Skip to content
downpipes docs

Send downpipes alerts to ServiceNow Event Management

ServiceNow Event Management receives downpipes alerts as events. The engine posts an em_event to your ServiceNow instance, its correlation rules group events that share a message key into one Alert, and a later event on the same key at severity 0 clears that Alert. So downpipes raises an alert on a failure and clears it on recovery, keyed the same way each time.

What you need

  • A ServiceNow instance with Event Management, and a Basic-auth integration user for downpipes to post as.
  • That integration user holding the evt_mgmt_integration role. Without it, events authenticate and the post succeeds, yet ServiceNow silently creates no Alert.

Set it up

  1. In ServiceNow, create or choose a Basic-auth integration user for downpipes.
  2. Grant that user the evt_mgmt_integration role. This is the step teams most often miss: without it, downpipes authenticates and the event posts fine, yet no Alert is ever created.
  3. Note your Event Management endpoint. downpipes posts an em_event; the documented intake is /api/global/em/jsonv2, and the Table API path /api/now/table/em_event also works. Use the full instance URL, for example https://your-instance.service-now.com/api/global/em/jsonv2.
  4. In the downpipes console, open Notifications, choose Add a channel and pick ServiceNow Event Management. Adding a channel needs the notify-config capability, so an Operator, Approver or Owner can add one.
  5. Paste the endpoint into the URL field, enter the integration user in Username and its Password. downpipes sends these as HTTP Basic auth and seals the password at rest, so it is never shown again. Name the channel and save it, then a rule routes events to it.
  6. Choose Test on the channel row to confirm delivery without sending real alert content, then check ServiceNow received the event and, given the role above, raised an Alert.

Good to know

  • Severity 0 clears the Alert, not necessarily the Incident. downpipes sends severity 0 (Clear) on recovery, which clears the linked Alert. Whether a cleared Alert then closes an Incident raised from it is governed by your own ITOM business rules in ServiceNow, so downpipes does not promise the Incident closes. Confirm that behaviour in your instance.
  • The role is the common failure. If alerts never appear despite a passing test, check the evt_mgmt_integration role on the integration user first. A test send exercises the post and the auth, but the Alert only materialises when Event Management is available on your instance and the user is allowed to create events.

Last updated .