ServiceNow

Creates a ServiceNow incident from a Watchtower issue or incident (with a backlink in the description) and keeps the two in step. Sync is polled every 60 s: a Watchtower resolve moves the incident to done_state_id; an incident in a done state resolves the issue (as the system actor servicenow). Webhooks would need ServiceNow-side scripting and are not required.

Install (POST /internal/connect/servicenow/install): config {"base_url":"https://acme.service-now.com","done_state_id":"6","done_states":["6","7","8"],"urgency_map":{"high":"1","medium":"2","low":"3"},"assignment_group":"<sys_id>","cmdb_classes":["cmdb_ci_server"],"cmdb_import":true}; secrets {"username","password"} or {"access_token"}. Secrets are sealed and never returned or logged.

CMDB import runs hourly: each cmdb_ci_* class becomes entities (props source=servicenow, servicenow.*), each cmdb_rel_ci row an entity link of kind cmdb (parent to child). An entity discovered by an agent with the same kind and id is never overwritten.

The base URL passes the SSRF guard: private addresses are refused unless the deployment allows private targets.