> ## Documentation Index > Fetch the complete documentation index at: https://docs.rad.security/llms.txt > Use this file to discover all available pages before exploring further. # ServiceNow (ITSM) > Configure ServiceNow ITSM integration with RAD Security for automated security incident management. # ServiceNow (ITSM) Integration Setup **Beta Integration:** This integration is currently in beta. Features and setup steps may change as we refine the integration based on user feedback. This guide walks you through integrating ServiceNow ITSM with RAD Security for automated security incident and ticket management, enabling you to automatically create, update, and track security incidents as ServiceNow issues. ServiceNow provides powerful IT service management capabilities, making it ideal for managing security incidents, vulnerabilities, and remediation workflows in enterprise environments. **Token Authentication Required:** This integration requires ServiceNow API Key (token-based) authentication, which is only available in the ServiceNow Washington DC release or later. Earlier versions are not supported. ## Prerequisites Before you begin, ensure you have: * Admin access to ServiceNow (Washington DC release or later) * Ability to create users, roles, and API keys in ServiceNow * The API Key and HMAC Authentication plugin enabled * Access to RAD Security workspace with integration permissions **Service User Recommended:** Create a dedicated service user for this integration rather than using a personal account. This ensures the integration continues working when team members leave or change roles. *** ## Step 1: Log in to ServiceNow as Admin Log in to your ServiceNow instance with administrator privileges 1. Navigate to **All > Admin Center > Application Manager** 2. Verify the **API Key and HMAC Authentication** plugin (`com.glide.tokenbased_auth`) is activated 3. If not enabled, activate the plugin before proceeding The API Key plugin is required for this integration and is only available in ServiceNow Washington DC release or later. *** ## Step 2: Elevate Role and Create Custom Role 1. Click on the **face icon** in the upper right corner 2. Click **Elevate Role** 3. Select **security\_admin** This elevation allows you to create the necessary roles and permissions for the integration. 1. Navigate to **All > System Security > Users and Groups > Roles** 2. Click **New** 3. Create a new custom role with a descriptive name (e.g., "rad\_security\_integration") 4. **Save and note the role name** for use in later steps This custom role will be used to grant specific permissions to the service user for table access. *** ## Step 3: Create Service Account User Navigate to **All > Organization > Users** 1. Select **New** from the upper right corner 2. Fill in the required fields, making sure to select the **Internal Integration User** field Once the user is created, select it from the list of users: 1. In the **Roles** tab, select **Edit...** 2. Add the following role collections: * `sn_incident_write` - Write access to incidents * `sn_incident_read` - Read access to incidents * `itil_admin` - ITIL administration * `u_ticket_user` - Ticket management 3. Add the **custom role** you created in Step 2 4. Click **Save** **Service User Strongly Recommended:** While you can use an existing user account, creating a dedicated service user is strongly recommended. If a personal account is used and that person leaves your organization, the integration will break. *** ## Step 4: Create Inbound Authentication Profile Navigate to **All > System Web Services > API Access Policies > Inbound Authentication Profile** 1. Click **New** 2. Click **Create API Key authentication profiles** 3. Provide a **name** for the profile 4. In the **Auth Parameter** field, add **Auth Header** using the `x-sn-apikey` header field 5. Click **Submit** The `x-sn-apikey` header is the standard header used to send the API key in requests to ServiceNow. *** ## Step 5: Generate API Key Navigate to **All > System Web Services > API Access Policies > REST API Key** 1. Click **New** 2. Enter a **name** for the key (e.g., "RAD Security Integration Key") 3. Select the **service user** created in Step 3 as the **User** 4. Click **Save** The API key will be associated with the service user and inherit all the user's role assignments. 1. After saving, the system generates a token 2. Use the **lock icon** to view the token 3. **Immediately copy the token** that appears below the field **Save this token securely!** You'll need it to configure the integration in RAD Security. Store it in a password manager or secrets vault. *** ## Step 6: Set API Access Policy Navigate to **All > System Web Services > API Access Policies > REST API Access Policies** 1. Click **New** 2. Provide a descriptive **name** (e.g., "RAD Security Table API Access") 3. Under **REST API**, select **Table API** 4. Verify that **Apply to all methods** is checked *** ## Step 7: Create ACL for Table Access Navigate to **All > System Security > Access Control (ACL) > New** 1. In the **Type** field, select **record** 2. In the **Operation** field, select **Create** 3. In the **Name** field, select **Incident** 4. Under **Requires Role**, in the **Roles** field, select the **custom role** created in Step 2 5. Click **Submit** This ACL grants create permission on the Incident table to any user with the custom role you created. **Important for Mixed Authentication:** If you are using basic authentication for other integrations that use the Table API, you will need to add a basic auth authentication profile to this policy as well, or create a separate policy for basic auth integrations. ServiceNow uses a priority system to determine which authentication method to use, and adding an API key authentication profile will override the default basic auth profile. *** ## Step 8: Configure in RAD Security Navigate to your RAD Security workspace and configure the ServiceNow ITSM integration with the following parameters: ### Required Parameters | Parameter | Description | Example | | ---------- | ------------------------------------ | --------------------------------------- | | **URL** | Root URL of your ServiceNow instance | `https://your-company.service-now.com/` | | **Secret** | API Key token from Step 5 | `your-api-token-here` | The URL should be your ServiceNow root URL in the format `https://.service-now.com/` where `` is your organization's ServiceNow instance name. *** ## Verify Integration After completing the setup, verify your integration is working: 1. Navigate to **Data Sources > Integrations > Ticketing** in RAD Security 2. Locate your ServiceNow ITSM integration 3. Check the connection status shows as **Connected** 4. Test by creating a sample incident from RAD Security Your ServiceNow ITSM integration is now configured! RAD Security can now automatically create and manage security incidents in ServiceNow. ## What Data is Synced Once configured, RAD Security will sync the following with ServiceNow ITSM: * Automatically create ServiceNow incidents for security events * Include detailed incident context and metadata * Attach relevant threat intelligence * Add affected assets and resources * Include remediation recommendations * Populate standard ITIL fields * Map RAD Security fields to ServiceNow fields * Configure custom field values * Set default incident types * Define priority and urgency mappings * Configure assignment rules * Support for custom ServiceNow fields * Integrate with ServiceNow workflows * Trigger automated assignment rules * Leverage ServiceNow escalation policies * Support approval processes * Enable change management integration ## Use Cases Automatically create ServiceNow incidents when security events, vulnerabilities, or policy violations are detected. Integrate security findings into existing IT service management workflows and processes. Manage security incidents alongside IT incidents in a centralized ITSM platform. Track security remediation efforts through ServiceNow's audit and compliance features. ## Troubleshooting **Possible causes:** * API token is incorrect or expired * API token was revoked * Service user account was disabled or deleted * Incorrect ServiceNow instance URL **Solution:** * Verify the API token is copied correctly (no extra spaces) * Check that the service user account is still active * Try logging in to ServiceNow with the service user credentials * Generate a new API token if needed * Confirm the instance URL is correct **Possible causes:** * User missing required roles * Custom role not assigned * ACL not properly configured * User removed from necessary groups **Solution:** * Verify the service user has all required roles assigned * Check that the custom role is assigned to the user * Review ACL configuration for the Incident table * Ensure role collections are active and properly configured * Confirm no role restrictions have been added **Possible causes:** * Missing ACL permissions * Required fields not mapped * Table access restrictions * Workflow blocking creation **Solution:** * Verify the ACL for Incident table includes the custom role * Check that all required ServiceNow fields are properly mapped * Ensure the Incident table is accessible * Review ServiceNow workflow restrictions * Check ServiceNow business rules that might block creation **Possible causes:** * ServiceNow version is older than Washington DC release * Plugin not activated * License doesn't include API access **Solution:** * Verify your ServiceNow version supports API keys (Washington DC or later) * Check that the API Key and HMAC Authentication plugin is activated * Contact ServiceNow support about licensing if plugin is unavailable * Consider upgrading to a supported ServiceNow version **Possible causes:** * Missing trailing slash * Incorrect instance name * Using developer instance URL format * Including additional path components **Solution:** * Ensure you're using the correct URL format: `https://.service-now.com/` * Include the trailing slash * Verify the instance name matches your organization * Don't include paths like `/api/` or `/incident.do` **Possible causes:** * Token was manually revoked * Service user was deleted or deactivated * Token reached configured expiration * API access policy changed **Solution:** * Log in as admin and verify the service user exists and is active * Navigate to REST API Keys and check if the token still exists * Check API access policies haven't changed * Create a new token if the old one was revoked * Update the token in RAD Security integration settings ## Security Best Practices Always use a dedicated service account with a service email, never a personal account tied to an individual. Only grant the minimum permissions required. Use custom roles rather than admin privileges for integration accounts. Rotate API tokens every 90 days or according to your security policy to minimize risk of compromise. Store API tokens in a secure password manager or secrets vault. Never commit to version control or share via insecure channels. Regularly review incidents created by the integration to ensure proper operation and detect anomalies. Periodically review the service user's role assignments and ACL configurations to ensure they remain appropriate. Document which tokens are used for which integrations to simplify rotation and troubleshooting. Ensure admin accounts used to create service users and API keys have multi-factor authentication enabled. ## Token Rotation To rotate your ServiceNow API token: 1. Log in as admin to ServiceNow 2. Navigate to **All > System Web Services > API Access Policies > REST API Key** 3. Create a new API key for the same service user with a different name 4. Copy the new token immediately Update the token in RAD Security integration settings Test that the integration still works with the new token by creating a test incident Once verified, delete or deactivate the old token in ServiceNow ## Additional Resources Official ServiceNow guide to API key authentication Learn about ServiceNow's REST API capabilities Understand ServiceNow access control and ACL configuration ServiceNow IT Service Management overview and best practices ## Next Steps Learn about other ticketing integrations Add Jira Cloud for additional ticket management Configure custom workflows for incident response Set up alert rules that trigger ServiceNow incident creation