This guide explains how to integrate Coralogix with ServiceNow to automatically create, update, and synchronize ServiceNow records from Coralogix Cases. It covers what the integration does, how the components work together, how to set it up step-by-step, and how to verify and operate it in production.
What this integration does :coralogix-actions-connect-medium:
The Coralogix ServiceNow integration connects Coralogix Cases with ServiceNow records (Incidents by default).
Once configured, it enables you to:
- :coralogix-alerts-incident-activity-medium: Automatically create ServiceNow records (Incidents by default) when Coralogix Cases are created
- :coralogix-actions-connect-medium: Keep ServiceNow records synchronized as Cases are acknowledged, updated, resolved, or closed
- :coralogix-actions-connect-medium: Optionally enable bi-directional sync, so actions taken in ServiceNow update the corresponding Coralogix Case
- :coralogix-actions-filter-medium: Route different types of Cases to ServiceNow based on routing rules
This allows teams to manage the incident lifecycle in ServiceNow, while Coralogix is used for alerting, investigation, and troubleshooting.
Coralogix ServiceNow app overview :coralogix-general-service-medium:
The Coralogix ServiceNow app is an official, no-cost application provided by Coralogix and available through the ServiceNow Store. It follows ServiceNow certification and best-practice implementation requirements.
- A ServiceNow administrator must approve and install the app.
- After installation, users with the appropriate roles can access the Coralogix application from the ServiceNow navigation bar.
Note: Link to the ServiceNow Store listing will be provided separately.
Key components and architecture :coralogix-general-settings-medium:
Understanding the main components helps explain how data flows between Coralogix and ServiceNow.
Case notifications table :coralogix-general-update-notification-medium:
The Case notifications table is a Coralogix-owned table in ServiceNow that receives incoming events from the Coralogix Notification Center.
Every Coralogix Case event, such as case created, acknowledged, updated, and closed creates a new record in this table.
These records act as the initial trigger for processing inside ServiceNow.
Case object (Synchronization and staging layer) :coralogix-actions-connect-medium:
The Case object is the core synchronization layer of the integration.
It represents the logical relationship between:
- A Coralogix Case, and
- Its corresponding ServiceNow record
The Case object:
- Tracks the Coralogix Case state
- Acts as a staging layer for incoming data
- Determines whether to create or update a ServiceNow record
- Routes updates to the configured target table
By default, the target table is Incident, but this can be changed if required.
Processing logic
Processing logic is part of the Case object.
When a Case Notification is received:
- If no related ServiceNow record exists, a new record is created
- If a related record already exists, it is updated
After processing, updates are applied to the configured target table (Incident by default).
This ensures a one-to-one relationship between a Coralogix Case and a ServiceNow record.
Case policies (Inbound and outbound) :coralogix-actions-edit-medium:
Case policies define how data moves into and out of ServiceNow.
Inbound scenarios (Coralogix to ServiceNow)
Inbound policies define what happens in ServiceNow when Coralogix Case events are received.
Coralogix provides an out-of-the-box inbound policy that:
- Creates a ServiceNow Incident
- Synchronizes predefined fields
- Keeps the Incident aligned with the Coralogix Case state
You can customize inbound behavior by:
- Changing the target table (for example, Event instead of Incident)
- Adding conditions to control when records are created or updated
- Customizing scripts to map fields to your internal workflows
Note: If you apply custom configurations, you are responsible for maintaining them. Custom behavior may fall outside Coralogix's support scope.
Outbound scenarios (ServiceNow to Coralogix)
Outbound policies enable bi-directional synchronization.
They define how ServiceNow record state changes are reflected back in Coralogix Case updates.
When bi-directional synchronization is enabled, the following mappings apply:
- :coralogix-general-multi-users-medium: Assigning a ServiceNow Incident acknowledges the corresponding Coralogix Case
- :coralogix-actions-check-medium-fill: Resolving a ServiceNow Incident resolves the corresponding Coralogix Case
- :coralogix-actions-check-medium-fill: Closing or canceling a ServiceNow Incident closes the corresponding Coralogix Case
These mappings ensure that actions taken during incident handling in ServiceNow are accurately reflected in the Coralogix Case lifecycle.
Note: Advanced update options, such as synchronizing comments, assignments, or additional fields, are planned for future phases and are not currently available.
Coralogix connection (ServiceNow side) :coralogix-actions-connect-medium:
A Coralogix Connection record is automatically created in ServiceNow when you configure the ServiceNow connector in Coralogix.
This record:
- Represents the logical connection to Coralogix
- Stores authentication details
- Enables inbound and outbound synchronization
It requires a Coralogix API key with the appropriate permissions.
ServiceNow connector (Coralogix side) :coralogix-actions-connect-medium:
On the Coralogix side, the integration is represented by a ServiceNow connector in the Notification Center.
The connector:
- Is configured using a ServiceNow username and password
- Sends Coralogix Case events into ServiceNow
- Triggers creation of Case Notification records
Once created, the connector can be used in routing rules.
End-to-end flow :coralogix-general-in-progress-medium:
A typical end-to-end flow looks like this:
- :coralogix-general-settings-medium: A ServiceNow admin installs and approves the Coralogix app
- :coralogix-general-multi-users-medium: A dedicated ServiceNow user is created with the required permissions
- :coralogix-actions-connect-medium: A ServiceNow connector is created in Coralogix
- :coralogix-actions-connect-medium: A Coralogix Connection record is automatically created in ServiceNow
- :coralogix-general-flag-medium: A Coralogix API key with the required permissions is generated manually and added to the Coralogix Connection in ServiceNow to enable bi-directional synchronization.
- :coralogix-alerts-incident-activity-medium: A Coralogix Case is created
- :coralogix-general-update-notification-medium: Notification Center sends a Case event
- :coralogix-general-update-notification-medium: A Case Notification record is created in ServiceNow
- :coralogix-actions-connect-medium: A Case object is created or updated
- :coralogix-alerts-incident-activity-medium: A ServiceNow Incident is created or updated
- :coralogix-actions-check-medium-fill: Resolving the Incident resolves the Coralogix Case
Create a ServiceNow connector in Coralogix :coralogix-actions-edit-medium:
To allow Coralogix to send Case notifications to ServiceNow:
- In Coralogix, navigate to Alerts, then Notification Center, then Connectors.
- Select New connector, then choose ServiceNow.
- Enter:
- Name
- Description
- ServiceNow instance URL
- ServiceNow username
- ServiceNow password
- Select Create connector.
The connector is now available for routing rules.
Route Coralogix Cases to ServiceNow :coralogix-actions-filter-medium:
Routing determines which Cases are sent to ServiceNow.
Add routing labels
-
Open an alert definition
-
Add routing labels, for example:
routing.group:sre
routing.environment:prod
-
Save the alert
Create a router and routing rule
- Go to Notification Center, then Routers.
- Create a router that matches your routing labels.
- Add a routing rule:
- Condition:
true or a specific Case condition
- Destination: ServiceNow connector
- Save the router.
Matching Case notifications are now sent to ServiceNow.
Generate a Coralogix API key :coralogix-general-flag-medium:
Generate or use an existing team API key from the API keys UI containing the cases role.
- Open the Coralogix Connection record in ServiceNow
- The Coralogix app automatically sets the endpoint URL. No manual action is required.
- Configure credentials using the Coralogix API key
Important behavior rules:
- Case states do not move backward
- Resolving an Incident resolves the Case
- Reopening an Incident does not re-acknowledge the Case
- Only resolved Cases can close
To disable closed-state synchronization, remove the closure condition from the outbound policy.
Verify bi-directional synchronization :coralogix-actions-check-medium-fill:
- Open a ServiceNow Incident created by Coralogix
- Change its state to In progress
- Confirm the Coralogix Case moves to Acknowledged
- Resolve or close the Incident and confirm the Case updates
Verify delivery :coralogix-actions-check-medium-fill:
- Trigger an alert that creates a Coralogix Case
- Confirm the Incident appears in ServiceNow
- Update the Incident and confirm the Case reflects the change
Operating the integration :coralogix-general-settings-medium:
Once live:
- :coralogix-actions-filter-medium: Use routing rules to control which Cases are sent to ServiceNow
- :coralogix-actions-edit-medium: Use inbound policies to adapt record creation to your workflows
- :coralogix-actions-connect-medium: Use outbound policies to control how ServiceNow updates flow back to Coralogix
- :coralogix-actions-search-medium: Review Case Notifications and Case objects for troubleshooting
- :coralogix-actions-search-medium: Review outbound HTTP logs to verify outbound sync from ServiceNow to Coralogix
