Security Monitoring

Attach security findings to a ServiceNow ticket

Attach security findings to a ServiceNow ticket by providing the ServiceNow ticket URL. You can attach up to 50 security findings per ServiceNow ticket. If the ServiceNow ticket is not linked to any case, this operation will create a case for the security findings and link the ServiceNow ticket to the newly created case. Security findings that are already attached to another ServiceNow ticket will be detached from their previous ServiceNow ticket and attached to the specified ServiceNow ticket.

patch/api/v2/security/findings/servicenow_tickets

Request

Base URL
https://api.datadoghq.com
URL
https://api.datadoghq.com/api/v2/security/findings/servicenow_tickets
Auth
- API key in header DD-API-KEY and API key in header DD-APPLICATION-KEY
- or OAuth 2
  Authorization code: /oauth2/v1/authorize
  Token URL: /oauth2/v1/token

Request body

Example request

{
  "data": {
    "attributes": {
      "servicenow_ticket_url": "https://example.service-now.com/now/nav/ui/classic/params/target/incident.do?sys_id=abcdef0123456789abcdef0123456789"
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
            "type": "findings"
          }
        ]
      },
      "project": {
        "data": {
          "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
          "type": "projects"
        }
      }
    },
    "type": "servicenow_tickets"
  }
}

Response

Example response

{
  "data": {
    "attributes": {
      "archived_at": "2025-01-01T00:00:00.000Z",
      "assigned_to": {
        "data": {
          "id": "00000000-0000-0000-2345-000000000000",
          "type": "users"
        }
      },
      "closed_at": "2025-01-01T00:00:00.000Z",
      "created_at": "2025-01-01T00:00:00.000Z",
      "creation_source": "CS_SECURITY_FINDING",
      "description": "A description of the case.",
      "due_date": "2025-01-01",
      "insights": [
        {
          "ref": "/security/appsec/vm/library/vulnerability/dfa027f7c037b2f77159adc027fecb56?detection=static",
          "resource_id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
          "type": "SECURITY_FINDING"
        }
      ],
      "jira_issue": {
        "error_message": "{\"errorMessages\":[\"An error occured.\"],\"errors\":{}}",
        "result": {
          "account_id": "463a8631-680e-455c-bfd3-3ed04d326eb7",
          "issue_id": "2871276",
          "issue_key": "PROJ-123",
          "issue_url": "https://domain.atlassian.net/browse/PROJ-123"
        },
        "status": "COMPLETED"
      },
      "key": "PROJ-123",
      "linear_issue": {
        "error_message": "Linear issue creation failed.",
        "result": {
          "account_id": "463a8631-680e-455c-bfd3-3ed04d326eb7",
          "issue_id": "9c1e5f8a-2b3d-4c7e-8f6a-1d2e3f4a5b6c",
          "issue_key": "ENG-123",
          "team_id": "b5d3c8a1-7e6f-4d2c-9a8b-3c4d5e6f7a8b",
          "url": "https://linear.app/your-workspace/issue/ENG-123"
        },
        "status": "COMPLETED"
      },
      "modified_at": "2025-01-01T00:00:00.000Z",
      "priority": "P4",
      "servicenow_ticket": {
        "result": {
          "instance_name": "example",
          "sys_id": "abcdef0123456789abcdef0123456789",
          "sys_target_link": "https://example.service-now.com/incident.do?sys_id=abcdef0123456789abcdef0123456789",
          "sys_target_sys_id": "abcdef0123456789abcdef0123456789",
          "table_name": "incident",
          "url": "https://example.service-now.com/now/nav/ui/classic/params/target/incident.do?sys_id=abcdef0123456789abcdef0123456789"
        },
        "status": "COMPLETED"
      },
      "status": "OPEN",
      "status_group": "SG_OPEN",
      "status_name": "Open",
      "title": "A title for the case.",
      "type": "SECURITY"
    },
    "id": "c1234567-89ab-cdef-0123-456789abcdef",
    "relationships": {
      "created_by": {
        "data": {
          "id": "00000000-0000-0000-2345-000000000000",
          "type": "users"
        }
      },
      "modified_by": {
        "data": {
          "id": "00000000-0000-0000-2345-000000000000",
          "type": "users"
        }
      },
      "project": {
        "data": {
          "id": "aeadc05e-98a8-11ec-ac2c-da7ad0900001",
          "type": "projects"
        }
      }
    },
    "type": "cases"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.