Skip to main content
{ Task Management }

ServiceNow Ticket Creation

Turns the structured findings another agent produces into ServiceNow incidents, one per finding, and keeps them in sync on every run without duplicates.

What this agent does

This agent files ServiceNow incidents from the findings another agent writes, such as a triage, posture, or SRE agent that runs before it in the same workflow. It creates an incident for each new finding and updates the existing incident for a finding it has seen before. It resolves an incident when the finding is resolved, and reopens an incident it resolved if the finding returns. It never overrides an incident a person resolved, closed, or canceled.

The challenge

An agent that finds problems is only useful if the right people see them in the tool they already work in. Filing tickets by hand from a report is slow. A scheduled agent that does not check for existing incidents creates a duplicate on every run. Nobody resolves the incidents for fixed problems, and the agent reopens incidents a person closed on purpose. A resolved incident closes on its own after a set number of days, and a closed incident cannot reopen when the problem returns.

The solution

The agent gives every finding a stable key, writes it to the correlation ID field, and looks up existing incidents by that key before it writes anything. It runs as a dedicated integration user, so the resolved-by field shows which incidents it resolved. It updates an open incident only when its finding changed, resolves incidents whose finding is gone, and respects every decision a person made. Provides one open incident per finding, updated as the findings change.

Workflow

  1. 01

    Read the findings

    Read the structured findings the earlier agent wrote, and stop if they are missing or malformed.

  2. 02

    Match existing incidents

    Look up the open, resolved, closed, and canceled incidents for these findings by their correlation ID in one query.

  3. 03

    Decide each incident

    Create, update, resolve, reopen, or leave alone, depending on the finding and the incident's state.

  4. 04

    File and log

    Make the changes in ServiceNow and record every action and failure.

Agent template 

# ServiceNow Ticket Creation

## Measurable outcomes

Every open finding from the earlier agent has exactly one open ServiceNow incident, and every resolved finding's incident is resolved. No incident a person resolved, closed, or canceled is reopened. Track how many incidents were created, updated, resolved, and reopened on each run.

## Procedure

Run after the agent whose findings I want filed, and read its structured output. Stop with an error when that output is missing or malformed, because an empty run would look the same as a clean one. Each finding needs a stable key, a title, a description, a severity, and whether it is open or resolved. Let me set the assignment group, the category, and the caller. Run as a dedicated integration user, so the resolved-by field on each incident shows which ones this agent resolved. Write the finding's stable key to the correlation ID field, prefixed with a shared tag for this workflow, so the next run can find it. Map severity to impact and urgency with a mapping I set, and let ServiceNow derive priority. Before writing, query all incidents with the workflow's prefix in one request, including resolved, closed, and canceled ones, and remember the incidents created during the run. Match each finding to its newest incident. Create an incident for each open finding that has none. Update the description when the finding changed, and add a work note that says what changed. Add nothing when nothing changed. Resolve an incident when its finding is resolved, with a resolution code and notes that say why. Reopen an incident only when this agent resolved it and the finding is open again. A closed incident cannot reopen, so create a new incident with the same correlation ID and name the closed one in a work note. When a person resolved, closed, or canceled the incident, leave it and add at most one work note that names their decision and what changed. When findings share a source, such as one rule across many resources, group them under one parent incident per source. Resolving a parent resolves its children, so resolve a parent only when every child finding is resolved, and treat a cascade from a parent a person resolved as a person's decision. Stop and report when more than a quarter of the writes fail, since that usually means an ACL or permissions problem rather than a one-off error. Start in a report-only mode that prints every change it would make before it writes anything.

## Requirements

It needs a dedicated integration user with ServiceNow Table API access to read, create, and update incidents, and read access to the earlier agent's output, and nothing more. It never deletes incidents and never changes incidents outside its own correlation ID prefix.