Configure ServiceNow Event Alerts with ThousandEyes Custom Webhooks

[Berenice Guerra]

• Introduction
• Prerequisites
• ServiceNow Configuration
• ThousandEyes Configuration
• Configuration Example on ThousandEyes

 

Introduction

To be able to receive ThousandEyes alert notifications in the Events Dashboard on ServiceNow (indirect integration), you need to configure the integration using the Custom Webhooks

Contributed by Berenice Guerra, Technical Account Manager for ThousandEyes (part of Cisco)

Prerequisites

Requirements

ThousandEyes recommends that you have knowledge of these topics:

• Event Management platforms (e.g. ServiceNow, AppDynamics, Splunk, PagerDuty)

• Webhooks

• API

For documentation purposes refer to ServiceNow as SNOW abbreviation.

Components Used

The information in this document is based on these software versions:

• ThousandEyes Alerts Integrations

• ServiceNow Rome version 

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

ServiceNow Configuration

1. Ensure you have followed the pre-requisites as documented in the Incident Management - ThousandEyes Documentation

2. Create a new application registry for ThousandEyes. Navigate to Application Registries > New > Create an OAuth API endpoint for external client

3. Configure Application Registry

• Name

• Client ID* - Take note of this value as it is used on the ThousandEyes settings

• Client Secret - You can write one or leave in blank. After you click on Submit click on the new Application Registry you created and the Client Secret will be generated automatically.

• Redirect URL: https://app.thousandeyes.com/namespace/integrations/AuthCallbackPage.html 

  Reference: https://docs.thousandeyes.com/product-documentation/integration-guides/custom-webhooks/oauth

• Refresh Token Lifespan & Access Token Lifespan

Tip: You should set a high number for both tokens to avoid keep generating new tokens frequently. Example: 31,536,000

You can leave the other fields under the default values. After you click on Submit click on the new Application Registry you created and the Client Secret will generated.

ThousandEyes Configuration

1. Create a New Integration. Navigate to Alerts > Integrations > New Integration

2. Configure New Integration as follows:

• Name
• URL: https://<instancename>.service-now.com/api/global/em/jsonv2
  The URL should be in format your instance URL + api/global/em/jsonv2

This is based on what we have tested and worked for us following SNOW documentation about Event collection to the instance using web service API | ServiceNow which seems to be supported for ThousandEyes integration

• Preset Configurations: Override with an example
  Using this option we can write the specific body in the API format that works for ServiceNow Events ingestion as per the SNOW documentation of the above link.

3. Auth Type - Select the Authentication Type you prefer

• Basic Authentication - You need to use the login credentials of your instance. You will find them under Manage instance password from your account home page

• OAuth Client Credentials - Follow the steps described in the ThousandEyes documentation: Using OAuth Authentication for Your Custom Webhook

We have seen in many scenarios that the users elect not to use the OAuth because of the need to manually refresh the token in ThousandEyes, so they prefer to go with the Basic Authentication. We have not seen any main differences between them so far, just the security methods, but that will depend on each user.

Note: Ensure you have covered the step 3 of Incident Management documentation if you are willing to use OAuth Authentication

4. Headers: Content-Type application/json

5. Body - This will be define as per each user requirements, it can be guided by the existing examples on the Product Documentation | ServiceNow but to make it work with the fields of the ThousandEyes alerts information you should need to base on the Webhook Variables to get the required information that you want to display under the ServiceNow Events Dashboard.

Configuration Example on ThousandEyes

Webhook Body Example

{ "records":
[
{
"source":"ThousandEyes",
"event_class":"{{alert.rule.name}}",
"resource":"{{alert.rule.name}}",
"node":"{{alert.details.source.id}}",
"metric_name":"{{alert.details.metricsAtStart}}",
"type":"{{alert.test.testType}}",
"severity":"{{alert.severity.id}}",
"description":"{{alert.test.name}}",
"additional_info": "{{alert.details.metricsAtStart}}"
}
]
}

If the alert.details.metricsAtStart variable is used like described, it will return a 'null' value.

alert.details is a collection, therefore value must be gathered using the following syntax:
"{{#each alert.details}}{{metricsAtStart}}{{#unless @last}}, {{/unless}}{{/each}}"

Reference: Webhook Variables

Custom Webhook with Basic Authentication

Custom Webhook with Basic Authentication

Custom Webhook with OAuth Client Credentials Authentication

Custom Webhook with OAuth Client Credentials Authentication

Events on ServiceNow

Events on ServiceNow