ServiceNow Connector

The ServiceNow connector ingests ITSM records from ServiceNow into CortexDB as typed episodes. Incidents, Change Requests, Problems, Knowledge Articles, and Service Catalog Tasks are all captured with full metadata, assignment, and CI relationships.

Setup

1. Create a ServiceNow Integration User

Create a dedicated service account in ServiceNow with the following roles:

• itil -- Read access to ITSM tables
• knowledge -- Read access to Knowledge Base
• snc_read_only -- Read-only access (recommended)

2. Configure the Connector

export CORTEX_SERVICENOW_INSTANCE=mycompany
export CORTEX_SERVICENOW_USERNAME=cortex-integration
export CORTEX_SERVICENOW_PASSWORD=your-password
export CORTEX_SERVICENOW_TENANT_ID=my-app
export CORTEX_SERVICENOW_NAMESPACE=servicenow

3. Start the Connector

cortexdb-connector servicenow \
  --instance mycompany \
  --username cortex-integration \
  --password your-password \
  --tenant-id my-app

Or with Docker:

docker run -d \
  --name cortex-servicenow \
  -e CORTEX_SERVICENOW_INSTANCE=mycompany \
  -e CORTEX_SERVICENOW_USERNAME=cortex-integration \
  -e CORTEX_SERVICENOW_PASSWORD=your-password \
  -e CORTEX_SERVICENOW_TENANT_ID=my-app \
  cortexdb/connector-servicenow:latest

What Gets Ingested

| ServiceNow Table | Episode Type | Content | |---|---|---| | Incident | incident | Number, short description, state, priority | | Change Request | deployment | Number, description, risk, dates | | Problem | issue | Number, description, known error, cause | | Knowledge Article | document | Title, body, workflow state | | SC Task | issue | Number, description, due date |

Episode Metadata

{
  "type": "incident",
  "content": "Incident INC0012345 [2]: VPN connectivity failure for remote users\nMultiple users reporting inability to connect via GlobalProtect VPN...",
  "source": "servicenow",
  "timestamp": "2026-03-17T06:30:00Z",
  "metadata": {
    "servicenow_table": "incident",
    "sys_id": "abc123def456",
    "number": "INC0012345",
    "state": "2",
    "priority": "2",
    "impact": "2",
    "urgency": "1",
    "category": "network"
  },
  "entities": [
    { "type": "incident", "id": "abc123def456", "name": "INC0012345" },
    { "type": "configuration_item", "id": "ci789", "name": "ci789" },
    { "type": "user", "id": "user456", "name": "user456" },
    { "type": "group", "id": "group789", "name": "group789" }
  ]
}

Configuration

| Variable | Default | Description | |---|---|---| | CORTEX_SERVICENOW_INSTANCE | Required | Instance name or full URL | | CORTEX_SERVICENOW_USERNAME | Required | ServiceNow username | | CORTEX_SERVICENOW_PASSWORD | Required | ServiceNow password | | CORTEX_SERVICENOW_TABLES | incident,change_request,problem,kb_knowledge,sc_task | Comma-separated table names | | CORTEX_SERVICENOW_TENANT_ID | Required | Target tenant | | CORTEX_SERVICENOW_NAMESPACE | servicenow | Target namespace | | CORTEX_SERVICENOW_BACKFILL_DAYS | 90 | Days of history to backfill | | CORTEX_SERVICENOW_POLL_INTERVAL_SEC | 60 | Polling interval |

Backfill

On first run, the connector backfills records updated within the last CORTEX_SERVICENOW_BACKFILL_DAYS days (default 90). Records are fetched from the Table API using sysparm_query with sys_updated_on filtering. Pagination uses sysparm_offset and sysparm_limit (100 records per page). Rate limits are handled with automatic retry using the Retry-After header.