service-now-logo

Automated Alert Ticket Creation in ServiceNow Made Simple

Many organizations using a network monitoring system like SolarWinds, would like to automate ticket creation in IT Service Management tools such as ServiceNow for the alerts SolarWinds generates from incidents.

There is a simple approach to doing this by just having SolarWinds send an email or via http request with alert information about the incident directly to ServiceNow, which can then automatically create a ticket for that incident.  However, the simplest way of doing things, isn’t always the best way of doing things.

Using an automation tool like eyeShare, which integrates with both SolarWinds and ServiceNow, offers some distinct advantages over taking the email approach, which is purely a one-way communication process, that doesn’t let you do a number of other important things.

For example…

If you use the email approach to generating ServiceNow tickets, you cannot receive a confirmation that it actually worked. When you create a ticket in ServiceNow from a SolarWinds email, you have no way to confirm that ServiceNow even received the email from SolarWinds, much less created a ticket from it in ServiceNow.

However, by using eyeShare’s integration between the two, you can not only confirm that a ticket was created in ServiceNow, but you can also extract the ticket # & the name of the responsible technician assigned to the incident.  This information can then be propagated back to SolarWinds for cross-referencing purposes.

Furthermore, during the ticket creation process, eyeShare’s communication, notification, & escalation capabilities can be leveraged to dynamically assign ticket ownership in ServiceNow to an appropriate technician.

For instance, eyeShare can notify the relevant person to take ownership for a particular ticket via SMS, email,  and instant messaging.  If that person can’t be located within say 60 seconds (or however long is appropriate), eyeShare moves to the next person in the escalation hierarchy, and tries to notify them.  eyeShare can escalate to a specific name, or to whoever is currently on duty, or even to a group of people in order to ensure that no matter what day or time it is, the right person takes ownership for a particular incident.  You can’t do that with the email approach. In addition to that, the email approach does not allow for any data enrichment.

If you use the simple email approach to ticket creation, how do you map information from a SolarWinds alert email to a ServiceNow form?  You can either use complicated scripting, which then negates the simplicity of using the email approach in the first place, or you can stuff all the information into one field on the ServiceNow form.  That’s not exactly the best practice technique, and it neutralizes a big chunk of ServiceNow’s value for storing information about an incident.

With eyeShare integrating SolarWinds & ServiceNow though, you can populate multiple fields on ServiceNow forms accurately, and do so without requiring any scripting.

For example, eyeShare can not only take information about the incident and use that to create a ticket in ServiceNow, but it can also include forensic information like CPU usage, available memory, # of users logged in, etc. and put that on the ServiceNow ticket as well.

Another big drawback to the simple approach of emailing alert information to ServiceNow, is that it gives you no way to first verify that the alert is NOT a false positive, unless (again) you’re willing to start writing some complicated scripts (and now, suddenly the email method isn’t so simple anymore).

With eyeShare however, you can incorporate a verification process into the ticket creation workflow, and confirm that the alert is not a false positive before starting to remediate the incident.  And BTW – you can do that without any scripting too.

When you integrate SolarWinds with ServiceNow, the communications flow is bi-directional.  That not only means that Solarwinds alerts can flow automatically to ServiceNow, but it also means that tickets submitted in ServiceNow can cause a flow of automation to be directed back towards SolarWinds. 

As an example, let’s say that you have a maintenance work of 100’s of servers that need to be patched.  Normally, taking down those servers might trigger an alert storm in SolarWinds.  However, if you submit a ticket in ServiceNow requesting a maintenance activity request for these servers, and that ServiceNow ticket gets approved, eyeShare will see that approved ticket in ServiceNow’s queue and execute a workflow that (among other things), puts those servers on “maintenance mode” in Solarwinds & thus avoids triggering a storm of false alerts.

This comparison contrasts the benefits of using simple emails to automate ticket creation vs. using an automation tool like eyeShare.  The good news however, is that using eyeShare to do what’s described above is actually pretty simple too, thus providing a superior approach to automating ticket creation in ServiceNow.

Not sure where to begin? Simply download your free trial and start putting the power of automation to work for your company


IT Process Automation Survival Guide