Use Azure alerts to create a ServiceNow alert or event work item

This article describes the process of sending alerts and events to ServiceNow using ITSM actions.

After you create your ITSM connection, use the ITSM action in action groups to create work items in your ITSM tool based on Azure alerts. Action groups provide a modular and reusable way to trigger actions for your Azure alerts. You can use action groups with metric alerts, activity log alerts, and Log Analytics alerts in the Azure portal.

Create ITSM work items

1. In the Azure portal, select Monitor > Alerts.

2. On the menu at the top of the screen, select Manage actions.

3. On the Action groups screen, select +Create. The Create action group screen appears.

4. Select the Subscription and Resource group where you want to create your action group. Enter values in Action group name and Display name for your action group. Then select Next: Notifications.

5. On the Notifications tab, select Next: Actions.

6. On the Actions tab, select ITSM in the Action type list. For Name, provide a name for the action. Then select the pen button that represents Edit details.

7. In the Subscription list, select the subscription that contains your Log Analytics workspace. In the Connection list, select your ITSM Connector name. It will be followed by your workspace name. An example is MyITSMConnector(MyWorkspace).

8. In the Work Item type field, select the type of work item.

9. In the last section of the interface for creating an ITSM action group, if the alert is a log alert, you can define how many work items will be created for each alert. For all other alert types, one work item is created per alert.

   • If the work item type is Event:

     If you select Create a work item for each row in the search results, every row in the search results creates a new work item. Because several alerts occur for the same affected configuration items, there is also more than one work item. For example, an alert that has three configuration items creates three work items. An alert that has one configuration item creates one work item.

     If you select the Create a work item for configuration item in the search results, ITSMC creates a single work item for each alert rule and adds all affected configuration items to that work item. A new work item is created if the previous one is closed. This means that some of the fired alerts won't generate new work items in the ITSM tool. For example, an alert that has three configuration items creates one work item. If an alert has one configuration item, that configuration item is attached to the list of affected configuration items in the created work item. An alert for a different alert rule that has one configuration item creates one work item.

     

   • If the work item type is Alert:

     If you select Create a work item for each row in the search results, every row in the search results creates a new work item. Because several alerts occur for the same affected configuration items, there is also more than one work item. For example, an alert that has three configuration items creates three work items. An alert that has one configuration item creates one work item.

     If you do not select Create a work item for each row in the search results, ITSMC creates a single work item for each alert rule and adds all affected configuration items to that work item. A new work item is created if the previous one is closed. This means that some of the fired alerts won't generate new work items in the ITSM tool. For example, an alert that has three configuration items creates one work item. If an alert has one configuration item, that configuration item is attached to the list of affected configuration items in the created work item. An alert for a different alert rule that has one configuration item creates one work item.

     

10. You can configure predefined fields to contain constant values as a part of the payload. Based on the work item type, three options can be used as a part of the payload:

    • None: Use a regular payload to ServiceNow without any extra predefined fields and values.
    • Use default fields: Use a set of fields and values that will be sent automatically as a part of the payload to ServiceNow. Those fields aren't flexible, and the values are defined in ServiceNow lists.
    • Use saved templates from ServiceNow: Use a predefined set of fields and values that were defined as a part of a template definition in ServiceNow. If you already defined the template in ServiceNow, you can use it from the Template list. Otherwise, you can define it in ServiceNow.

11. Select OK.

When you create or edit an Azure alert rule, use an action group, which has an ITSM action. When the alert triggers, the work item is created or updated in the ITSM tool.