External DocumentationTo learn more, visit the ServiceNow documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Query | An encoded query string used to filter the results. |
| Table Name | The name of the table, such as “incident” or “asset”. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Display Value | Determines the type of data returned, either the actual values from the database or the display values of the fields. Display values are manipulated based on the actual value in the database and user or system settings and preferences. Valid values: - true: Returns the display values for all fields. - false: Returns the actual values from the database. - all: Returns both actual and display values. |
| Response Fields | Comma-separated list of fields to return in the response. |
Example Output
[
{
"parent": "<string>",
"u_vendor_name": "<string>",
"u_related_edr_record": "<string>",
"watch_list": "<string>",
"related_party_users": "<string>",
"sys_updated_on": "<string>",
"u_search_id": "<string>",
"u_source_ip": "<string>",
"environment_type": "<string>",
"skills": "<string>",
"u_mttdrv": "<string>",
"u_wba_dsep": null,
"state": "<string>",
"sys_created_by": "<string>",
"knowledge": "<string>",
"u_subcategory": "<string>",
"u_incident_type": "<string>",
"impact": "<string>",
"active": "<string>",
"auto_created_case": "<string>",
"log_source_type": null,
"first_response_time": "<string>",
"group_list": "<string>",
"platform_enablement_phase": null,
"u_vendor_ref_number": "<string>",
"u_cis_control": null,
"correlation_display": "<string>",
"u_mtt_detect": "<string>",
"u_user": "<string>",
"follow_up": "<string>",
"u_customer_reference_number": "<string>",
"contact_local_time": "<string>",
"u_customer_declared_incident": "<string>",
"u_last_additional_comment": "<string>",
"u_vsoc_detect": "<string>",
"u_case_type": "<string>",
"u_alert_time": "<string>",
"u_planned_start_date": "<string>",
"story_points": "<string>",
"priority_changed": "<string>",
"u_splunk_link": "<string>",
"u_first_assigned_on": "<string>",
"u_category": "<string>",
"partner": "<string>",
"stage": null,
"u_reopen_count": "<string>",
"escalation": "<string>",
"correlation_id": "<string>",
"u_exclude_from_torq_auto_closure": "<string>",
"u_soar_link": "<string>",
"made_sla": "<string>",
"u_destination_ip": "<string>",
"project": "<string>",
"u_first_assigned_engineer": "<string>",
"u_security_incident": null,
"user_input": "<string>",
"sys_created_on": "<string>",
"contact": "<string>",
"impact_changed": "<string>",
"route_reason": "<string>",
"u_event_name": "<string>",
"closed_at": "<string>",
"u_dw_correlation": "<string>",
"follow_the_sun": "<string>",
"u_qa_notes": "<string>",
"u_documentation_link": "<string>",
"business_impact": "<string>",
"u_agent_type": null,
"time_worked": "<string>",
"work_end": "<string>",
"u_related_mdr_record": "<string>",
"u_qa_assignee": "<string>",
"subcategory": "<string>",
"u_hosts": "<string>",
"assignment_group": {
"display_value": "<string>",
"link": "<string>"
},
"customer_updated_by": "<string>",
"u_request_issue": null,
"u_marked_for_sanitization": "<string>",
"description": "<string>",
"proactive": "<string>",
"u_data_source": {
"display_value": "<string>",
"link": "<string>"
},
"u_mtta": "<string>",
"x_virta_mitre_tactic_list": "<string>",
"sys_id": "<string>",
"probable_cause": "<string>",
"urgency": "<string>",
"major_case_state": null,
"u_dw_escalated_by": "<string>",
"approval": "<string>",
"u_event_time": "<string>",
"u_soar_incident_id": "<string>",
"u_dw_mttca": "<string>",
"project_task": "<string>",
"internal_user": "<string>",
"sys_tags": "<string>",
"u_file_path": "<string>",
"u_declared_incident_time": "<string>",
"u_mtti": "<string>",
"u_mttd": "<string>",
"u_mttc": "<string>",
"u_customer_validation_state": null,
"u_mttn": "<string>",
"related_party_consumers": "<string>",
"u_mttca": "<string>",
"upon_reject": "<string>",
"support_manager": "<string>",
"approval_history": "<string>",
"u_schedule_type": "<string>",
"feedback": "<string>",
"number": "<string>",
"u_destination_port": "<string>",
"u_mitre_tactic": null,
"u_mttcw": "<string>",
"u_mttcv": "<string>",
"case": "<string>",
"order": "<string>",
"u_event_of_interest": "<string>",
"u_splunk_search": "<string>",
"u_mttdi": "<string>",
"contract": "<string>",
"priority": "<string>",
"sys_domain_path": "<string>",
"u_customer_ack_time": "<string>",
"business_duration": "<string>",
"child_case_creation_progress": "<string>",
"sync_driver": "<string>",
"u_customer_validation_time": "<string>",
"x_pd_integration_incident_id": "<string>",
"universal_request": "<string>",
"short_description": "<string>",
"work_start": "<string>",
"additional_assignee_list": "<string>",
"notify": "<string>",
"sys_class_name": "<string>",
"closed_by": "<string>",
"reassignment_count": "<string>",
"contact_time_zone": null,
"contributor_users": "<string>",
"notes_to_comments": "<string>",
"u_related_fw_record": "<string>",
"assigned_to": "<string>",
"u_search_name": "<string>",
"u_source_hostname": "<string>",
"product": "<string>",
"u_customer_assignment_time": "<string>",
"u_mitre_technique": "<string>",
"sla_due": "<string>",
"u_file_name": "<string>",
"u_customer_notification_group": {
"display_value": "<string>",
"link": "<string>"
},
"u_mttdwv": "<string>",
"upon_approval": "<string>",
"partner_contact": "<string>",
"customer_updated": "<string>",
"asset": "<string>",
"u_mitre_sub_technique_list": "<string>",
"feedback_submitter": "<string>",
"u_threat_hunt_outcomes": "<string>",
"u_jira_ref_number": "<string>",
"sprint_status": null,
"task_effective_number": "<string>",
"resolved_by": "<string>",
"sys_updated_by": "<string>",
"u_mttca_2": "<string>",
"opened_by": {
"display_value": "<string>",
"link": "<string>"
},
"u_suppress_email_notifications": "<string>",
"sys_domain": {
"display_value": "<string>",
"link": "<string>"
},
"u_outcome_severity": null,
"tuning_recommendation": "<string>",
"u_mttdwc": "<string>",
"contributor_groups": "<string>",
"u_credentials_compromised": "<string>",
"business_service": "<string>",
"entitlement": "<string>",
"u_on_hold_reason": "<string>",
"u_change_type": "<string>",
"u_ioc": "<string>",
"expected_start": "<string>",
"opened_at": "<string>",
"x_virta_mitre_mitigation_list": "<string>",
"resolved_at": "<string>",
"u_mtt_response": "<string>",
"u_destination_hostname": "<string>",
"u_mtt_validate": "<string>",
"cause": "<string>",
"calendar_duration": "<string>",
"close_notes": "<string>",
"auto_close": "<string>",
"contact_type": "<string>",
"u_planned_end_date": "<string>",
"resolution_code": null,
"u_related_vms_record": "<string>",
"u_reporting_device": "<string>",
"activity_due": "<string>",
"x_virta_mitre_technique_list": "<string>",
"comments": "<string>",
"due_date": "<string>",
"sys_mod_count": "<string>",
"u_file_hash": "<string>",
"u_mttrv": "<string>",
"tell_us_how_we_did": null,
"u_customer_acknowledgement_time": "<string>",
"u_alert_assignment_time": "<string>",
"category": "<string>",
"account": {
"display_value": "<string>",
"link": "<string>"
},
"u_string_1": "<string>"
}
]
Workflow Library Example
List Incidents with Servicenow and Send Results Via Email