f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(servicenow): new ServiceNow ITSM integration

Browse Source 
31 commands: ticket lifecycle (create/update/resolve/delete, comments,
work notes, links, tags, journal notes, attachments), generic table
records CRUD and discovery, CMDB/user/group queries, service catalog
ordering, standard change from template, AWA queue routing, generic
API call, plus get_incidents ingestion with a bundled OCSF mapper.
Basic or OAuth 2.0 (password grant) authentication, stdlib-only scripts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-07-10 22:48:50 +02:00
parent c406edb5e7
commit 1ca5597453
34 changed files with 2629 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/servicenow/mappers/get_incidents.yaml
+28
View File
@@ -0,0 +1,28 @@
name: "ServiceNow Tickets → OCSF"
description: "Maps a ServiceNow ticket (Table API, results_path = result) to OCSF finding fields. Reference fields (assigned_to, caller_id, cmdb_ci, …) are {value, link} objects in raw mode and {value, display_value} objects when the fetch uses sysparm_display_value=all — both path variants are listed and absent ones are skipped safely."
field_mappings:
title: "short_description"
severity: "priority = '1' ? 5 : (priority = '2' ? 4 : (priority = '3' ? 3 : 2))"
description: "description"
# results_path = result; source_path is JSONata over ONE ticket object.
# Paths absent from a given ticket are skipped at ingestion, so extra entries are safe.
ocsf:
# ── Finding ───────────────────────────────────────────────────────
- { source_path: "sys_id", ocsf_field: "finding_info.uid" }
- { source_path: "number", ocsf_field: "finding_info.uid_alt" }
- { source_path: "short_description", ocsf_field: "finding_info.title" }
- { source_path: "description", ocsf_field: "finding_info.desc" }
- { source_path: "opened_at", ocsf_field: "finding_info.first_seen_time" }
- { source_path: "sys_created_on", ocsf_field: "finding_info.created_time" }
- { source_path: "sys_updated_on", ocsf_field: "finding_info.modified_time" }
- { source_path: "category", ocsf_field: "finding_info.analytic.category" }
- { source_path: "subcategory", ocsf_field: "finding_info.types" }
- { source_path: "state", ocsf_field: "status" }
- { source_path: "close_code", ocsf_field: "disposition" }
- { source_path: "close_notes", ocsf_field: "comment" }
# ── People ────────────────────────────────────────────────────────
- { source_path: "sys_created_by", ocsf_field: "actor.user.name" }
- { source_path: "caller_id.display_value", ocsf_field: "user.name" }
- { source_path: "assigned_to.display_value", ocsf_field: "assignee.name" }
# ── Affected CI ───────────────────────────────────────────────────
- { source_path: "cmdb_ci.display_value", ocsf_field: "device.hostname" }