- Kibana Guide: other versions:
- What is Kibana?
- What’s new in 8.13
- Kibana concepts
- Quick start
- Set up
- Install Kibana
- Configure Kibana
- Alerting and action settings
- APM settings
- Banners settings
- Cases settings
- Enterprise Search settings
- Fleet settings
- i18n settings
- Logging settings
- Logs settings
- Metrics settings
- Monitoring settings
- Reporting settings
- Search sessions settings
- Secure settings
- Security settings
- Spaces settings
- Task Manager settings
- Telemetry settings
- URL drilldown settings
- Start and stop Kibana
- Access Kibana
- Securing access to Kibana
- Add data
- Upgrade Kibana
- Configure security
- Configure reporting
- Configure logging
- Configure monitoring
- Command line tools
- Production considerations
- Discover
- Dashboard and visualizations
- Canvas
- Maps
- Build a map to compare metrics by country or region
- Track, visualize, and alert on assets in real time
- Map custom regions with reverse geocoding
- Heat map layer
- Tile layer
- Vector layer
- Plot big data
- Search geographic data
- Configure map settings
- Connect to Elastic Maps Service
- Import geospatial data
- Troubleshoot
- Reporting and sharing
- Machine learning
- Graph
- Alerting
- Observability
- APM
- Set up
- Get started
- How-to guides
- Configure APM agents with central config
- Control access to APM data
- Create an alert
- Create custom links
- Filter data
- Find transaction latency and failure correlations
- Identify deployment details for APM agents
- Integrate with machine learning
- Exploring mobile sessions with Discover
- Viewing sessions with Discover
- Observe Lambda functions
- Query your data
- Storage Explorer
- Track deployments with annotations
- Users and privileges
- Settings
- REST API
- Troubleshooting
- Security
- Dev Tools
- Fleet
- Osquery
- Stack Monitoring
- Stack Management
- REST API
- Get features API
- Kibana spaces APIs
- Kibana role management APIs
- User session management APIs
- Saved objects APIs
- Data views API
- Get all data views
- Get data view
- Create data view
- Update data view
- Delete data view
- Swap references preview
- Swap references
- Get default data view
- Set default data view
- Update data view fields metadata
- Get runtime field
- Create runtime field
- Upsert runtime field
- Update runtime field
- Delete runtime field
- Index patterns APIs
- Alerting APIs
- Action and connector APIs
- Cases APIs
- Add comment
- Create case
- Delete cases
- Delete comments
- Find case activity
- Find cases
- Find connectors
- Get alerts
- Get case activity
- Get case
- Get case status
- Get cases by alert
- Get comments
- Get configuration
- Get reporters
- Get tags
- Push case
- Set configuration
- Update cases
- Update comment
- Update configuration
- Import and export dashboard APIs
- Logstash configuration management APIs
- Machine learning APIs
- Osquery manager API
- Short URLs APIs
- Get Task Manager health
- Upgrade assistant APIs
- Synthetics APIs
- Uptime APIs
- Kibana plugins
- Troubleshooting
- Accessibility
- Release notes
- Kibana 8.13.4
- Kibana 8.13.3
- Kibana 8.13.2
- Kibana 8.13.1
- Kibana 8.13.0
- Kibana 8.12.2
- Kibana 8.12.1
- Kibana 8.12.0
- Kibana 8.11.4
- Kibana 8.11.3
- Kibana 8.11.2
- Kibana 8.11.1
- Kibana 8.11.0
- Kibana 8.10.4
- Kibana 8.10.3
- Kibana 8.10.2
- Kibana 8.10.1
- Kibana 8.10.0
- Kibana 8.9.2
- Kibana 8.9.1
- Kibana 8.9.0
- Kibana 8.8.2
- Kibana 8.8.1
- Kibana 8.8.0
- Kibana 8.7.1
- Kibana 8.7.0
- Kibana 8.6.1
- Kibana 8.6.0
- Kibana 8.5.2
- Kibana 8.5.1
- Kibana 8.5.0
- Kibana 8.4.3
- Kibana 8.4.2
- Kibana 8.4.1
- Kibana 8.4.0
- Kibana 8.3.3
- Kibana 8.3.2
- Kibana 8.3.1
- Kibana 8.3.0
- Kibana 8.2.3
- Kibana 8.2.2
- Kibana 8.2.1
- Kibana 8.2.0
- Kibana 8.1.3
- Kibana 8.1.2
- Kibana 8.1.1
- Kibana 8.1.0
- Kibana 8.0.0
- Kibana 8.0.0-rc2
- Kibana 8.0.0-rc1
- Kibana 8.0.0-beta1
- Kibana 8.0.0-alpha2
- Kibana 8.0.0-alpha1
- Developer guide
ServiceNow ITSM connector and action
editServiceNow ITSM connector and action
editThe ServiceNow ITSM connector uses the import set API to create ServiceNow incidents. You can use the connector for rule actions and cases.
Create connectors in Kibana
editYou can create connectors in Stack Management > Connectors or as needed when you’re creating a rule. You must choose whether to use OAuth for authentication.


Connector configuration
editServiceNow ITSM connectors have the following configuration properties:
- Client ID
- The client identifier assigned to your OAuth application.
- Client secret
- The client secret assigned to your OAuth application.
- JWT verifier key ID
- The key identifier assigned to the JWT verifier map of your OAuth application.
- Password
- The password for HTTP basic authentication.
- Private key
- The RSA private key that you created for use in ServiceNow.
- Private key password
- The password for the RSA private key. This values is required if you set a password for your private key.
- ServiceNow instance URL
- The full URL for the ServiceNow instance.
- Use OAuth authentication
- By default, basic authentication is used instead of open authorization (OAuth).
- User identifier
-
The identifier to use for OAuth type authentication.
This identifier should be the user field you selected during setup. For example, if the selected user field is
Email
, the user identifier should be the user’s email address. - Username
- The username for HTTP basic authentication.
Test connectors
editWhen you create or edit a connector, use the Test tab to test its actions:

ServiceNow ITSM actions have the following configuration properties.
- Additional comments
- Additional information for the client, such as how to troubleshoot the issue.
- Category
- The category of the incident.
- Correlation display
- A descriptive label of the alert for correlation purposes in ServiceNow.
- Correlation ID
-
Connectors using the same correlation ID will be associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident will be created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as
{{ruleID}}:{{alert ID}}
to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters.Using the default configuration of
{{ruleID}}:{{alert ID}}
ensures that ServiceNow will create a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert. - Description
- The details about the incident.
- Impact
- The effect an incident has on business. It can be measured by the number of affected users or by how critical it is to the business in question.
- Severity
- The severity of the incident.
- Short description
- A short description for the incident, used for searching the contents of the knowledge base.
- Subcategory
- The category of the incident.
- Urgency
- The extent to which the incident resolution can delay.
When you create a rule that uses a ServiceNow ITSM connector, its recovery actions close ServiceNow incidents based on the correlation ID. If there are multiple incidents that match the correlation ID, the latest open incident for that ID is closed.
Connector networking configuration
editUse the Action configuration settings to customize connector networking configurations, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use xpack.actions.customHostSettings
to set per-host configurations.
Configure ServiceNow
editServiceNow offers free Personal Developer Instances, which you can use to test incidents.
Prerequisites
editAfter upgrading from Elastic Stack version 7.15.0 or earlier to version 7.16.0 or later, you must complete the following steps within your ServiceNow instance before creating a new ServiceNow ITSM connector or updating an existing one:
- Install Elastic for ITSM from the ServiceNow store.
- Assign cross-scope privileges for the Elastic for ITSM app.
- Create a ServiceNow integration user and assign it the appropriate roles.
- Create a Cross-Origin Resource Sharing (CORS) rule.
-
If you use open authorization (OAuth), you must also:
Assign cross-scope privileges
editThe Elastic for ITSM app requires specific cross-scope privilege records to run successfully.
In particular, you must have a privilege record for the Elastic for ITSM
application with the status set to Allowed
for each of the following targets:
Target scope | Name | Type | Operation |
---|---|---|---|
Global |
GlideRecord.insert |
Scriptable |
Execute API |
Global |
GlideRecord.setValue |
Scriptable |
Execute API |
Global |
GlideRecordSecure.getValue |
Scriptable |
Execute API |
Global |
Incident |
Table |
Read |
Global |
ScriptableServiceResultBuilder.setBody |
Scriptable |
Execute API |
Global |
ScopedGlideElement |
Scriptable |
Execute API |
To access the cross scope privileges table:
- Log into ServiceNow and set your application scope to Elastic for ITSM.
-
Click All and search for
sys_scope_privilege
.
For more details, refer to the ServiceNow product documentation.
Create a ServiceNow integration user
editTo ensure authenticated communication between Elastic and ServiceNow, create a ServiceNow integration user and assign it the appropriate roles.
- In your ServiceNow instance, go to System Security → Users and Groups → Users.
- Click New.
- Complete the form, then right-click on the menu bar and click Save.
- Go to the Roles tab and click Edit.
-
Assign the integration user the following roles:
-
import_set_loader
-
import_transformer
-
personalize_choices
-
x_elas2_inc_int.integration_user
-
- Click Save.
Create a CORS rule
editA CORS rule is required for communication between Elastic and ServiceNow. To create a CORS rule:
- In your ServiceNow instance, go to System Web Services → REST → CORS Rules.
- Click New.
-
Configure the rule as follows:
- Name: Name the rule.
-
REST API: Set the rule to use the Elastic ITSM API by choosing
Elastic ITSM API [x_elas2_inc_int/elastic_api]
. - Domain: Enter the Kibana URL, including the port number.
- Go to the HTTP methods tab and select GET.
- Click Submit to create the rule.
Create an RSA keypair and add an X.509 certificate
editThis step is required to use OAuth for authentication between Elastic and ServiceNow.
Create an RSA keypair:
-
Use OpenSSL to generate an RSA private key:
-
Use OpenSSL to generate the matching public key:
openssl req -new -x509 -key example-private-key.pem -out example-sn-cert.pem -days 360
Add an X.509 certificate to ServiceNow:
- In your ServiceNow instance, go to Certificates and select New.
-
Configure the certificate as follows:
- Name: Name the certificate.
- PEM Certificate: Copy the generated public key into this text field.
- Click Submit to create the certificate.
Create an OAuth JWT API endpoint for external clients with a JWT Verifiers Map
editThis step is required to use OAuth for authentication between Elastic and ServiceNow.
- In your ServiceNow instance, go to Application Registry and select New.
-
Select Create an OAuth JWT API endpoint for external clients from the list of options.
-
Configure the application as follows:
- Name: Name the application.
- User field: Select the field to use as the user identifier.
Remember the selected user field. You will use this as the User Identifier Value when creating the connector. For example, if you selected Email for User field, you will use the user’s email for the User Identifier Value.
- Click Submit to create the application. You will be redirected to the list of applications.
- Select the application you just created.
- Find the Jwt Verifier Maps tab and click New.
-
Configure the new record as follows:
- Name: Name the JWT Verifier Map.
- Sys certificate: Click the search icon and select the name of the certificate created in the previous step.
- Click Submit to create the verifier map.
-
Note the Client ID, Client Secret and JWT Key ID. You will need these values to create your ServiceNow connector.
Update a deprecated ServiceNow ITSM connector
editServiceNow ITSM connectors created in Elastic Stack version 7.15.0 or earlier are marked as deprecated after you upgrade to version 7.16.0 or later. Deprecated connectors have a yellow icon after their name and display a warning message when selected.

Deprecated connectors will continue to function with the rules they were added to and can be assigned to new rules. However, it is strongly recommended to update deprecated connectors or create new ones to ensure you have access to connector enhancements, such as updating incidents.
To update a deprecated connector:
- Open the main menu and go to Stack Management > Connectors.
- Select the deprecated connector to open the Edit connector flyout.
- In the warning message, click Update this connector.
-
Complete the guided steps in the Edit connector flyout.
- Install Elastic for ITSM and complete the required prerequisites.
- Enter the URL of your ServiceNow instance.
- Enter the username and password of your ServiceNow instance.
- Click Update.
On this page
- Create connectors in Kibana
- Connector configuration
- Test connectors
- Connector networking configuration
- Configure ServiceNow
- Prerequisites
- Assign cross-scope privileges
- Create a ServiceNow integration user
- Create a CORS rule
- Create an RSA keypair and add an X.509 certificate
- Create an OAuth JWT API endpoint for external clients with a JWT Verifiers Map
- Update a deprecated ServiceNow ITSM connector