Skip to main content

Create ServiceNow Ticket

This Playbook is part of the ServiceNow Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Create ServiceNow Ticket allows you to open new tickets as a task from a parent playbook. When creating the ticket, you can decide to update based on the ticket's state, which will wait for the ticket to resolve or close with StatePolling. Alternatively, you can select to mirror the ServiceNow ticket and incident fields. To apply either of these options, set the SyncTicket value in the playbook inputs to one of the following options:

  1. StatePolling
  2. Mirror
  3. Leave Blank to use none.


This playbook uses the following sub-playbooks, integrations, and scripts.


  • ServiceNow Ticket State Polling
  • Mirror ServiceNow Ticket


ServiceNow v2


This playbook does not use any scripts.



Playbook Inputs#

NameDescriptionDefault ValueRequired
CategorySet the category of the ServiceNow Ticket.Optional
AssignmentGroupThe group to which to assign the new ticket.Optional
ShortDescriptionA short description of the ticket.Optional
ImpactSThe impact for the new ticket. Leave empty for ServiceNow default impact.Optional
UrgencyThe urgency of the new ticket. Leave empty for ServiceNow default urgency.Optional
SeverityThe severity of the new ticket. Leave empty for ServiceNow default severity.Optional
CommentA comment for the created ticket.Optional
SyncTicketThe value of the desired sync method with ServiceNow Ticket. You can choose one of the following options:
1. StatePolling
2. Mirror
3. Blank for none

GenericPolling polls for the state of the ticket and runs until the ticket state is either resolved or closed.

Mirror - You can use the Mirror option to perform a full sync with the ServiceNow Ticket. The ticket data is synced automatically between ServiceNow and Cortex XSOAR with the ServiceNow mirror feature.
If this option is selected, FieldPolling is true by default.
PollingIntervalThe interval time (in minutes) for the polling to run.Optional
PollingTimeoutThe amount of time (in minutes) to poll the status of the ticket before declaring a timeout and resuming the playbook.Optional
AdditionalPollingCommandNameIn this use case, additional polling commands are relevant when using StatePolling, and there is more than one ServiceNow instance. It will specify the polling command to use a specific instance to run on.
If so, add "Using" to the value.
The playbook will then take the instance name as the instance to use.
InstanceNameThe ServiceNow instance that will be used for mirroring/running polling commands.
ServiceNow v2_instance_1Optional
MirrorDirectionThe mirror direction. It should be one of the following:
1. In
2. Out
3. Both
MirrorCommentTagsThe tags for mirror comments and files to ServiceNow.comments,work_notes,ForServiceNowOptional
FieldPollingSet the value to true or false to determine if the playbook will execute the FieldPolling sub-playbook.
It is useful when it is needed to wait for the ServiceNow ticket to be resolved and continue the parent playbook.
FieldPolling will run until the ticket state is either resolved or closed.
TicketTypeThe ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".Optional

Playbook Outputs#

ServiceNow.Ticket.IDTicket ID.string
ServiceNow.Ticket.OpenedByTicket opener ID.string
ServiceNow.Ticket.CreatedOnTicket creation date.string
ServiceNow.Ticket.AssigneeTicket assignee ID.string
ServiceNow.Ticket.StateTicket state.string
ServiceNow.Ticket.SummaryTicket short summary.string
ServiceNow.Ticket.NumberTicket number.string
ServiceNow.Ticket.ActiveTicket active.string
ServiceNow.Ticket.AdditionalCommentsTicket comments.string
ServiceNow.Ticket.PriorityTicket priority.string
ServiceNow.Ticket.OpenedAtTicket opening time.string
ServiceNow.Ticket.ResolvedByTicket resolver ID.string
ServiceNow.Ticket.CloseCodeTicket close code.string

Playbook Image#

Create ServiceNow Ticket