This guide explains how to integrate Coralogix with ServiceNow to automatically create, update, and synchronize ServiceNow records from Coralogix Cases. It covers what the integration does, how the components work together, how to set it up step-by-step, and how to verify and operate it in production.
What this integration does
The Coralogix ServiceNow integration connects Coralogix Cases with ServiceNow records (Incidents by default).
Once configured, it enables you to:
- Automatically create ServiceNow records (Incidents by default) when Coralogix Cases are created
- Keep ServiceNow records synchronized as Cases are acknowledged, updated, resolved, or closed
- Optionally enable bi-directional sync, so actions taken in ServiceNow update the corresponding Coralogix Case
- Route different types of Cases to ServiceNow based on routing rules
This allows teams to manage the incident lifecycle in ServiceNow, while Coralogix is used for alerting, investigation, and troubleshooting.
Coralogix ServiceNow app overview
The Coralogix ServiceNow app is an official, no-cost application provided by Coralogix and available through the ServiceNow Store. It follows ServiceNow certification and best-practice implementation requirements.
- A ServiceNow administrator must approve and install the app.
- After installation, users with the appropriate roles can access the Coralogix application from the ServiceNow navigation bar.
Install the app and assign the required roles from the Coralogix listing on the ServiceNow Store. Open Links and Documents on that listing for the official installation guide, which covers app setup and the role a ServiceNow administrator assigns to the integration user used by the connector.
Key components and architecture
Understanding the main components helps explain how data flows between Coralogix and ServiceNow.
Case notifications table
The Case notifications table is a Coralogix-owned table in ServiceNow that receives incoming events from the Coralogix Notification Center.
Every Coralogix Case event, such as case created, acknowledged, updated, and closed creates a new record in this table.
These records act as the initial trigger for processing inside ServiceNow.
Case object (Synchronization and staging layer)
The Case object is the core synchronization layer of the integration.
It represents the logical relationship between:
- A Coralogix Case, and
- Its corresponding ServiceNow record
The Case object:
- Tracks the Coralogix Case state
- Acts as a staging layer for incoming data
- Determines whether to create or update a ServiceNow record
- Routes updates to the configured target table
By default, the target table is Incident, but this can be changed if required.
Processing logic
Processing logic is part of the Case object.
When a Case Notification is received:
- If no related ServiceNow record exists, a new record is created
- If a related record already exists, it is updated
After processing, updates are applied to the configured target table (Incident by default).
This ensures a one-to-one relationship between a Coralogix Case and a ServiceNow record.
Case policies (Inbound and outbound)
Case policies define how data moves into and out of ServiceNow.
Inbound scenarios (Coralogix to ServiceNow)
Inbound policies define what happens in ServiceNow when Coralogix Case events are received.
Coralogix provides an out-of-the-box inbound policy that:
- Creates a ServiceNow Incident
- Synchronizes predefined fields
- Keeps the Incident aligned with the Coralogix Case state
You can customize inbound behavior by:
- Changing the target table (for example, Event instead of Incident)
- Adding conditions to control when records are created or updated
- Customizing scripts to map fields to your internal workflows
Incident is the only table mapped out of the box. If you change the target table to any other table, such as Event or a custom table, the out-of-the-box field mapping no longer applies. You own the field mapping for that table and must complete it with your ServiceNow administrator. Records sent to an unmapped table are created empty and fail with an error. Custom target tables and custom configurations fall outside Coralogix's support scope, and you are responsible for maintaining them.
Outbound scenarios (ServiceNow to Coralogix)
Outbound policies enable bi-directional synchronization.
They define how ServiceNow record state changes are reflected back in Coralogix Case updates.
When bi-directional synchronization is enabled, the following mappings apply:
- Assigning a ServiceNow Incident acknowledges the corresponding Coralogix Case
- Resolving a ServiceNow Incident resolves the corresponding Coralogix Case
- Closing or canceling a ServiceNow Incident closes the corresponding Coralogix Case
These mappings ensure that actions taken during incident handling in ServiceNow are accurately reflected in the Coralogix Case lifecycle.
Advanced update options, such as synchronizing comments, assignments, or additional fields, are planned for future phases and are not currently available.
Coralogix connection (ServiceNow side)
A Coralogix Connection record is automatically created in ServiceNow when you configure the ServiceNow connector in Coralogix.
This record:
- Represents the logical connection to Coralogix
- Stores authentication details
- Enables inbound and outbound synchronization
It requires a Coralogix API key with the appropriate permissions.
ServiceNow connector (Coralogix side)
On the Coralogix side, the integration is represented by a ServiceNow connector in the Notification Center.
The connector:
- Is configured using a ServiceNow username and password
- Sends Coralogix Case events into ServiceNow
- Triggers creation of Case Notification records
Once created, the connector can be used in routing rules.
End-to-end flow
A typical end-to-end flow looks like this:
- A ServiceNow admin installs and approves the Coralogix app
- A dedicated ServiceNow user is created with the required permissions
- A ServiceNow connector is created in Coralogix
- A Coralogix Connection record is automatically created in ServiceNow
- A Coralogix API key with the required permissions is generated manually and added to the Coralogix Connection in ServiceNow to enable bi-directional synchronization.
- A Coralogix Case is created
- Notification Center sends a Case event
- A Case Notification record is created in ServiceNow
- A Case object is created or updated
- A ServiceNow Incident is created or updated
- Resolving the Incident resolves the Coralogix Case
Create a ServiceNow connector in Coralogix
To allow Coralogix to send Case notifications to ServiceNow:
- In Coralogix, select Integrations, then Notification Center, then Connectors.
- Select New connector, then select ServiceNow.
- Enter:
- Name
- Description
- ServiceNow instance URL
- ServiceNow username
- ServiceNow password
- Select Create connector.
The connector is now available for routing rules.
Route Coralogix Cases to ServiceNow
Routing determines which Cases are sent to ServiceNow.
Add routing labels
-
Open an alert definition
-
Add routing labels, for example:
routing.group:sre
routing.environment:prod
-
Save the alert
Create a router and routing rule
- Select Integrations, then Notification Center, then Routers.
- Create a router that matches your routing labels.
- Add a routing rule:
- Condition:
true or a specific Case condition
- Destination: ServiceNow connector
- Save the router.
Matching Case notifications are now sent to ServiceNow.
Generate a Coralogix API key
Generate or use an existing team API key from the API keys UI containing the cases role.
- Open the Coralogix Connection record in ServiceNow
- The Coralogix app automatically sets the endpoint URL. No manual action is required.
- Configure credentials using the Coralogix API key
Important behavior rules:
- Case states do not move backward
- Resolving an Incident resolves the Case
- Reopening an Incident does not re-acknowledge the Case
- Only resolved Cases can close
To disable closed-state synchronization, remove the closure condition from the outbound policy.
Verify bi-directional synchronization
- Open a ServiceNow Incident created by Coralogix
- Change its state to In progress
- Confirm the Coralogix Case moves to Acknowledged
- Resolve or close the Incident and confirm the Case updates
Verify delivery
- Trigger an alert that creates a Coralogix Case
- Confirm the Incident appears in ServiceNow
- Update the Incident and confirm the Case reflects the change
Troubleshooting
Records are created empty and fail with an error
Symptom: ServiceNow records are created, but their fields are empty and the delivery shows an Error status. The failure reason is similar to:
ConversionError: The undefined value has no properties ... status 500 Internal Server Error
Cause: The target table was changed away from Incident without completing the field mapping for the new table. The out-of-the-box mapping applies only to Incident, so records sent to an unmapped table have no fields to populate.
Resolution:
- Use the out-of-the-box Incident mapping, or
- Have your ServiceNow administrator map the required fields for your custom target table.
To find the failure reason for a specific notification, open the failed notification delivery in Notification Center and review its error message.
Operating the integration
Once live:
- Use routing rules to control which Cases are sent to ServiceNow
- Use inbound policies to adapt record creation to your workflows
- Use outbound policies to control how ServiceNow updates flow back to Coralogix
- Review Case Notifications and Case objects for troubleshooting
- Review outbound HTTP logs to verify outbound sync from ServiceNow to Coralogix