🔗 ServiceNow Integration

⚙️ How It Works

When a security incident is created in ServiceNow, it's forwarded to Ayzal AI SOC where our AI engine:

• Analyzes the incident details
• Cross-references with threat intelligence
• Determines severity based on priority and category
• Triggers auto-remediation if enabled

🚀 Setup (5 minutes)

Step 1: Create a Business Rule in ServiceNow

1. Navigate to System Definition → Business Rules
2. Click New
3. Configure:
   Name: Forward to Ayzal SOC
Table: Incident [incident]
When: After Insert, After Update
Condition: Category is "Security" OR Priority is "1-Critical"

Step 2: Add the REST Call

In the Business Rule script, add a REST call to Ayzal AI SOC:

(function executeRule(current, previous /*null when async*/) {
    var request = new sn_ws.RESTMessageV2();
    request.setEndpoint('https://api.ayzalai.com/api/v1/integrations/webhook');
    request.setHttpMethod('POST');
    request.setRequestHeader('Content-Type', 'application/json');
    request.setRequestHeader('x-api-key', 'YOUR_API_KEY');
    request.setRequestHeader('x-siem-type', 'servicenow');

    var body = {
        number: current.number.toString(),
        short_description: current.short_description.toString(),
        priority: current.priority.toString(),
        category: current.category.toString(),
        caller_id: current.caller_id.getDisplayValue() || '',
        assignment_group: current.assignment_group.getDisplayValue() || ''
    };

    request.setRequestBody(JSON.stringify(body));
    request.execute();
})(current, previous);

Step 3: Get Your API Key

Get your API key from Ayzal AI SOC → Settings → API Keys.

📊 Severity Mapping

💡 Pro Tip: Use ServiceNow's built-in REST API explorer to test your integration before going live.