Skip to main content
Last updated on

ServiceNow

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

Export Lakewatch alerts to ServiceNow. When an alert is created, Lakewatch creates an Incident record in ServiceNow and updates it as the alert changes. For how export behaves across destinations, see Alert destinations.

Export to ServiceNow is one-way, from Lakewatch to ServiceNow. Lakewatch signs in with an OAuth application that you register in ServiceNow.

How the record is created and updated​

  • On alert creation: Lakewatch creates an Incident record in your ServiceNow instance.
  • On change: as the alert's title, description, or state changes, Lakewatch updates the same record.

Each record's correlation ID holds the Lakewatch alert ID, so you can trace a record back to its alert.

Prerequisites​

Set up ServiceNow​

In ServiceNow, register an OAuth application that Lakewatch uses to create and update Incident records. These are the high-level steps. For the exact procedure, see the ServiceNow OAuth documentation.

  1. In ServiceNow, go to System OAuth > Application Registry and select Create an OAuth API endpoint for external clients. You can create a new application or reuse an existing one.
  2. Set Client Type to Integration as a Service, set Scope Restriction to Broadly scoped, and set the OAuth Application User.
  3. Grant the OAuth Application User the incident_manager role, so it can create and update Incident records.

Note the instance ID, the OAuth client ID, and the client secret.

Store the client secret as a Unity Catalog secret​

Store the OAuth client secret in a Unity Catalog secret in the __lakewatch schema of your Lakewatch environment's catalog. Select secret lists secrets from that schema, and Create secret creates one there. Lakewatch stores only the secret name, not the secret value.

You can create this secret ahead of time in <catalog>.__lakewatch, or create it while configuring ServiceNow export with the Create secret button. Either way, creating a secret requires USE CATALOG on the catalog and either ownership of the __lakewatch schema or both CREATE SECRET and USE SCHEMA on it. For the steps, see Create a secret.

Required permissions​

To configure ServiceNow export, you need the following:

  • READ SECRET on the Unity Catalog secret that holds the client secret, or on its parent schema or catalog. Lakewatch checks that you can read the secret when you save the configuration. To grant it, see Manage permissions on secrets.
  • The MANAGE privilege on your Lakewatch environment's catalog. See Configure settings.

To change the client secret, update the value of the same Unity Catalog secret. Lakewatch uses the new value on the next export, with no change to the settings. To use a different secret, click Select secret or Create secret in the settings and save.

Set up ServiceNow as an alert destination​

Configure a ServiceNow destination for alerts in the Alerts settings section.

  1. In the Lakewatch sidebar, go to Settings, then open Alerts.
  2. Under Delivery, set Alert destination to ServiceNow.
  3. In Instance ID, enter only the first part of your instance's hostname: for https://acme.service-now.com, enter acme.
  4. In Client ID, enter the OAuth client ID of the application you registered in ServiceNow.
  5. For Client secret, click Select secret to choose the secret that holds the client secret, or click Create secret to create one from the client secret without leaving the page. The field shows the secret's name, not its value.
  6. Save your changes.

For the full alert settings reference, see Configure settings.

Troubleshooting​

  • Records aren't created in ServiceNow: the OAuth Application User can't create Incident records, or the instance ID is wrong. Confirm the Application User has the incident_manager role, and that the instance ID is only the first part of the hostname (for example, acme).
  • The configuration doesn't save: you don't have permission to read the Unity Catalog secret, or the secret is in a different catalog than your Lakewatch environment. Confirm your access to the secret and its catalog.
  • Your secret isn't listed in Select secret: Select secret lists only the secrets you can access in the __lakewatch schema of your environment's catalog. Store the secret there, or ask for READ SECRET on it.
  • Authentication fails: the client ID or client secret is wrong, or the OAuth application lacks permission. Confirm the client ID, the secret value, and the application's access in ServiceNow.
  • You rotated the client secret: update the Unity Catalog secret with the new value. No change to the export configuration is needed.
On this page