Skip to main content

Create ServiceNow Ticket

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Create ServiceNow Ticket allows you to open new tickets as a task from a parent playbook. It is an option to set sync with the ticket's state, which will wait for the ticket to resolve or close with StatePolling. You can alternatively select to mirror the ServiceNow ticket and incident fields. Mirroring includes its equivalent for StatePolling - FieldPolling. To apply either of these options, set the SyncTicket value in the playbook inputs to one of the following options:

  1. StatePolling
  2. Mirror
  3. Leave Blank to use none.


This playbook uses the following sub-playbooks, integrations, and scripts.


  • Mirror ServiceNow Ticket
  • ServiceNow Ticket State Polling


  • ServiceNow v2


This playbook does not use any scripts.


  • servicenow-create-ticket

Playbook Inputs#

NameDescriptionDefault ValueRequired
CategorySet the category of the ServiceNow Ticket.Optional
AssignmentGroupThe group to assign the new ticket toOptional
ShortDescriptionSet A short description of the ticket.Optional
ImpactSet Impact for the new ticket, leave empty for ServiceNow default impact.Optional
UrgencySet urgency to the new ticket, leave empty for ServiceNow default urgency.Optional
SeveritySet severity to the new ticket, leave empty for ServiceNow default severity.Optional
CommentAdd a comment for the created ticket.Optional
SyncTicketSet the value of the desired sync method with ServiceNow Ticket. you can choose one of three options:
1. StatePolling
2. Mirror
3. Blank for none

GenericPolling uses as cold sync, which polls for the state of the ticket.
GenericPoliing will run until the ticket state is either resolved or closed.

Mirror - You can use the Mirror option to perform a full sync with ServiceNow Ticket. The ticket data is synced automatically between ServiceNow and Cortex xSOAR with the ServiceNow mirror feature.
If this option is selected, FieldPolling is true by default.
PollingIntervalSet interval time for the polling to run
(In minutes)
PollingTimeoutSet the amount of time to poll the status of the ticket before declaring a timeout and resuming the playbook.
(In minutes)
AdditionalPollingCommandNameIn this use case, Additional polling commands are relevant when using StatePolling, and there is more than one ServiceNow instance. It will specify the polling command to use a specific instance to run on.
If so, please add "Using" to the value.
The playbook will then take the instance name as the instance to use.
InstanceNameSet the ServiceNow Instance that will be used for mirroring/running polling commands.
MirrorDirectionSet the mirror direction, should be one of the following:
1. Out
2. Both
MirrorCommentTagsSet tags for mirror comments and files to ServiceNow.comments,work_notes,ForServiceNowOptional
FieldPollingSet the value to true or false to determine if the paybook will execute the FieldPolling sub playbook.
It is useful when it is needed to wait for the ServiceNow ticket to be resolved and continue the parent playbook.
FieldPolling will run until the ticket state is either resolved or closed.

Playbook Outputs#

There are no outputs for this playbook.

Playbook Image#

Create ServiceNow Ticket