Skip to content

ServiceNow Integration FAQ

Answers to common questions about the ServiceNow integration, including configuration, ticket operations, limitations, and troubleshooting.

General

What is the ServiceNow integration?

The ServiceNow integration lets Qualytics create and link ServiceNow Incidents directly from data anomalies detected in the platform. This streamlines the issue resolution workflow by eliminating the need to manually create incidents in ServiceNow and then reference them back in Qualytics.

Is the synchronization one-way or two-way?

One-way only, from Qualytics to ServiceNow. Changes made directly in ServiceNow (incident state, work notes, closure) are not reflected back in Qualytics. See the How It Works page for the full sync matrix.

Who can manage the ServiceNow integration?

  • Users with the Manager or Admin role can connect, edit, and disconnect the integration.
  • Users with the Member role cannot access the integration configuration in Settings, but can view linked tickets on anomalies they have permission to access.

For ticket operations on anomalies (create, link, remove), team-level permissions on the anomaly's datastore also apply. See the Permissions page for details.

Configuration & Credentials

How are credentials stored?

The ServiceNow service account username and password are stored encrypted at rest in Qualytics. They are never shown in plain text in the UI or in API responses.

Can I use OAuth 2.0 instead of Basic Authentication?

Not currently. The integration uses Basic Authentication with a service account username and password in the username:password format. OAuth 2.0 is not supported yet.

Can I connect multiple ServiceNow instances at the same time?

No. Only one ticketing integration (Jira or ServiceNow) can be active at a time. Connecting a new integration requires disconnecting the existing one first.

Can I switch from ServiceNow to Jira later?

Yes. Disconnect the ServiceNow integration and connect a new Jira integration. Existing anomaly-incident links remain in Qualytics as historical records but will no longer sync to ServiceNow.

Can I change the ServiceNow instance URL?

You need to disconnect the integration and reconnect it with the new URL. The connector type itself (ServiceNow) cannot be changed on an existing integration.

Enabling Web service access only in ServiceNow restricts the account to API-only usage, so the credentials cannot be used to log in through the standard UI. This reduces the attack surface and is a common security best practice for integration accounts that don't need a human-facing login.

Where do I find Category, Subcategory, Assignment Group, and Assigned To values?

These values must match what's configured in your ServiceNow instance. Category and Subcategory are case-sensitive. Assignment Group and Assigned To both require a sys_id, not the display name or the username. See Find ServiceNow Values for step-by-step lookup instructions.

Ticket Operations

Does linking an existing ServiceNow ticket modify the incident?

Yes, unlike the Jira integration. When you link an existing ServiceNow incident:

  • The anomaly details are appended to the existing description (the original content is preserved)
  • A work note is added to the incident with the linkage information (anomaly ID, status, timestamp)

If you need the incident to remain completely untouched, do not link it from Qualytics.

Situation Recommendation
The anomaly is a new, unique issue not yet tracked anywhere Create a new incident
There's already a ServiceNow incident covering this issue Link the existing incident
The existing incident must remain unchanged Don't link, because the description is appended and a work note is added on link

When in doubt, create a new incident. It's the safer default, since linking modifies the existing one.

What happens when I acknowledge an anomaly?

A timestamped work note is added to the linked ServiceNow incident (e.g., [2024-01-15 10:30:00 UTC] Qualytics Anomaly Status: Acknowledged). The ServiceNow incident state itself is not changed, which preserves your ServiceNow workflow control.

What happens when I archive (resolve) an anomaly?

A timestamped work note with the resolution status is added to the linked ServiceNow incident. The incident state is not changed automatically.

Yes. Multiple incidents can be linked to a single anomaly. Each link is tracked independently.

Yes. A single ServiceNow incident can be linked to multiple anomalies.

What fields can I set when creating a ServiceNow ticket from Qualytics?

The Create Ticket form has ten fields:

  • Short Description (required): brief one-line summary.
  • Description: detailed description. Anomaly context is added automatically.
  • Status: the state the incident starts in. Defaults to New.
  • Priority: Critical, High, Moderate, Low, or Planning. Defaults to Moderate.
  • Urgency: High, Medium, or Low. Defaults to Low.
  • Impact: High, Medium, or Low. Defaults to Low.
  • Category: must match a category configured in your ServiceNow instance (case-sensitive).
  • Subcategory: must match a subcategory configured in your ServiceNow instance (case-sensitive).
  • Assignment Group: sys_id of the assignment group, not the display name.
  • Assigned To: sys_id of the user, not the username.

Every record is created on the Incident table by the integration's service account, and the caller cannot be set from Qualytics. Neither the table nor the caller is part of the form.

See Field Mapping Reference for details on auto-populated content.

Why is my incident unassigned even though I filled in Assigned To?

Assigned To takes the user's sys_id, not a username or a display name. A value ServiceNow cannot resolve to a user is ignored, and the incident is created with no assignee. The same applies to Assignment Group. See Find ServiceNow Values for how to look up a sys_id.

What's the difference between work notes and comments in ServiceNow, and which does Qualytics use?

In ServiceNow:

  • Work notes are internal, visible only to fulfillers (users with the itil role).
  • Comments ("Additional comments" in some forms) are customer-facing, visible to the requester or caller via the Service Portal or email notifications.

Qualytics writes to work notes for all syncs (status changes, anomaly comments, link events). End users (callers) won't see Qualytics activity unless they have ITIL access. If you need that information visible to a customer, copy it manually into the comments field.

Do replies and comments on a specific change sync to ServiceNow?

Yes. Every comment posted on the anomaly's Timeline is pushed to the linked incident as a work note, whether it stands alone, is anchored to a specific change, or replies to another comment. The sync only ever adds, so edits to an existing comment are not re-synced, and deleting a comment in Qualytics leaves the work note already on the incident in place. Comments on containers, quality checks, and check templates are not pushed to tickets, because those assets have no linked ticket.

How does a comment look once it reaches ServiceNow?

The work note carries the comment as plain text. Two things do not survive the trip:

  • A mention arrives as a raw text code rather than as the formatted name you saw when typing it, and the mentioned user is notified in Qualytics only, not in ServiceNow.
  • A reply arrives as its own work note with no indication of which comment it answers, because work notes are a flat list.

For the full thread with its structure intact, open the anomaly's Timeline in Qualytics.

How do I interpret ServiceNow state codes (1, 2, 3, 6, ...)?

ServiceNow uses numeric codes for incident states. The Status field in Qualytics accepts the code, and it also accepts the readable name for the six states Qualytics recognizes: New, In Progress, On Hold, Resolved, Closed, and Canceled. Any other state has to be given as its numeric code. See the full state mapping in State Mappings.

Limitations

Why aren't ServiceNow state changes reflected in Qualytics?

The current release supports one-way sync only (Qualytics → ServiceNow). Two-way sync is planned for a future release. Until then, ServiceNow is the "ticket of record" and Qualytics is the "anomaly of record", and each system maintains its own state independently.

What happens if the ServiceNow incident is deleted?

The link in Qualytics remains but will show broken references. Future sync attempts (work notes, status changes) will fail. You can manually remove the link from the anomaly's Linked Tickets section.

Can Qualytics create tickets automatically (without user action)?

Yes. Besides creating an incident by hand from the Linked Tickets section of an anomaly, a Flow can do it for you: add the Create Ticket action to a Flow and every anomaly that matches the trigger gets an incident, already linked to the anomaly. A Flow can also move an existing linked incident with the Update Ticket Status action. See Ticketing actions.

Troubleshooting

My connection test failed. What should I check?

Issue Resolution
Connection failed Verify instance URL format (https://your-instance.service-now.com), check credentials format (username:password), confirm service account is active
401 Unauthorized Incorrect credentials; verify the username:password format is correct and that the account is not locked
403 Forbidden Service account lacks required roles; add the itil role
Ticket created but missing fields Category names must match exactly (case-sensitive); verify names in ServiceNow choice list
Assignment Group not set Must use sys_id, not group name; copy sys_id from User Administration → Groups
Network timeout Firewall may be blocking; ensure Qualytics IPs are allowlisted
Work notes not appearing Verify the service account has permission to add work notes to incidents

Why do I get 403 Forbidden even with the itil role?

Enterprise ServiceNow instances often use custom Access Control Lists (ACLs) on the Incident table or specific fields. These ACLs can deny access even when the user has the itil role. Ask your ServiceNow administrator to:

  • Confirm the service account can read, create, and write on the Incident table
  • Check field-level ACLs on category, subcategory, assignment_group, and any custom fields you use
  • Verify there are no scoped-application restrictions blocking the account

How do I rotate the service account password?

Update the password directly in your ServiceNow instance (User Administration → Users), then disconnect the current ServiceNow integration in Qualytics and reconnect it with the new credentials.

A linked ticket shows "Unknown" status. What does that mean?

The ticket was linked successfully but the current status could not be fetched from ServiceNow. This usually indicates that the ServiceNow credentials expired or the incident was deleted. Try disconnecting and reconnecting the integration.

Getting Support

If you encounter issues not covered above, contact Qualytics support:

  • Email: support@qualytics.ai
  • Slack: Your dedicated customer Slack channel

Please include: Instance URL (masked if needed), error messages, and steps to reproduce.