Guillaume BOURGEOIS
1ca5597453
31 commands: ticket lifecycle (create/update/resolve/delete, comments, work notes, links, tags, journal notes, attachments), generic table records CRUD and discovery, CMDB/user/group queries, service catalog ordering, standard change from template, AWA queue routing, generic API call, plus get_incidents ingestion with a bundled OCSF mapper. Basic or OAuth 2.0 (password grant) authentication, stdlib-only scripts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
29 lines
2.4 KiB
YAML
29 lines
2.4 KiB
YAML
name: "ServiceNow Tickets → OCSF"
|
|
description: "Maps a ServiceNow ticket (Table API, results_path = result) to OCSF finding fields. Reference fields (assigned_to, caller_id, cmdb_ci, …) are {value, link} objects in raw mode and {value, display_value} objects when the fetch uses sysparm_display_value=all — both path variants are listed and absent ones are skipped safely."
|
|
field_mappings:
|
|
title: "short_description"
|
|
severity: "priority = '1' ? 5 : (priority = '2' ? 4 : (priority = '3' ? 3 : 2))"
|
|
description: "description"
|
|
# results_path = result; source_path is JSONata over ONE ticket object.
|
|
# Paths absent from a given ticket are skipped at ingestion, so extra entries are safe.
|
|
ocsf:
|
|
# ── Finding ───────────────────────────────────────────────────────
|
|
- { source_path: "sys_id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "number", ocsf_field: "finding_info.uid_alt" }
|
|
- { source_path: "short_description", ocsf_field: "finding_info.title" }
|
|
- { source_path: "description", ocsf_field: "finding_info.desc" }
|
|
- { source_path: "opened_at", ocsf_field: "finding_info.first_seen_time" }
|
|
- { source_path: "sys_created_on", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "sys_updated_on", ocsf_field: "finding_info.modified_time" }
|
|
- { source_path: "category", ocsf_field: "finding_info.analytic.category" }
|
|
- { source_path: "subcategory", ocsf_field: "finding_info.types" }
|
|
- { source_path: "state", ocsf_field: "status" }
|
|
- { source_path: "close_code", ocsf_field: "disposition" }
|
|
- { source_path: "close_notes", ocsf_field: "comment" }
|
|
# ── People ────────────────────────────────────────────────────────
|
|
- { source_path: "sys_created_by", ocsf_field: "actor.user.name" }
|
|
- { source_path: "caller_id.display_value", ocsf_field: "user.name" }
|
|
- { source_path: "assigned_to.display_value", ocsf_field: "assignee.name" }
|
|
# ── Affected CI ───────────────────────────────────────────────────
|
|
- { source_path: "cmdb_ci.display_value", ocsf_field: "device.hostname" }
|