Forum Discussion

neil's avatar
neil
Icon for Expert rankExpert
2 months ago

ServiceNow Incident Sync Pack & RBAs

Hi all,

I am currently trying to configure some Run book automation policies to enrich data in ServiceNow incidents, sending the RBA output into the Incident worklog, and have hit a bit of a road block on the best way to configure the RBA criteria.

Background: We use a dedicated "ServiceNow: [Incident] - Add/Update" RBA for each organisation, which is triggered on event creation, to effectively "Auto Ticket" on all events for specific SL orgs (excluding masked and child rollup). 

Challenge: In my Enrichment RBA's I want to trigger using "and external ticket IS created", to ensure that I am only posting updates when there has been a ServiceNow incident created. However the OOTB ServiceNow Incident sync pack is updating the events external ticket ref field with various messages e.g. "Sync Successful", before the event is updated with the Incident Number.

As soon as the Incident Create updates the events external ticket ref field, by Automation policy gets triggered (I assume because from the RBA's point of view, it has a value in the field) to update the Worklog.

Does anyone have any suggestions on the best way to ensure that an "Enrichment" RBA is only triggered only once it has a real SN incident number returned?

Many thanks in advance.
Neil

run_book_automation
  • teppotahkapaa's avatar
    teppotahkapaa
    Icon for Leader rankLeader
    2 months ago

    One way could be to put those enrichment actions into those same RBA policies which actually initiate the incident creation

    • neil's avatar
      neil
      Icon for Expert rankExpert
      2 months ago

      Hi teppotahkapaa 

      Thanks fo rhte suggestion, but that wont work for our environment as the "Enrichment" RBA's are technology specific, i.e. PowerShell cmds are executed which will fail to run on network devices :(.

      Any other thoughts or ideas?

      • LukeAuxilion's avatar
        LukeAuxilion
        Icon for Contributor rankContributor
        2 months ago

        Hi Neil,

        There are three options here -
        1:Create a device group for the devices you would like the automation to run on automatically. 

        2: Set a delay in the elapsed time ( I would suggest doing this anyway 5 mins works for us but would depend on when the incident sync - syncs across) If you have loads of automation running at once spread them out for every 3 mins. 

        3: The below would work and would only trigger when an external ticket is created, I set a delay so it doesn't override our enrichment.