TicketingServiceNow (ITSM)

ServiceNow (ITSM)

Configure ServiceNow ITSM integration with RAD Security for automated security incident management.

Beta Integration: This integration is currently in beta. Features and setup steps may change as we refine the integration based on user feedback.

This guide walks you through integrating ServiceNow ITSM with RAD Security for automated security incident and ticket management, enabling you to automatically create, update, and track security incidents as ServiceNow issues.

ServiceNow provides powerful IT service management capabilities, making it ideal for managing security incidents, vulnerabilities, and remediation workflows in enterprise environments.

Token Authentication Required: This integration requires ServiceNow API Key (token-based) authentication, which is only available in the ServiceNow Washington DC release or later. Earlier versions are not supported.

Prerequisites

Before you begin, ensure you have:

  • Admin access to ServiceNow (Washington DC release or later)
  • Ability to create users, roles, and API keys in ServiceNow
  • The API Key and HMAC Authentication plugin enabled
  • Access to RAD Security workspace with integration permissions

Service User Recommended: Create a dedicated service user for this integration rather than using a personal account. This ensures the integration continues working when team members leave or change roles.

Step 1: Log in to ServiceNow as Admin

Access ServiceNow Admin

Log in to your ServiceNow instance with administrator privileges

Verify API Key Plugin

  1. Navigate to All > Admin Center > Application Manager
  2. Verify the API Key and HMAC Authentication plugin (com.glide.tokenbased_auth) is activated
  3. If not enabled, activate the plugin before proceeding

The API Key plugin is required for this integration and is only available in ServiceNow Washington DC release or later.

Step 2: Elevate Role and Create Custom Role

Elevate to Security Admin

  1. Click on the face icon in the upper right corner
  2. Click Elevate Role
  3. Select security_admin

This elevation allows you to create the necessary roles and permissions for the integration.

Create Custom Role

  1. Navigate to All > System Security > Users and Groups > Roles
  2. Click New
  3. Create a new custom role with a descriptive name (e.g., "rad_security_integration")
  4. Save and note the role name for use in later steps

This custom role will be used to grant specific permissions to the service user for table access.

Step 3: Create Service Account User

Navigate to User Management

Navigate to All > Organization > Users

Create New User

  1. Select New from the upper right corner
  2. Fill in the required fields, making sure to select the Internal Integration User field

Assign Roles to User

Once the user is created, select it from the list of users:

  1. In the Roles tab, select Edit...
  2. Add the following role collections:
    • sn_incident_write - Write access to incidents
    • sn_incident_read - Read access to incidents
    • itil_admin - ITIL administration
    • u_ticket_user - Ticket management
  3. Add the custom role you created in Step 2
  4. Click Save

Service User Strongly Recommended: While you can use an existing user account, creating a dedicated service user is strongly recommended. If a personal account is used and that person leaves your organization, the integration will break.

Step 4: Create Inbound Authentication Profile

Navigate to Authentication Profiles

Navigate to All > System Web Services > API Access Policies > Inbound Authentication Profile

Create API Key Profile

  1. Click New
  2. Click Create API Key authentication profiles
  3. Provide a name for the profile
  4. In the Auth Parameter field, add Auth Header using the x-sn-apikey header field
  5. Click Submit

The x-sn-apikey header is the standard header used to send the API key in requests to ServiceNow.

This profile is not attached to the API key. The REST API Key record has no field for an authentication profile — do not go looking for one. You will link this profile to the Table API in Step 6. Until you do, ServiceNow never evaluates the x-sn-apikey header and every request fails.

Step 5: Generate API Key

Navigate to REST API Keys

Navigate to All > System Web Services > API Access Policies > REST API Key

Create API Key

  1. Click New
  2. Enter a name for the key (e.g., "RAD Security Integration Key")
  3. Select the service user created in Step 3 as the User
  4. Click Save

The API key will be associated with the service user and inherit all the user's role assignments.

Copy API Key Token

  1. After saving, the system generates a token
  2. Use the lock icon to view the token
  3. Immediately copy the token that appears below the field

Save this token securely! You'll need it to configure the integration in RAD Security. Store it in a password manager or secrets vault.

Step 6: Set API Access Policy

Navigate to API Access Policies

Navigate to All > System Web Services > API Access Policies > REST API Access Policies

Create New Policy

  1. Click New
  2. Provide a descriptive name (e.g., "RAD Security Table API Access")
  3. Under REST API, select Table API
  4. Verify that Apply to all methods is checked

Attach the Authentication Profile

  1. In the Authentication profile embedded list near the bottom of the form, click Insert a new row
  2. Select the API Key authentication profile you created in Step 4
  3. Click Submit to save the policy

Do not skip this step. This is the only place the authentication profile and the Table API are linked. If the profile is missing from this list, ServiceNow ignores the x-sn-apikey header entirely and every request returns 401 User Not Authenticated — even though the API key itself looks correctly configured. This is the most common cause of a ServiceNow setup that appears complete but does not work.

How the three records fit together: The REST API Key carries the user, which determines what data can be reached through ACLs. The Inbound Authentication Profile determines how an incoming request presents its key (the x-sn-apikey header). The REST API Access Policy is the only record where those two meet, by applying the authentication profile to the Table API. All three are required, and the key and the profile are never linked directly to each other.

Step 7: Create ACL for Table Access

Navigate to Access Control

Navigate to All > System Security > Access Control (ACL) > New

Configure ACL

  1. In the Type field, select record
  2. In the Operation field, select Create
  3. In the Name field, select Incident
  4. Under Requires Role, in the Roles field, select the custom role created in Step 2
  5. Click Submit

This ACL grants create permission on the Incident table to any user with the custom role you created.

Important for Mixed Authentication: If you are using basic authentication for other integrations that use the Table API, you will need to add a basic auth authentication profile to this policy as well, or create a separate policy for basic auth integrations. ServiceNow uses a priority system to determine which authentication method to use, and adding an API key authentication profile will override the default basic auth profile.

Verify the ServiceNow Setup

Before configuring the integration in RAD Security, confirm the API key works directly against ServiceNow. RAD Security authenticates using exactly this header, so if these requests fail the integration will fail too.

curl -i \
  -H "x-sn-apikey: YOUR_API_KEY" \
  -H "Accept: application/json" \
  "https://<instance>.service-now.com/api/now/table/incident?sysparm_limit=1"

On Windows, curl in PowerShell is an alias for Invoke-WebRequest and will not accept -i or -H. Call curl.exe explicitly, or run the command from cmd.exe.

Interpret the response:

ResponseMeaning
200 OKRead access works — continue to the write check below
401 with a WWW-Authenticate: Basic response headerThe key was never evaluated. The authentication profile is not attached to the access policy (Step 6)
401 User Not AuthenticatedThe key is inactive, mistyped, expired, or the instance predates Washington DC
403 / insufficient rightsAuthentication works, but the service user lacks roles or ACLs (Step 2, Step 7)

A successful GET only proves read access. RAD Security creates incidents, so verify the write path as well:

curl -i -X POST \
  -H "x-sn-apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"short_description":"RAD Security connectivity test"}' \
  "https://<instance>.service-now.com/api/now/table/incident"

Read-only access passing while creation fails is common — it means the ACL from Step 7 is missing or does not use Operation: Create. Delete the test incident once the check succeeds.

Step 8: Configure in RAD Security

Navigate to your RAD Security workspace and configure the ServiceNow ITSM integration with the following parameters:

Required Parameters

ParameterDescriptionExample
URLRoot URL of your ServiceNow instancehttps://your-company.service-now.com/
SecretAPI Key token from Step 5your-api-token-here

The URL should be your ServiceNow root URL in the format https://<tenant>.service-now.com/ where <tenant> is your organization's ServiceNow instance name.

Verify Integration

After completing the setup, verify your integration is working:

  1. Navigate to Data Sources > Integrations > Ticketing in RAD Security
  2. Locate your ServiceNow ITSM integration
  3. Check the connection status shows as Connected
  4. Test by creating a sample incident from RAD Security

Your ServiceNow ITSM integration is now configured! RAD Security can now automatically create and manage security incidents in ServiceNow.

What Data is Synced

Once configured, RAD Security will sync the following with ServiceNow ITSM:

Use Cases

Automated Incident Creation Automatically create ServiceNow incidents when security events, vulnerabilities, or policy violations are detected.

ITSM Workflow Integration Integrate security findings into existing IT service management workflows and processes.

Enterprise Incident Management Manage security incidents alongside IT incidents in a centralized ITSM platform.

Compliance Tracking Track security remediation efforts through ServiceNow's audit and compliance features.

Troubleshooting

Security Best Practices

Use Service Accounts Always use a dedicated service account with a service email, never a personal account tied to an individual.

Least Privilege Access Only grant the minimum permissions required. Use custom roles rather than admin privileges for integration accounts.

Rotate Tokens Regularly Rotate API tokens every 90 days or according to your security policy to minimize risk of compromise.

Secure Token Storage Store API tokens in a secure password manager or secrets vault. Never commit to version control or share via insecure channels.

Monitor Integration Activity Regularly review incidents created by the integration to ensure proper operation and detect anomalies.

Audit Permissions Periodically review the service user's role assignments and ACL configurations to ensure they remain appropriate.

Track Token Usage Document which tokens are used for which integrations to simplify rotation and troubleshooting.

Enable MFA on Admin Accounts Ensure admin accounts used to create service users and API keys have multi-factor authentication enabled.

Token Rotation

To rotate your ServiceNow API token:

Create New Token

  1. Log in as admin to ServiceNow
  2. Navigate to All > System Web Services > API Access Policies > REST API Key
  3. Create a new API key for the same service user with a different name
  4. Copy the new token immediately

Update Integration

Update the token in RAD Security integration settings

Verify Connection

Test that the integration still works with the new token by creating a test incident

Revoke Old Token

Once verified, delete or deactivate the old token in ServiceNow

Additional Resources

ServiceNow API Key Authentication

Official ServiceNow guide to API key authentication

ServiceNow REST API Documentation

Learn about ServiceNow's REST API capabilities

ServiceNow Access Control

Understand ServiceNow access control and ACL configuration

ServiceNow ITSM Best Practices

ServiceNow IT Service Management overview and best practices

Next Steps

Ticketing Overview

Learn about other ticketing integrations

Jira Cloud

Add Jira Cloud for additional ticket management

Workflows

Configure custom workflows for incident response

Alerts & Incidents

Set up alert rules that trigger ServiceNow incident creation

Was this page helpful?