Skip to main content
Last updated on

ServiceNow

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

Export Lakewatch alerts to ServiceNow. When an alert is created, Lakewatch creates an Incident record in ServiceNow through the Table API and updates it as the alert changes. For how export behaves across destinations, see Alert destinations.

Export to ServiceNow is one-way, from Lakewatch to ServiceNow. Lakewatch writes to the ServiceNow Table API, authenticating with an OAuth application that you register in ServiceNow.

How the record is created and updated​

  • On alert creation: Lakewatch creates an Incident record in your ServiceNow instance through the Table API.
  • On change: as the alert's title, description, or state changes, Lakewatch updates the same record.

Lakewatch sets the record's correlation ID to the Lakewatch alert ID, so you can trace a record back to its alert and Lakewatch updates the same record rather than creating a duplicate.

Prerequisites​

Set up ServiceNow​

In ServiceNow, register an OAuth application that Lakewatch uses to create and update Incident records. These are the high-level steps. For the exact procedure, see the ServiceNow OAuth documentation.

  1. In ServiceNow, go to System OAuth > Application Registry and select Create an OAuth API endpoint for external clients. You can create a new application or reuse an existing one.
  2. Set Client Type to Integration as a Service, set Scope Restriction to Broadly scoped, and set the OAuth Application User.
  3. Grant the OAuth Application User the incident_manager role, so it can create and update Incident records.

Note the instance ID, the OAuth client ID, and the client secret.

Store the client secret as a Unity Catalog secret​

Lakewatch reads the OAuth client secret from a Unity Catalog secret, a securable with a three-level name in the form catalog.schema.secret, each time it exports an alert. Lakewatch stores only the secret name, not the secret value.

You can create this secret ahead of time, or create it inline while configuring ServiceNow export with the Create secret button. Either way, creating a secret requires USE CATALOG on the catalog and either ownership of the schema or both CREATE SECRET and USE SCHEMA on the schema. For the steps, see Create a secret.

Required permissions​

To configure ServiceNow export, you need the following:

  • READ SECRET on the Unity Catalog secret that holds the client secret, or on its parent schema or catalog. Lakewatch checks that you can read the secret when you save the configuration. To grant it, see Manage permissions on secrets.
  • Permission to edit the alert export configuration in workspace settings.

At export time, Lakewatch reads the client secret itself, as its service principal. Because Lakewatch reads the secret by name each time it exports, rotating the secret is zero-touch: update the Unity Catalog secret and Lakewatch uses the new value on the next export, with no change to the export configuration.

Configure ServiceNow export​

Configure a ServiceNow destination for alerts in the Alerts settings section.

  1. In the Lakewatch sidebar, go to Settings, then open Alerts.
  2. Find the Export setting under Alerts.
  3. Set the export destination to ServiceNow.
  4. For Workspace, keep the current workspace unless the destination is behind a specific workspace's network, such as a PrivateLink endpoint or a region-restricted service. This workspace's network delivers the export.
  5. In Instance ID, enter your ServiceNow instance ID. Enter the host label only, not the full URL: for an instance at https://acme.service-now.com, enter acme.
  6. In Client ID, enter the OAuth client ID of the application you registered in ServiceNow.
  7. Set Client secret to the Unity Catalog secret that holds the OAuth client secret. Type or paste its three-level name (catalog.schema.secret), click Select secret to pick an existing secret, or click Create secret to create one from the client secret without leaving the page. After you save, the secret field becomes read-only; to update it, rotate the secret in Unity Catalog.
  8. Save your changes.

For the full alert settings reference, see Configure settings.

Troubleshooting​

  • Records aren't created in ServiceNow: the OAuth Application User can't create Incident records, or the instance ID is wrong. Confirm the Application User has the incident_manager role, and that the instance ID is the host label only (for example, acme).
  • The configuration doesn't save: you don't have permission to read the Unity Catalog secret, or the secret name isn't in the catalog.schema.secret form. Confirm your access to the secret and the secret name.
  • Authentication fails: the client ID or client secret is wrong, or the OAuth application lacks permission. Confirm the client ID, the secret value, and the application's access in ServiceNow.
  • You rotated the client secret: update the Unity Catalog secret with the new value. No change to the export configuration is needed.
On this page