ServiceNow — Integration Setup

ServiceNow is CMDash's second bi-directional integration (alongside Jira): CMDash reads existing Security Incident Response and security-tagged change records as incidents, and can push risks/remediations out to ServiceNow as new incidents.

⚠ Push only — status does not flow back. An earlier version of this line claimed CMDash would "poll them for status changes". It does not: CMDash never reads incident status back from ServiceNow. Closing an incident in ServiceNow will not close the corresponding CMDash task. Corrected 2026-08-12; tracked as a follow-up.

Prerequisites

• ServiceNow instance with Security Incident Response (SIR) enabled (for the read direction) and standard Incident Management (for write-back)
• A ServiceNow user account with read access to sn_si_incident and change_request, and (for write-back) create/edit access to the standard incident table
• CMDash Essentials tier or above

Step 1: Create a ServiceNow Integration User

1. In ServiceNow, go to User Administration → Users → New.
2. Create a dedicated service account, e.g. cmdash.integration.
3. Assign roles covering:
   • Read access to the Security Incident Response table (sn_si_incident) — typically sn_si.read or your org's SIR read role
   • Read access to change_request
   • itil (or equivalent) for read/write access to the standard incident table, needed for write-back
4. Set (or note) the account's password — CMDash uses HTTP Basic auth.

Step 2: Connect in CMDash

1. Navigate to Integrations in your CMDash dashboard.
2. Find ServiceNow and click Connect.
3. Enter:
   • Instance — your instance subdomain only (e.g., acme for acme.service-now.com)
   • Username
   • Password (stored as this connection's access token)
4. Click Save & Test Connection.

What Syncs (Read Direction)

Both queries are scoped to records updated in the last 7 days and are read page by page (sysparm_offset, 500 records per request) until the table ends, up to 25,000 records per table; reaching that ceiling marks the sync Partial with a warning rather than reporting it as complete. ServiceNow priority (1–3/other) maps to CMDash's critical/high/medium/low severity scale; SIR state and change state codes are each mapped independently onto CMDash's open/investigating/resolved/closed status.

Write-Back Direction

Important asymmetry: reads pull from the Security Incident Response table (sn_si_incident), but write-back creates records in the standard ITSM Incident table (incident) — these are two different tables in ServiceNow. An incident CMDash pushes will not appear in the next scheduled read-sync unless someone in your ServiceNow workflow promotes/converts it into a Security Incident. Plan your ServiceNow process accordingly if you rely on CMDash to close the loop automatically.

Troubleshooting

• 401 Unauthorized: The integration user's password was changed or the account was deactivated.
• 403 Forbidden on reads: The account lacks read access to sn_si_incident or change_request — check its assigned roles.
• Push fails with 403: The account lacks itil (or equivalent create/write) access to the standard incident table.
• Pushed incidents never show a status update in CMDash: expected — status sync-back is not implemented. fetchIncidentStatus exists on the adapter but no code path calls it, from the remediation detail view or anywhere else. Track the incident in ServiceNow and close the CMDash task manually.
• Pushed incident doesn't "close the loop" with the original risk: See the read/write table asymmetry noted above — pushed items land in incident, not sn_si_incident.

Rate Limits & Sync Behavior

Credential Rotation

ServiceNow passwords do not expire automatically unless your instance enforces a password policy. CMDash recommends rotating the integration account's password quarterly.

To rotate:

1. In ServiceNow, reset the cmdash.integration account's password.
2. In CMDash: Settings → Integrations → ServiceNow → Edit.
3. Enter the new Password and Save.

Note: Because ServiceNow credentials carry no expiry metadata CMDash can read, the 30-day expiry warning banner is not shown for this integration.

Multiple Instances / Multi-Site

If you operate more than one ServiceNow instance (e.g., separate production and subsidiary instances), each needs its own CMDash connection.

To add another instance:

1. Create an integration user in the additional instance, following Step 1.
2. In CMDash: Settings → Integrations → Add Integration → ServiceNow.
3. Enter the instance name, username, and password for the additional instance.
4. Give the connection a descriptive name (e.g., ServiceNow - Prod, ServiceNow - Subsidiary).
5. Click Save & Test Connection.

Compliance Framework Coverage

The ServiceNow integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.