---
title: ServiceNow Incident Connector Guide
slug: rbvm-help/servicenow-incident-connector-guide
createdAt: 2026-10-26T13:51:23.710Z
---

**Summary**: How to set up and use the ServiceNow Incident connector in Ivanti Neurons.

## Overview

The Ivanti Neurons platform provides a connector that integrates with ServiceNow Incident for ticket creation from the Ivanti Neurons platform. Ivanti Neurons users can create tickets to a specific project when configuring the connector. The ServiceNow user credentials used in the connector configuration should have create, read, and write permissions to the specific project to create tickets and subsequently query ticket status from the ServiceNow ticket. When creating a ticket, the connector allows a user to create a ticket on a single vulnerability, multiple vulnerabilities for applications, hosts, application findings, or host findings.

## User Prerequisites/ServiceNow Incident Setup

Refer to the following KB link for the [user permissions required for configuring the ServiceNow Incident Connector](docId\:i9b7z-8GGs5JuXQd4DEDL).

## Configuring the ServiceNow Incident Connector in Ivanti Neurons

Navigate to the **Automate > Integrations** page.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/N6T9UnB5FOanUDKWj7uEe_palo-alto-xpanse-expander.png" alt="Navigation - Automation - Integrations-2" position="flex-start" size="33" width="229" height="151" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" showCaption="false"}

Using the search bar in the upper-right corner of the **Integrations** page, type **ServiceNow **to find the connector.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/HSoRPoKDnvThjNuVL59xg_servicenow-incident-connector.png" position="flex-start" size="98" width="688" height="122" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector.png" showCaption="false"}

Locate the **ServiceNow Incident** card on the page and click **Configuration**.

Complete the required fields in the new window under **Connection**, as described below.

- **Connector Name**: The name of the connector instance.
- **Username**: The user's username that has access to the ServiceNow instance.
- **Password**: Password of the user that has access to the ServiceNow instance.
- **Location (URL)**: The URL of the ServiceNow instance.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/08wsLIx61yDFllegR2Sj4_servicenow-incident-connector1.png" position="flex-start" size="91" width="639" height="448" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_1.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_1.png" showCaption="false"}

Click the **Test Credentials** button to ensure the credentials are correct and have the necessary access to make ServiceNow Incident API calls.

Under **Connector Specific Options**, RiskSense makes dynamic calls to pull information from ServiceNow Incident.

**Templates**: This dropdown lists all available templates from ServiceNow Incident. Users can choose to add more than one template as well.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/YcatgHVcE-PEgZzPGB4x__servicenow-incident-connector2.png" position="flex-start" size="74" width="515" height="297" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_2.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_2.png" showCaption="false"}

**Default Template**: Users can select the default template available from the selected templates. On selecting the default template, the user can use this pre-defined template during ticket creation to complete the incident form.

**Current Templates**: All pre-defined values part of each template are provided here. Users can choose between which template to be better used and can also **Lock Template Fields. **By locking these fields, other users will not be able to edit any of the template fields during ticket creation.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/CsHxSa3MF8waFiVEb9v6L_servicenow-incident-connector3.png" position="flex-start" size="98" width="687" height="284" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_3.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_3.png" showCaption="false"}

**Connector Fields: **Ivanti Neurons will fetch all the available fields from the Incident connector. By default, it shows some mandatory fields; on typing in the search box, Ivanti Neurons will fetch all the available supported optional fields.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/Tzl6Vj1FFR82xBO15XJAn_servicenow-incident-connector4.png" position="flex-start" size="42" width="293" height="291" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_4.png" showCaption="false"}

Suppose the user selects the **Use Plugin Information** checkbox near the Short Description and Description fields. In that case, Ivanti Neurons will send plugin-related information as part of the corresponding fields in ServiceNow Incident. The plugin information includes the scanner, plugin ID, title, description, VRR, and vulnerabilities associated with the plugin. If the ticket is associated with a single finding, the ticket also includes asset information. Users can provide a custom Short Description and Description for the ticket or populate these fields with plugin information automatically.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/3lb3oUOz3nIUwRZ9O-5aS_servicenow-incident-connector5.png" position="flex-start" size="98" width="687" height="507" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_5.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_5.png" showCaption="false"}

**Tag Name Sync Field: **Choosing a field from this dropdown will replace that field with the Ivanti Neurons Tag name when a ticket is created.

**RiskSense Defaults: **Users can select default values for Ivanti Neurons fields.

- **Tag Type**: The user can choose the default tag type. While creating a ticket in the Create Ticket popup, the tag type field will be pre-populated with the chosen value. If the user wishes to override them, it is also possible in the connector form or the Create Ticket popup.
- **SLA Date**: This dropdown provides a list of ServiceNow Incident fields that the user would like to map the SLA date from Ivanti Neurons. If the ticket is associated with more than one finding, the earliest due date applied among those findings would be listed as the SLA Date on the ticket.

**Fields for Ticket Description: **Select the fields that will appear in the ticket description. These are the fields that appear on the Tags page.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/BWuhlbNBwNVsJR-OhGzEf_servicenow-incident-connector6.png" position="flex-start" size="88" width="616" height="482" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_6.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_6.png" showCaption="false"}

**Unsupported Fields: **These fields are not currently supported for this connector integration.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/2IlKRcJxeto9gKleYF3CY_servicenow-incident-connector7.png" position="flex-start" size="66" width="463" height="445" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_7.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_7.png" showCaption="false"}

**Ticket Attachments:** In this section, the ability to attach asset details and findings as Ticket Attachments and allow the deletion of tags associated with the connector option is available.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/ErIasf6VRpKrx8k1B4MJk_servicenow-incident-connector8.png" position="flex-start" size="85" width="592" height="263" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_8.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_8.png" showCaption="false"}

**Ticket Status Settings:**

- **Ticket Sync Status**: This dropdown has a list of statuses from ServiceNow Incident. Ivanti Neurons will send updates (comments/attachments) only for the selected statuses.
- **Close Status**: If the user wishes to move a ServiceNow Incident ticket to a selected status when all the associated findings for a ticket are in a Closed state in Ivanti Neurons, then the user needs to select the status and mark the checkbox. Ivanti Neurons will not send updates to this status.

:::hint{type="info"}
**Note**: The status selected for Ticket Sync Status and Close Status should not be the same.
:::

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/THpE9IHak0s8vwJMXpYnM_servicenow-incident-connector9.png" position="flex-start" size="99" width="691" height="573" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_9.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_9.png" showCaption="false"}

Click **Save **to enable the connector.

## Creating a ServiceNow Incident Ticket

After configuring the ServiceNow Incident connector, you can view information about it from the following list views.

- Hosts
- Host Findings
- Applications
- Application Findings
- Tags

To create a ticket, the user must have the ability to create a ticket on any selected application or host vulnerabilities. First, select at least one finding. Next, click the **More** button and choose the **Create Ticket** option.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/QKgReNpUKtesEXGsuUB-J_servicenow-incident-connector10.png" position="flex-start" size="80" width="561" height="266" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_10.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_10.png" showCaption="false"}

In the *Create Ticket* window, choose the ServiceNow Incident connector. After selecting the connector, the **Create New Ticket **window appears. In the Connector form, if the user has chosen the default value for Tag Type and the SLA date, then the selected values will be prepopulated here. If the user would like to override the chosen tag type, they can select from the dropdown. The SLA date field can also be overridden.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/disJCJZTCbTBHHkHWDLbu_servicenow-incident-connector11.png" position="flex-start" size="94" width="657" height="638" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_11.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_11.png" showCaption="false"}

Once the ticket is created, it will take some time to reflect in the system. Click on the ticket icon in the findings detailed pane, and the user will see the ticketing system with the ticket number, which is a link to the ticket in ServiceNow Incident along with the current state of the ticket in the ticketing system.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/RPYxmInX2G8hskp5eob6S_servicenow-incident-connector12.png" position="flex-start" size="95" width="666" height="457" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_12.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_12.png" showCaption="false"}

If **Use Plugin information** is chosen, the ticket will look like the one below when a finding is associated with a ticket. Users can choose multiple findings, as well.

The following screenshot shows what the Description and Short Description look like in the ServiceNow Incident ticket.

![](https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/_nt2tdMOHKqscxjf0g2v3_servicenow-incident-connector13.png)

If there is more than one finding, each associated plugin’s information will be added to the ticket until the maximum character limit is reached.

Use the **Has Ticket** filter in a list view to see all vulnerabilities with a ticket assigned.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/j3ZLWlJFFwh5y8GJrmKdt_servicenow-incident-connector14.png" position="flex-start" size="51" width="354" height="340" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_14.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/ServiceNow Incident Connector_14.png" showCaption="false"}