Skip to content
downpipes docs

Send downpipes alerts to ServiceNow Event Management

ServiceNow Event Management receives downpipes alerts as events. The engine posts an em_event to your ServiceNow instance. Its correlation rules group events sharing a message key into one Alert, and a later same-key event at severity 0 clears that Alert. So downpipes raises an alert on a failure and clears it on recovery, keyed the same way each time.

What you need

  • A ServiceNow instance with Event Management, and a Basic-auth integration user for downpipes to post as.
  • That integration user holding the evt_mgmt_integration role. Without it, events authenticate and the post succeeds, yet ServiceNow silently creates no Alert. You also need access to the downpipes console with permission to configure notifications (Operator, Approver or Owner) to add and test the channel.

Set it up

  1. In ServiceNow, create or choose a Basic-auth integration user for downpipes.
  2. Grant that user the evt_mgmt_integration role. This is the step teams most often miss: without it, downpipes authenticates and the event posts fine, yet no Alert is ever created.
  3. Note your Event Management endpoint. downpipes posts an em_event; the documented intake is /api/global/em/jsonv2, and the Table API path /api/now/table/em_event also works. Use the full instance URL, for example https://your-instance.service-now.com/api/global/em/jsonv2.
  4. In the downpipes console, open Notifications, choose Add a channel and pick ServiceNow Event Management. Adding a channel needs permission to configure notifications, so an Operator, Approver or Owner can add one.
  5. Paste the endpoint into the HTTPS URL field, enter the integration user in Username and its Password. downpipes sends these as HTTP Basic auth and seals the password at rest, so it is never shown again. Name the channel and save it. Your first channel gets a default rule for failure and stale alerts when no rule exists yet. Add a later channel to a rule under Rules.
  6. Choose Test on the channel row to confirm delivery without sending real alert content, then check ServiceNow received the event and, given the role above, raised an Alert.

Good to know

  • Severity 0 clears the Alert, not necessarily the Incident. downpipes sends severity 0 (Clear) on recovery, which clears the linked Alert. Whether a cleared Alert then closes an Incident raised from it is governed by your own ITOM business rules in ServiceNow, so downpipes does not promise the Incident closes. Confirm that behaviour in your instance.
  • The role is the common failure. If alerts never appear despite a passing test, check the evt_mgmt_integration role on the integration user first. A test send exercises the post and the auth, but the Alert only materialises when Event Management is available on your instance and the user is allowed to create events.

Last updated .