Introduction
To be able to receive ThousandEyes alert notifications in the Events Dashboard on ServiceNow (indirect integration), you need to configure the integration using the Custom Webhooks
Contributed by Berenice Guerra, Technical Account Manager for ThousandEyes (part of Cisco)
Prerequisites
Requirements
ThousandEyes recommends that you have knowledge of these topics:
For documentation purposes refer to ServiceNow as SNOW abbreviation.
Components Used
The information in this document is based on these software versions:
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
ServiceNow Configuration
1. Ensure you have followed the pre-requisites as documented in the Incident Management - ThousandEyes Documentation
2. Create a new application registry for ThousandEyes. Navigate to Application Registries > New > Create an OAuth API endpoint for external client
3. Configure Application Registry
-
Name
-
Client ID* - Take note of this value as it is used on the ThousandEyes settings
-
Client Secret - You can write one or leave in blank. After you click on Submit click on the new Application Registry you created and the Client Secret will be generated automatically.
-
Redirect URL: https://app.thousandeyes.com/namespace/integrations/AuthCallbackPage.html
-
Refresh Token Lifespan & Access Token Lifespan
Tip: You should set a high number for both tokens to avoid keep generating new tokens frequently. Example: 31,536,000
You can leave the other fields under the default values. After you click on Submit click on the new Application Registry you created and the Client Secret will generated.
ThousandEyes Configuration
1. Create a New Integration. Navigate to Alerts > Integrations > New Integration
2. Configure New Integration as follows:
This is based on what we have tested and worked for us following SNOW documentation about Event collection to the instance using web service API | ServiceNow which seems to be supported for ThousandEyes integration
- Preset Configurations: Override with an example
Using this option we can write the specific body in the API format that works for ServiceNow Events ingestion as per the SNOW documentation of the above link.
3. Auth Type - Select the Authentication Type you prefer
- Basic Authentication - You need to use the login credentials of your instance. You will find them under Manage instance password from your account home page
We have seen in many scenarios that the users elect not to use the OAuth because of the need to manually refresh the token in ThousandEyes, so they prefer to go with the Basic Authentication. We have not seen any main differences between them so far, just the security methods, but that will depend on each user.
Note: Ensure you have covered the step 3 of Incident Management documentation if you are willing to use OAuth Authentication
4. Headers: Content-Type application/json
5. Body - This will be define as per each user requirements, it can be guided by the existing examples on the Product Documentation | ServiceNow but to make it work with the fields of the ThousandEyes alerts information you should need to base on the Webhook Variables to get the required information that you want to display under the ServiceNow Events Dashboard.
Configuration Example on ThousandEyes
Webhook Body Example
{ "records":
[
{
"source":"ThousandEyes",
"event_class":"{{alert.rule.name}}",
"resource":"{{alert.rule.name}}",
"node":"{{alert.details.source.id}}",
"metric_name":"{{alert.details.metricsAtStart}}",
"type":"{{alert.test.testType}}",
"severity":"{{alert.severity.id}}",
"description":"{{alert.test.name}}",
"additional_info": "{{alert.details.metricsAtStart}}"
}
]
}
If the alert.details.metricsAtStart
variable is used like described, it will return a 'null' value.
alert.details is a collection, therefore value must be gathered using the following syntax:
"{{#each alert.details}}{{metricsAtStart}}{{#unless @last}}, {{/unless}}{{/each}}"
Reference: Webhook Variables
Custom Webhook with Basic Authentication
Custom Webhook with Basic Authentication
Custom Webhook with OAuth Client Credentials Authentication
Custom Webhook with OAuth Client Credentials Authentication
Events on ServiceNow
Events on ServiceNow