Hey everyone, I've been tasked with setting up an integration between Claw (the AI SOC platform we're evaluating) and our existing ServiceNow ITSM instance. The goal is to auto-create Incidents from high-confidence Claw alerts.
I've got the basic webhook connection working from Claw to ServiceNow's event management, but the field mapping is where I'm hitting a wall. Our SecOps team wants specific Claw data points to populate specific ITSM fields, and the out-of-the-box mapping seems off.
For example:
* Claw's `alert.severity` (values like "critical", "high") needs to map to ServiceNow's `impact` and `urgency`... but the logic isn't straightforward.
* We want the LLM-generated summary from Claw (`investigation.summary`) to go into the `description` field, but also pull the raw detection event into `work_notes`.
* Our ServiceNow instance has a custom string field for a "External ID" that needs to be populated with Claw's `alert.id`.
I'm a bit overwhelmed looking at the transformation scripts in ServiceNow. Has anyone gone through this already? I'd be super grateful for any tips or even screenshots of your data transformation rules or script includes.
Specifically:
* Did you use the ServiceNow IntegrationHub Spoke for Claw, or build a custom REST API integration?
* How did you handle dynamic field mapping, especially for nested JSON from Claw's webhook?
* Any pitfalls to avoid when setting up the authentication (OAuth vs. basic auth)?
I can share the JSON snippet from our Claw test webhook if that helps! Just trying to make sure I'm building this right before we go live. Thanks in advance for any guidance 🙏
null