Lists all incident tickets of a ServiceNow instance.

External Documentation

To learn more, visit the ServiceNow documentation.

​
Basic Parameters

ParameterDescription
QueryAn encoded query string used to filter the results.
Table NameThe name of the table, such as “incident” or “asset”.

​
Advanced Parameters

ParameterDescription
Display ValueDetermines the type of data returned, either the actual values from the database or the display values of the fields.
Display values are manipulated based on the actual value in the database and user or system settings and preferences.


Valid values:
- true: Returns the display values for all fields.
- false: Returns the actual values from the database.
- all: Returns both actual and display values.
Response FieldsComma-separated list of fields to return in the response.

​
Example Output

[
	{
		"parent": "<string>",
		"u_vendor_name": "<string>",
		"u_related_edr_record": "<string>",
		"watch_list": "<string>",
		"related_party_users": "<string>",
		"sys_updated_on": "<string>",
		"u_search_id": "<string>",
		"u_source_ip": "<string>",
		"environment_type": "<string>",
		"skills": "<string>",
		"u_mttdrv": "<string>",
		"u_wba_dsep": null,
		"state": "<string>",
		"sys_created_by": "<string>",
		"knowledge": "<string>",
		"u_subcategory": "<string>",
		"u_incident_type": "<string>",
		"impact": "<string>",
		"active": "<string>",
		"auto_created_case": "<string>",
		"log_source_type": null,
		"first_response_time": "<string>",
		"group_list": "<string>",
		"platform_enablement_phase": null,
		"u_vendor_ref_number": "<string>",
		"u_cis_control": null,
		"correlation_display": "<string>",
		"u_mtt_detect": "<string>",
		"u_user": "<string>",
		"follow_up": "<string>",
		"u_customer_reference_number": "<string>",
		"contact_local_time": "<string>",
		"u_customer_declared_incident": "<string>",
		"u_last_additional_comment": "<string>",
		"u_vsoc_detect": "<string>",
		"u_case_type": "<string>",
		"u_alert_time": "<string>",
		"u_planned_start_date": "<string>",
		"story_points": "<string>",
		"priority_changed": "<string>",
		"u_splunk_link": "<string>",
		"u_first_assigned_on": "<string>",
		"u_category": "<string>",
		"partner": "<string>",
		"stage": null,
		"u_reopen_count": "<string>",
		"escalation": "<string>",
		"correlation_id": "<string>",
		"u_exclude_from_torq_auto_closure": "<string>",
		"u_soar_link": "<string>",
		"made_sla": "<string>",
		"u_destination_ip": "<string>",
		"project": "<string>",
		"u_first_assigned_engineer": "<string>",
		"u_security_incident": null,
		"user_input": "<string>",
		"sys_created_on": "<string>",
		"contact": "<string>",
		"impact_changed": "<string>",
		"route_reason": "<string>",
		"u_event_name": "<string>",
		"closed_at": "<string>",
		"u_dw_correlation": "<string>",
		"follow_the_sun": "<string>",
		"u_qa_notes": "<string>",
		"u_documentation_link": "<string>",
		"business_impact": "<string>",
		"u_agent_type": null,
		"time_worked": "<string>",
		"work_end": "<string>",
		"u_related_mdr_record": "<string>",
		"u_qa_assignee": "<string>",
		"subcategory": "<string>",
		"u_hosts": "<string>",
		"assignment_group": {
			"display_value": "<string>",
			"link": "<string>"
		},
		"customer_updated_by": "<string>",
		"u_request_issue": null,
		"u_marked_for_sanitization": "<string>",
		"description": "<string>",
		"proactive": "<string>",
		"u_data_source": {
			"display_value": "<string>",
			"link": "<string>"
		},
		"u_mtta": "<string>",
		"x_virta_mitre_tactic_list": "<string>",
		"sys_id": "<string>",
		"probable_cause": "<string>",
		"urgency": "<string>",
		"major_case_state": null,
		"u_dw_escalated_by": "<string>",
		"approval": "<string>",
		"u_event_time": "<string>",
		"u_soar_incident_id": "<string>",
		"u_dw_mttca": "<string>",
		"project_task": "<string>",
		"internal_user": "<string>",
		"sys_tags": "<string>",
		"u_file_path": "<string>",
		"u_declared_incident_time": "<string>",
		"u_mtti": "<string>",
		"u_mttd": "<string>",
		"u_mttc": "<string>",
		"u_customer_validation_state": null,
		"u_mttn": "<string>",
		"related_party_consumers": "<string>",
		"u_mttca": "<string>",
		"upon_reject": "<string>",
		"support_manager": "<string>",
		"approval_history": "<string>",
		"u_schedule_type": "<string>",
		"feedback": "<string>",
		"number": "<string>",
		"u_destination_port": "<string>",
		"u_mitre_tactic": null,
		"u_mttcw": "<string>",
		"u_mttcv": "<string>",
		"case": "<string>",
		"order": "<string>",
		"u_event_of_interest": "<string>",
		"u_splunk_search": "<string>",
		"u_mttdi": "<string>",
		"contract": "<string>",
		"priority": "<string>",
		"sys_domain_path": "<string>",
		"u_customer_ack_time": "<string>",
		"business_duration": "<string>",
		"child_case_creation_progress": "<string>",
		"sync_driver": "<string>",
		"u_customer_validation_time": "<string>",
		"x_pd_integration_incident_id": "<string>",
		"universal_request": "<string>",
		"short_description": "<string>",
		"work_start": "<string>",
		"additional_assignee_list": "<string>",
		"notify": "<string>",
		"sys_class_name": "<string>",
		"closed_by": "<string>",
		"reassignment_count": "<string>",
		"contact_time_zone": null,
		"contributor_users": "<string>",
		"notes_to_comments": "<string>",
		"u_related_fw_record": "<string>",
		"assigned_to": "<string>",
		"u_search_name": "<string>",
		"u_source_hostname": "<string>",
		"product": "<string>",
		"u_customer_assignment_time": "<string>",
		"u_mitre_technique": "<string>",
		"sla_due": "<string>",
		"u_file_name": "<string>",
		"u_customer_notification_group": {
			"display_value": "<string>",
			"link": "<string>"
		},
		"u_mttdwv": "<string>",
		"upon_approval": "<string>",
		"partner_contact": "<string>",
		"customer_updated": "<string>",
		"asset": "<string>",
		"u_mitre_sub_technique_list": "<string>",
		"feedback_submitter": "<string>",
		"u_threat_hunt_outcomes": "<string>",
		"u_jira_ref_number": "<string>",
		"sprint_status": null,
		"task_effective_number": "<string>",
		"resolved_by": "<string>",
		"sys_updated_by": "<string>",
		"u_mttca_2": "<string>",
		"opened_by": {
			"display_value": "<string>",
			"link": "<string>"
		},
		"u_suppress_email_notifications": "<string>",
		"sys_domain": {
			"display_value": "<string>",
			"link": "<string>"
		},
		"u_outcome_severity": null,
		"tuning_recommendation": "<string>",
		"u_mttdwc": "<string>",
		"contributor_groups": "<string>",
		"u_credentials_compromised": "<string>",
		"business_service": "<string>",
		"entitlement": "<string>",
		"u_on_hold_reason": "<string>",
		"u_change_type": "<string>",
		"u_ioc": "<string>",
		"expected_start": "<string>",
		"opened_at": "<string>",
		"x_virta_mitre_mitigation_list": "<string>",
		"resolved_at": "<string>",
		"u_mtt_response": "<string>",
		"u_destination_hostname": "<string>",
		"u_mtt_validate": "<string>",
		"cause": "<string>",
		"calendar_duration": "<string>",
		"close_notes": "<string>",
		"auto_close": "<string>",
		"contact_type": "<string>",
		"u_planned_end_date": "<string>",
		"resolution_code": null,
		"u_related_vms_record": "<string>",
		"u_reporting_device": "<string>",
		"activity_due": "<string>",
		"x_virta_mitre_technique_list": "<string>",
		"comments": "<string>",
		"due_date": "<string>",
		"sys_mod_count": "<string>",
		"u_file_hash": "<string>",
		"u_mttrv": "<string>",
		"tell_us_how_we_did": null,
		"u_customer_acknowledgement_time": "<string>",
		"u_alert_assignment_time": "<string>",
		"category": "<string>",
		"account": {
			"display_value": "<string>",
			"link": "<string>"
		},
		"u_string_1": "<string>"
	}
]

​
Workflow Library Example

List Incidents with Servicenow and Send Results Via Email

Preview this Workflow on desktop