Skip to Content

Sending tickets via ServicenowITSM.bat

(SPE2307)

You can track correlation threads that trigger an emergency alert with tickets in ServiceNow.

To raise an automated ticket alert in ServiceNow, administrators can customize the ServicenowITSM.bat file in the installationDirectory/t-actions folder.

Related topics

Using-and-creating-an-action-program

BMC-Defender-Server-automation

Replace the following placeholders in the ServicenowITSM.bat file:

  • <BASEURL>—ServiceNow portal URL that supports REST API endpoints for your installed ServiceNow server (AR server)
  • <USER>—ServiceNow server user with permission to create incidents on the ServiceNow server
  • <PASSWORD>—Password for the ServiceNow server user

The ServicenowITSM.bat file has the following default values:

  • Description (displayed as Summary in the user interface) is fetched from the Alert Message / Ticket Text field (Alerts > Counters tab).

  • Urgency is prioritized from the Alert/Ticket Severity (Messages > Catalogs > Severities) as follows:

    ServiceNow Urgency value

    BMC AMI Command Center for Security Severity value

    3-High

    debug and info

    2-Medium

    notice and warning

    1-High

    error, critical, alert, and emergency

  • Impact is set as 3-Low.
  • Opened by the system administrator.

You can customize the default values in the ServicenowITSM.bat file:

@echo on

set baseurl="<BASEURL>"
set user="<USER>"
set pwd="<PASSWORD>"

REM: Incident Urgency
set tm=%T_TIME%
set ip=%T_ADDRESS%
set fc=%T_FACILITY%
set sv=%T_SEVERITY%
set ms=%T_MESSAGE%

set tsev=%T_SEVERITY%

REM: Decide urgency as per severity of the ticket
if "%tsev%"=="debug"     set turgency="3-Low"
if "%tsev%"=="info"      set turgency="3-Low"
if "%tsev%"=="notice"    set turgency="2-Medium"
if "%tsev%"=="warning"   set turgency="2-Medium"
if "%tsev%"=="error"     set turgency="1-High"
if "%tsev%"=="critical"  set turgency="1-High"
if "%tsev%"=="alert"     set turgency="1-High"
if "%tsev%"=="emergency" set turgency="1-High"

REM: Check whether curl is available
where curl
if not errorlevel 0 (
    echo curl not available!
    exit 1
)

curl -s -X POST "%baseurl%/api/now/table/incident?sysparm_display_value=true&sysparm_exclude_reference_link=true&sysparm_fields=number%2Cshort_description" ^
--header "Accept:application/json" ^
--header "Content-Type:application/json" ^
--data "{\"short_description\":\"Alert from BMCAMI Command Center\",\"description\":\"%T_MESSAGE%\",\"Urgency\":\"%turgency%\"}" ^
--user %user%:%pwd%

REM: Expire the used auth token
curl -s -X POST %baseurl%/logout -H "Authorization:%authtoken%"

echo Execution complete.
exit 0


 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC Defender SIEM Correlation Server 6.2