Skip to content

ServiceNow Integration FAQ

Answers to common questions about the ServiceNow integration, including configuration, ticket operations, limitations, and troubleshooting.

General

What is the ServiceNow integration?

The ServiceNow integration lets Qualytics create and link ServiceNow Incidents directly from data anomalies detected in the platform. This streamlines the issue resolution workflow by eliminating the need to manually create incidents in ServiceNow and then reference them back in Qualytics.

Is the synchronization one-way or two-way?

One-way only — from Qualytics to ServiceNow. Changes made directly in ServiceNow (incident state, work notes, closure) are not reflected back in Qualytics. See the How It Works page for the full sync matrix.

Who can manage the ServiceNow integration?

  • Users with the Manager or Admin role can connect, edit, and disconnect the integration.
  • Users with the Member role cannot access the integration configuration in Settings, but can view linked tickets on anomalies they have permission to access.

For ticket operations on anomalies (create, link, remove), team-level permissions on the anomaly's datastore also apply. See the Permissions page for details.

Configuration & Credentials

How are credentials stored?

The ServiceNow service account username and password are stored encrypted at rest in Qualytics. They are never shown in plain text in the UI or in API responses.

Can I use OAuth 2.0 instead of Basic Authentication?

Not currently. The integration uses Basic Authentication with a service account username and password in the username:password format. OAuth 2.0 is not supported yet.

Can I connect multiple ServiceNow instances at the same time?

No. Only one ticketing integration (Jira or ServiceNow) can be active at a time. Connecting a new integration requires disconnecting the existing one first.

Can I switch from ServiceNow to Jira later?

Yes. Disconnect the ServiceNow integration and connect a new Jira integration. Existing anomaly-incident links remain in the Qualytics database as historical records but will no longer sync to ServiceNow.

Can I change the ServiceNow instance URL?

You need to disconnect the integration and reconnect it with the new URL. The connector type itself (ServiceNow) cannot be changed on an existing integration.

Enabling Web service access only in ServiceNow restricts the account to API-only usage — the credentials cannot be used to log in through the standard UI. This reduces the attack surface and is a common security best practice for integration accounts that don't need a human-facing login.

Where do I find Category, Subcategory, and Assignment Group values?

These values must match what's configured in your ServiceNow instance — Category and Subcategory are case-sensitive, and Assignment Group requires a sys_id, not the display name. See Find ServiceNow Values for step-by-step lookup instructions.

Ticket Operations

Does linking an existing ServiceNow ticket modify the incident?

Yes — unlike the Jira integration. When you link an existing ServiceNow incident:

  • The anomaly details are appended to the existing description (the original content is preserved)
  • A work note is added to the incident with the linkage information (anomaly ID, status, timestamp)

If you need the incident to remain completely untouched, do not link it from Qualytics.

Situation Recommendation
The anomaly is a new, unique issue not yet tracked anywhere Create a new incident
There's already a ServiceNow incident covering this issue Link the existing incident
The existing incident must remain unchanged Don't link — the description is appended and a work note is added on link

When in doubt, create a new incident — it's the safer default since linking modifies the existing one.

What happens when I acknowledge an anomaly?

A timestamped work note is added to the linked ServiceNow incident (e.g., [2024-01-15 10:30:00 UTC] Qualytics Anomaly Status: Acknowledged). The ServiceNow incident state itself is not changed — this preserves your ServiceNow workflow control.

What happens when I archive (resolve) an anomaly?

A timestamped work note with the resolution status is added to the linked ServiceNow incident. The incident state is not changed automatically.

Yes. Multiple incidents can be linked to a single anomaly. Each link is tracked independently.

Yes. A single ServiceNow incident can be linked to multiple anomalies.

What fields can I set when creating a ServiceNow ticket from Qualytics?

The Create Ticket form supports eight fields:

  • Table (required) — defaults to Incident. Other table options appear in the dropdown but only Incident is currently supported.
  • Short Description (required) — brief one-line summary
  • Description — detailed description; anomaly context is auto-appended
  • Category — must match a category configured in your ServiceNow instance (case-sensitive)
  • Impact — 1 - High, 2 - Medium, or 3 - Low
  • Urgency — 1 - High, 2 - Medium, or 3 - Low
  • Assignment Group — sys_id of the assignment group (not the display name)
  • Caller — shown in the form but currently ignored; all incidents are created with the integration's service account as the caller

See Field Mapping Reference for details on auto-populated content.

Why does the Table dropdown show options like Problem and Change Request if only Incident works?

The dropdown lists Incident, Problem, Change Request, and Task, but only the Incident table is supported in the current release. Selecting any other option still creates an Incident record. Support for additional table types is planned for a future release.

Why is the Caller field shown if it's ignored?

The Caller field is displayed in the Create Ticket form, but its value is not sent to ServiceNow in the current release. All incidents are created with the integration's service account as the caller. User-based caller assignment is on the roadmap.

What's the difference between work notes and comments in ServiceNow, and which does Qualytics use?

In ServiceNow:

  • Work notes are internal — visible only to fulfillers (users with the itil role).
  • Comments ("Additional comments" in some forms) are customer-facing — visible to the requester/caller via the Service Portal or email notifications.

Qualytics writes to work notes for all syncs (status changes, anomaly comments, link events). End users (callers) won't see Qualytics activity unless they have ITIL access. If you need that information visible to a customer, copy it manually into the comments field.

How do I interpret ServiceNow state codes (1, 2, 3, 6, ...)?

ServiceNow uses numeric codes for incident states. The Status field in Qualytics accepts both the code and the readable name. See the full state mapping in State Mappings.

Limitations

Why aren't ServiceNow state changes reflected in Qualytics?

The current release supports one-way sync only (Qualytics → ServiceNow). Two-way sync is planned for a future release. Until then, ServiceNow is the "ticket of record" and Qualytics is the "anomaly of record" — each system maintains its own state independently.

What happens if the ServiceNow incident is deleted?

The link in Qualytics remains but will show broken references. Future sync attempts (work notes, status changes) will fail. You can manually remove the link from the anomaly's Linked Tickets section.

Can Qualytics create tickets automatically (without user action)?

Not yet. Ticket creation is always manual — triggered by a user from the Linked Tickets section of an anomaly. Automatic ticket creation from Flows is planned for a future release.

Troubleshooting

My connection test failed. What should I check?

Issue Resolution
Connection failed Verify instance URL format (https://your-instance.service-now.com), check credentials format (username:password), confirm service account is active
401 Unauthorized Incorrect credentials; verify the username:password format is correct and that the account is not locked
403 Forbidden Service account lacks required roles; add the itil role
Ticket created but missing fields Category names must match exactly (case-sensitive); verify names in ServiceNow choice list
Assignment Group not set Must use sys_id, not group name; copy sys_id from User Administration → Groups
Network timeout Firewall may be blocking; ensure Qualytics IPs are allowlisted
Work notes not appearing Verify the service account has permission to add work notes to incidents

Why do I get 403 Forbidden even with the itil role?

Enterprise ServiceNow instances often use custom Access Control Lists (ACLs) on the Incident table or specific fields. These ACLs can deny access even when the user has the itil role. Ask your ServiceNow administrator to:

  • Confirm the service account can read, create, and write on the Incident table
  • Check field-level ACLs on category, subcategory, assignment_group, and any custom fields you use
  • Verify there are no scoped-application restrictions blocking the account

How do I rotate the service account password?

Update the password directly in your ServiceNow instance (User Administration → Users), then disconnect the current ServiceNow integration in Qualytics and reconnect it with the new credentials.

A linked ticket shows "Unknown" status. What does that mean?

The ticket was linked successfully but the current status could not be fetched from ServiceNow. This usually indicates that the ServiceNow credentials expired or the incident was deleted. Try disconnecting and reconnecting the integration.

Getting Support

If you encounter issues not covered above, contact Qualytics support:

  • Email: support@qualytics.ai
  • Slack: Your dedicated customer Slack channel

Please include: Instance URL (masked if needed), error messages, and steps to reproduce.