How the ServiceNow Integration Works

This page explains how the ServiceNow integration behaves internally: how data flows between Qualytics and ServiceNow, what is synced, state mappings, and how fields are mapped.

Integration Flow Diagram

The following diagram illustrates how data flows from Qualytics to ServiceNow:

flowchart TB
    subgraph Qualytics["Qualytics Platform"]
        A[Anomaly Detected] --> B{User Action}
        B -->|Create Ticket| C[Create Ticket Request]
        B -->|Acknowledge| D[Status Change Event]
        B -->|Add Comment| E[Comment Event]
        B -->|Archive/Resolve| F[Resolution Event]
    end

    subgraph Background["Background Processing"]
        C --> G[Qualytics API]
        D --> H[Sync Worker]
        E --> I[Sync Worker]
        F --> J[Sync Worker]
    end

    subgraph ServiceNow["ServiceNow Instance"]
        G -->|POST /incident| K[New Incident Created]
        H -->|PATCH /incident| L[Work Note Added]
        I -->|PATCH /incident| L
        J -->|PATCH /incident| M[Resolution Work Note]
    end

    K --> N[Ticket Link Stored]
    N --> O[Anomaly & Ticket Linked]

What Gets Synced

The current release supports one-way synchronization from Qualytics to ServiceNow.

Authentication

The ServiceNow integration uses Basic Authentication with a ServiceNow username and password. The credentials must belong to a dedicated service account with the itil role assigned, so Qualytics can create and update Incident records on its behalf.

See the Configure ServiceNow and Add Connection guides for the full setup flow.

ServiceNow State Mappings

ServiceNow uses numeric state values for incidents. Understanding these states helps when working with the integration:

The Status field accepts either the numeric code or one of the six recognized names. States 4 and 5 have to be given as their code, and an incident already sitting in one of them reads back in Qualytics as Unknown (4) or Unknown (5) rather than by name.

Field Mapping Reference

Incident Fields Supported

When creating a ticket from Qualytics, the following ServiceNow Incident fields can be populated:

Auto-Populated Fields

The following fields are automatically populated by Qualytics when creating a ticket:

Key Integration Operations

Create Ticket

Creates a ServiceNow incident from a Qualytics anomaly with:

• Required field: short_description
• Optional fields: description, state, priority, urgency, impact, category, subcategory, assignment_group, assigned_to
• Set by the integration: the record is always created on the Incident table, by the integration's service account; the caller cannot be set from Qualytics
• Auto-included: Anomaly ID, status, type, failed checks, and hyperlink back to the Qualytics anomaly (appended to the description)

When the starting state is Resolved, Closed, or Canceled, a close code and close note are filled in automatically, because ServiceNow requires them on those states.

Link Existing Ticket

Links an existing ServiceNow incident to an anomaly:

• Appends anomaly details to the existing description
• Adds a work note about the linkage

Sync Anomaly Status

When anomaly status changes in Qualytics:

• Adds a timestamped work note to the linked ServiceNow incident
• Example: [2024-01-15 10:30:00 UTC] Qualytics Anomaly Status: Acknowledged

Sync Comments

When comments are added to anomalies in Qualytics:

• The comment text is synced to linked tickets as work notes
• Example: Comment from Qualytics: <user's comment>

The work note carries the comment as plain text, so a mention arrives as a raw text code rather than as the formatted name you saw when typing it, and the mentioned user is notified in Qualytics only. A reply arrives as its own work note with no indication of which comment it answers, because work notes are a flat list. The anomaly's Timeline in Qualytics keeps the full thread with its structure.

Supported Features & Capabilities

Current Release Features

Known Limitations