For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/es/api/latest/security-monitoring/create-servicenow-tickets-for-security-findings.md. A documentation index is available at /llms.txt.
homeIniciodocsDocumentaciónapiAPI
Language
Datadog site

Create ServiceNow tickets for security findings

POSThttps://api.datadoghq.com/api/v2/security/findings/servicenow_ticketshttps://api.us3.datadoghq.com/api/v2/security/findings/servicenow_ticketshttps://api.us5.datadoghq.com/api/v2/security/findings/servicenow_ticketshttps://api.datadoghq.eu/api/v2/security/findings/servicenow_ticketshttps://api.ap1.datadoghq.com/api/v2/security/findings/servicenow_ticketshttps://api.ap2.datadoghq.com/api/v2/security/findings/servicenow_ticketshttps://api.uk1.datadoghq.com/api/v2/security/findings/servicenow_ticketshttps://api.ddog-gov.com/api/v2/security/findings/servicenow_ticketshttps://api.us2.ddog-gov.com/api/v2/security/findings/servicenow_tickets

Descripción general

Create ServiceNow tickets for security findings. This operation creates a case in Datadog and a ServiceNow ticket linked to that case for bidirectional sync between Datadog and ServiceNow. You can create up to 50 ServiceNow tickets per request and associate up to 50 security findings per ServiceNow ticket. Security findings that are already attached to another ServiceNow ticket will be detached from their previous ServiceNow ticket and attached to the newly created ServiceNow ticket.

This endpoint requires any of the following permissions:

  • security_monitoring_findings_write
  • appsec_vm_write

Solicitud

Body Data (required)

Campo
Type
Descripción
data [required]
[object]

Array of ServiceNow ticket creation request data objects.

Respuesta

Created

List of case responses.

Campo
Type
Descripción
data [required]
[object]

Array of case response data objects.

Ejemplo de código

Create ServiceNow tickets for security findings
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/servicenow_tickets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": [
    {
      "attributes": {
        "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0",
        "description": "A description of the ServiceNow ticket.",
        "priority": "NOT_DEFINED",
        "title": "A title for the ServiceNow ticket."
      },
      "relationships": {
        "findings": {
          "data": [
            {
              "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
              "type": "findings"
            }
          ]
        },
        "project": {
          "data": {
            "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
            "type": "projects"
          }
        }
      },
      "type": "servicenow_tickets"
    }
  ]
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/servicenow_tickets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": [
    {
      "attributes": {
        "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0",
        "description": "A description of the ServiceNow ticket.",
        "priority": "NOT_DEFINED",
        "title": "A title for the ServiceNow ticket."
      },
      "relationships": {
        "findings": {
          "data": [
            {
              "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
              "type": "findings"
            }
          ]
        },
        "project": {
          "data": {
            "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
            "type": "projects"
          }
        }
      },
      "type": "servicenow_tickets"
    }
  ]
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/servicenow_tickets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": [
    {
      "attributes": {
        "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0",
        "description": "A description of the ServiceNow ticket.",
        "priority": "NOT_DEFINED",
        "title": "A title for the ServiceNow ticket."
      },
      "relationships": {
        "findings": {
          "data": [
            {
              "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
              "type": "findings"
            }
          ]
        },
        "project": {
          "data": {
            "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
            "type": "projects"
          }
        }
      },
      "type": "servicenow_tickets"
    }
  ]
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/servicenow_tickets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": [
    {
      "attributes": {
        "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0",
        "description": "A description of the ServiceNow ticket.",
        "priority": "NOT_DEFINED",
        "title": "A title for the ServiceNow ticket."
      },
      "relationships": {
        "findings": {
          "data": [
            {
              "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
              "type": "findings"
            }
          ]
        },
        "project": {
          "data": {
            "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
            "type": "projects"
          }
        }
      },
      "type": "servicenow_tickets"
    }
  ]
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/servicenow_tickets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": [
    {
      "attributes": {
        "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0",
        "description": "A description of the ServiceNow ticket.",
        "priority": "NOT_DEFINED",
        "title": "A title for the ServiceNow ticket."
      },
      "relationships": {
        "findings": {
          "data": [
            {
              "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
              "type": "findings"
            }
          ]
        },
        "project": {
          "data": {
            "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
            "type": "projects"
          }
        }
      },
      "type": "servicenow_tickets"
    }
  ]
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/servicenow_tickets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": [
    {
      "attributes": {
        "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0",
        "description": "A description of the ServiceNow ticket.",
        "priority": "NOT_DEFINED",
        "title": "A title for the ServiceNow ticket."
      },
      "relationships": {
        "findings": {
          "data": [
            {
              "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
              "type": "findings"
            }
          ]
        },
        "project": {
          "data": {
            "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
            "type": "projects"
          }
        }
      },
      "type": "servicenow_tickets"
    }
  ]
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/servicenow_tickets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": [
    {
      "attributes": {
        "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0",
        "description": "A description of the ServiceNow ticket.",
        "priority": "NOT_DEFINED",
        "title": "A title for the ServiceNow ticket."
      },
      "relationships": {
        "findings": {
          "data": [
            {
              "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
              "type": "findings"
            }
          ]
        },
        "project": {
          "data": {
            "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
            "type": "projects"
          }
        }
      },
      "type": "servicenow_tickets"
    }
  ]
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/servicenow_tickets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": [
    {
      "attributes": {
        "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0",
        "description": "A description of the ServiceNow ticket.",
        "priority": "NOT_DEFINED",
        "title": "A title for the ServiceNow ticket."
      },
      "relationships": {
        "findings": {
          "data": [
            {
              "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
              "type": "findings"
            }
          ]
        },
        "project": {
          "data": {
            "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
            "type": "projects"
          }
        }
      },
      "type": "servicenow_tickets"
    }
  ]
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/servicenow_tickets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": [
    {
      "attributes": {
        "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0",
        "description": "A description of the ServiceNow ticket.",
        "priority": "NOT_DEFINED",
        "title": "A title for the ServiceNow ticket."
      },
      "relationships": {
        "findings": {
          "data": [
            {
              "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
              "type": "findings"
            }
          ]
        },
        "project": {
          "data": {
            "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
            "type": "projects"
          }
        }
      },
      "type": "servicenow_tickets"
    }
  ]
}
EOF