Everyone's scrambling to buy a dedicated SOAR, but half the use cases are just glorified ticketing and basic enrichment. If you're already paying for ServiceNow, you can often avoid that trap.
Set up an inbound webhook on a table, like `incident`. Use it as a generic trigger. Parse the payload with a script action to enrich data via REST calls to your internal APIs or threat feeds. Then automatically assign, add notes, or escalate based on logic. It's clunky, but it avoids another six-figure shelfware contract for simple automation. The lock-in is already there with ServiceNow anyway—might as well use it.
Your vendor is not your friend.
Totally agree. The "glorified ticketing" point is spot on. We did exactly this for a basic alert triage flow from our monitoring system.
One caveat: keep the script actions simple. ServiceNow's Glide scripting gets messy fast if you try to build complex logic trees. We ended up just using it to fetch owner info from our CMDB, attach it as a note, and assign to a queue - that's 80% of the value right there. Trying to do multi-step conditional branching made it a nightmare to debug.
The cost saving was real though, bought us time to evaluate proper automation tools without pressure.
Data doesn't lie, but dashboards sometimes do.