Connectors
ServiceNow
ServiceNow
Updated 2026-08-16
Automation Guide for Bloo
1. Overview
ServiceNow is a software as a service (SaaS) product for technical management support.
2. Configuration
- In the Configuration Box, enter the Configuration Name to uniquely identify this configuration. Follow the initial setup steps described in How to Configure Automation? in the Bloo Knowledge Base.
- Identify the content of headers and payload that you need to provide in the Configuration Box. Use the reference table below.
Configuration Reference
| Field | Value |
|---|---|
| Request Method | POST |
| URL | https://<your-instance>.service-now.com/api/now/table/incident |
| Header: Content-Type | application/json |
| Header: Accept | application/json |
| Header: Authorization | Basic <base64-encoded username:password> |
Note: AuthenticationReplace <your-instance> with your ServiceNow instance name (e.g., dev12345.service-now.com).The Authorization header uses HTTP Basic Authentication. Encode your ServiceNow username and password in Base64 format: base64(username:password).ServiceNow also supports OAuth 2.0 for more secure authentication. Refer to your ServiceNow instance documentation for details. |
Below is an example of how you can leverage this plugin to create an incident on ServiceNow.
Payload
{ "short_description": "Bloo ALERT", "caller_id": "admin", "comments": "Alert from Bloo - Found Suspicious Remote Desktop Activity on host DstIP"}
ServiceNow API creates an incident on the ServiceNow account based on the values given in the payload. This plugin is basically provisioned to replace the SrcIP, DstIP variables with the value received from the data stack received on running a Search block.
In the above figure, a workbook named Suspicious Remote Desktop Network Activity is executed which contains the following blocks:
- SQL Block: Displays two suspicious Destination IPs on execution of the workbook.
- Signal Block: This will raise a signal on detecting the suspicious IPs.
- DQL Block with _trigger query: Using Generic Webhook plugin for ServiceNow, an incident is created on ServiceNow based on the values given in the payload.
3. Related Links
Related
Was this page helpful?