Event

Sync Type: Incremental

Overview

The ServiceNow Event input fetches data from the ServiceNow Table API. This input accesses data from the em_event table, which is part of ServiceNow Event Management. This table stores event records generated by monitoring tools and integrations for alerting, incident creation, and operational intelligence.

Note: This input requires the Event Management plugin (com.snc.evt_mgmt) to be installed in your ServiceNow instance. Personal Developer Instances may not include this module by default.

Prerequisites

Portal setup

1. Login to your ServiceNow Instance.
2. Navigate to Users
   • Click on All option and type Users. Select Users option from under System Security > Users and Groups.
3. Create a New User
   • Fill out the details, most importantly First name, Last name and Email. Click Submit to save the info.
   • Click on New button to add a new User record.
4. Locate the new user
   • Find the newly created user in the users list.
   • Click on the UserID to open the user record details.
5. Assign Roles
   • In the user record details, a new "Roles" tab will appear at the bottom.
   • Click on "Edit" under the Roles tab, which will open a new page with all available roles.
   • For the Table API, you can either add all admin roles for the tables you want to retrieve data from or add the "general" admin role to give access to all tables.
   • Save the changes.
6. Set Password
   • Return to the user record.
   • You will see a "Set Password" button next to the update and delete button.
   • Click the Set Password button, which will open a popup.
   • Click the "Generate" button inside the popup to create a password, then click "Save Password".
7. Instance Name
   • Note the instance name of the ServiceNow instance for use in later steps. For example, if the URL to your ServiceNow instance is https://test-demo.service-now.com, the instance name will be test-demo.

Enable Event Mangement Plugin

1. Login to your ServiceNow Instance.
2. Navigate to Plugins

• Click on All option and type Plugins. Select Plugins option from under System Definition.

3. Search for Event Management, select Event Management Core from search results and click on Install.

OAuth Setup

⚠️ Important: Before setting up OAuth make sure you have security_admin role.

1. Navigate to System OAuth > Application Registry.
2. Click New and then click Create an OAuth API endpoint for external clients.
3. Enter the name of the client and click the Submit button to generate Client Secret.
4. Once generated note down Client ID and Client Secret.

Configuration

Setting	Type	Required	Description
Instance name	string	true	Instance name found in URL of your ServiceNow instance
Username	string	true	Your ServiceNow instance username.
Password	string	true	Your ServiceNow instance password.
Client ID	string	true	Client ID of the application created in the Application Registry while setting up OAuth.
Client Secret	string	true	Client ID of the application created in the Application Registry while setting up OAuth.
Backfill start time	string	No	The date to start fetching data from. If not specified, no past records will be fetched.

Related Articles

• ServiceNow Table API
• ServiceNow OAuth
• ServiceNow - Event Management

Sample Record

{
    "additional_info": "",
    "alert": "",
    "bucket": "4",
    "ci_identifier": "",
    "ci_type": "cmdb_ci_appl_now_app",
    "classification": "9",
    "cmdb_ci": "",
    "description": "",
    "error_msg": "",
    "event_class": "221087",
    "event_rule": "",
    "message_key": "8a7d7c47-1b65-44a2-11ab-25fa20966363",
    "metric_name": "Event Management - Evaluate Scoped Alert Rules Management0",
    "node": "",
    "processed": "2025-12-05 01:56:09",
    "processing_duration": "737",
    "processing_notes": "processingNotes",
    "processing_sn_node": {
        "link": "https://devtest.service-now.com/api/now/table/sys_cluster_state/d6ee4892-cddf-89a3-f022-bb7947c3e767",
        "value": "d863f8df-c1c2-1f04-616a-ccbbe4a2eb9d"
    },
    "resolution_state": "New",
    "resource": "Monitor all event management jobs",
    "severity": "5",
    "source": "",
    "state": "Processed",
    "sys_created_by": "system",
    "sys_created_on": "2025-12-05 09:56:09",
    "sys_domain": {
        "link": "https://devtest.service-now.com/api/now/table/sys_user_group/global",
        "value": "global"
    },
    "sys_id": "fa160c7c-b993-ae8b-ea88-ab967bed7285",
    "sys_mod_count": "8",
    "sys_tags": "",
    "sys_updated_by": "admin",
    "sys_updated_on": "2025-12-05 08:56:09",
    "time_of_event": "2025-12-05 07:56:09",
    "type": ""
}