How to make Elastic ServiceNow custom connector for incident creation?

Question

I want to create kind of custom connector whenever there is alert triggered by Elastic rule it will take the details and create incident in ServiceNow.

I have created a webhook in Elastic connector and a empty POST scripted API in ServiceNow but not sure how to move forward, need help in getting started.

Answer 1

you should be able to send a REST API request for creating an Incident using the below ServiceNow table API. Pls see curl example below from ServiceNow api docs.

    curl "https://instance.servicenow.com/api/now/table/incident" \
--request POST \
--header "Accept:application/json" \
--header "Content-Type:application/json" \
--data "{'short_description':'Unable to connect to office wifi','assignment_group':'287ebd7da9fe198100f92cc8d1d2154e','urgency':'2','impact':'2'}" \
--user 'username':'password'

https://developer.servicenow.com/dev.do#!/reference/api/latest/rest/c_TableAPI#table-POST