",
"sys_domain": {
"link": "https://dev125455.service-now.com/api/now/table/sys_user_group/global",
"value": "<string>"
},
"u_outcome_severity": "<string>",
"tuning_recommendation": "<string>",
"u_mttdwc": "<string>",
"contributor_groups": "<string>",
"u_credentials_compromised": "<string>",
"business_service": "",
"entitlement": "<string>",
"u_on_hold_reason": "<string>",
"u_change_type": "<string>",
"u_ioc": "<string>",
"expected_start": "",
"opened_at": "2022-12-21 04:08:52",
"x_virta_mitre_mitigation_list": "<string>",
"resolved_at": "",
"u_mtt_response": "<string>",
"u_destination_hostname": "<string>",
"u_mtt_validate": "<string>",
"cause": "",
"calendar_duration": "",
"close_notes": "",
"auto_close": "<string>",
"contact_type": null,
"u_planned_end_date": "<string>",
"resolution_code": "<string>",
"u_related_vms_record": "<string>",
"u_reporting_device": "<string>",
"activity_due": "2022-12-21 06:08:52",
"x_virta_mitre_technique_list": "<string>",
"comments": "",
"due_date": "",
"sys_mod_count": "0",
"u_file_hash": "<string>",
"u_mttrv": "<string>",
"tell_us_how_we_did": "<string>",
"u_customer_acknowledgement_time": "<string>",
"u_alert_assignment_time": "<string>",
"category": "Inquiry / Help",
"account": {
"link": "<string>",
"value": "<string>"
},
"u_string_1": "<string>"
}
}
Workflow Library Example
Forcepoint Dlp on Confidential Email Alert Ask User for Reason and Request Approval