Skip to main content

Create ServiceNow Ticket

This Playbook is part of the ServiceNow Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Create ServiceNow Ticket allows you to open new tickets as a task from a parent playbook. When creating the ticket, you can decide to update based on on the ticket's state, which will wait for the ticket to resolve or close with StatePolling. Alternatively, you can select to mirror the ServiceNow ticket and incident fields. To apply either of these options, set the SyncTicket value in the playbook inputs to one of the following options:

  1. StatePolling
  2. Mirror
  3. Leave Blank to use none.


This playbook uses the following sub-playbooks, integrations, and scripts.


  • ServiceNow Ticket State Polling
  • Mirror ServiceNow Ticket


  • ServiceNow v2


This playbook does not use any scripts.


  • servicenow-create-ticket

Playbook Inputs#

NameDescriptionDefault ValueRequired
CategorySet the category of the ServiceNow Ticket.Optional
AssignmentGroupThe group to which to assign the new ticket.Optional
ShortDescriptionSet a short description of the ticket.Optional
ImpactSet the impact for the new ticket. Leave empty for ServiceNow default impact.Optional
UrgencySet the urgency of the new ticket. Leave empty for ServiceNow default urgency.Optional
SeveritySet the severity of the new ticket. Leave empty for ServiceNow default severity.Optional
CommentAdd a comment for the created ticket.Optional
SyncTicketSet the value of the desired sync method with ServiceNow Ticket. you can choose one of three options:
1. StatePolling
2. Mirror
3. Blank for none

GenericPolling polls for the state of the ticket and runs until the ticket state is either resolved or closed.

Mirror - You can use the Mirror option to perform a full sync with the ServiceNow Ticket. The ticket data is synced automatically between ServiceNow and Cortex xSOAR with the ServiceNow mirror feature.
If this option is selected, FieldPolling is true by default.
PollingIntervalSet interval time for the polling to run
(In minutes)
PollingTimeoutSet the amount of time to poll the status of the ticket before declaring a timeout and resuming the playbook.
(In minutes)
AdditionalPollingCommandNameIn this use case, Additional polling commands are relevant when using StatePolling, and there is more than one ServiceNow instance. It will specify the polling command to use a specific instance to run on.
If so, please add "Using" to the value.
The playbook will then take the instance name as the instance to use.
InstanceNameSet the ServiceNow Instance that will be used for mirroring/running polling commands.
MirrorDirectionSet the mirror direction. It should be one of the following:
1. In
2. Out
3. Both
MirrorCommentTagsSet tags for mirror comments and files to ServiceNow.comments,work_notes,ForServiceNowOptional
FieldPollingSet the value to true or false to determine if the playbook will execute the FieldPolling sub playbook.
It is useful when it is needed to wait for the ServiceNow ticket to be resolved and continue the parent playbook.
FieldPolling will run until the ticket state is either resolved or closed.
TicketTypeSet the ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item".Optional

Playbook Outputs#

There are no outputs for this playbook.

Playbook Image#

Create ServiceNow Ticket