Set up ServiceNow Event Ingestion Integration add-on

Install and set up the ServiceNow Event Ingestion Integration add-on in your Splunk enterprise console or Splunk Cloud instance.

Before you begin

Important:

Create a Manual event forwarding profile to forward alerts on-demand from your splunk console to create a Security Incident Response (SIR) on the ServiceNow instance. For more information, see Create and name an event profile and implement same for Splunk V2.

This add-on setup is necessary to enable manual event forwarding for the Splunk profile. Up-to two configurations can be created for a particular add-on. (Splunk Primary and Splunk Secondary)

Verify that you have installed the application for this integration from the ServiceNow Store before installing the add-on plugin from splunkbase that is required for manual event ingestion. If you have not installed the application for the integration from the ServiceNow Store, see Install and configure the ServiceNow application for the Splunk Enterprise Event Ingestion integration and follow the instructions to install it.

Role required: ServiceNow AI Platform administrator (admin)

About this task

If you want to export events manually and on-demand from your Splunk console for the integration, download, and set up the ServiceNow Event Ingestion Integration add-on from Splunkbase in your Splunk console.

This ServiceNow extension add-on is required so that security incidents can be created from manually exported events in your ServiceNow AI Platform instance. This ServiceNow Event Ingestion Integration add-on is available on splunkbase.

For manual event forwarding, you can identify up to two different ServiceNow AI Platform endpoints (instances) in your Splunk Enterprise console. You forward the events to the endpoint or endpoints manually to create security incidents. For example, you can specify both a staging (development) instance and a production instance. By specifying separate instances and naming primary and secondary workflows for each instance, you can choose where you want to forward different events.

Procedure

1. If you have not already installed the ServiceNow Event Ingestion Integration add-on, follow these steps to install and configure it.

   1. Download ServiceNow Event Ingestion Integration add-on from Splunkbase.

   2. If prompted, restart the Splunk Enterprise.

      The ServiceNow Event Ingestion Integration add-on is installed in your Splunk Enterprise enterprise console. The next step is to set up the Add-on.

2. To set up the Addon, follow these steps.

   1. In the Splunk Enterprise, select Manage Apps gear icon on the menu drop-down list.

   2. On the list of applications that is displayed, in the Actions column, select Set up for ServiceNow Event Ingestion Integration.

      The ServiceNow Event Ingestion Integration add-on is configured into three different tabs.

      • Splunk Primary: The default or primary Splunk configuration.
      • Splunk Secondary: (Optional) The backup or second Splunk configuration.
      • Logging Level: The level of reporting logs generated by the integration, meaning the name of the type of information.
        1. On the form, fill in the fields.

4.  Select **Save**.

5.  Select the **Splunk Secondary** tab.

6.  On the form, fill in the fields.

    Fields are same as in the Splunk Primary tab.

7.  Select **Save**.

    **Note:** Up-to two configurations can be created for a particular add-on.\(**Basic Authentication** and another **OAuth 2.0 Authentication**\)

8.  Select the **Logging Level** tab.

9.  On the form, fill in the fields.

10. Select **Save**.

What to do next

Using ServiceNow Event Ingestion Integration add-on

Parent Topic:Integration architecture and external systems connection