> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.
# ServiceNow (Manual Setup)
> Manually configure ServiceNow to create incident tickets directly from Oleria risks and posture findings using OAuth JWT authentication.
Connect ServiceNow to Oleria to create incident tickets directly from risks and posture findings. This page covers the manual setup path - configuring ServiceNow step by step before connecting it in the Oleria workspace. If you prefer an automated setup, use the [standard ServiceNow integration page](/workspace/servicenow-ticketing).
Follow the prerequisites and the steps below.
ServiceNow tickets will be created as an incident ticket and the ticket will be assigned to the configured assignment group.
## Prerequisites
* User account to perform the setup steps in ServiceNow. The account needs to be able to do the following actions. See relevant ServiceNow documentation to learn more about necessary access needed to perform these actions.
* Add a x509 Certificate
* Add an Application Registry
* Add a User
* View a Group
* Oleria public key
* Administrator access to Oleria to access the Ticketing System page. Learn about [role permissions](/administration/default-user-roles).
## Download the Oleria Public Certificate
Log in to Oleria and select the **Avatar** icon in the upper right-hand corner.
Select the **Ticketing integration** option.
From the **Ticketing system** page, select the **Download public key** button to download the file containing the public key (`oleria-public-key.pem`).
## Configure ServiceNow
While following the steps in ServiceNow, collect the following data to use during the Oleria configuration:
* Client ID
* Kid (Key ID or Key IDentifier)
* Claim Value (Oleria service account email address)
* sys\_id (assignment group sys\_id)
1. Log into your ServiceNow instance with administrator credentials.
2. From the **All** menu, navigate to **x509 Certificate** under **Multi-Provider SSO → Administration**.
3. Create a new x509 certificate - select **New** from the upper right-hand corner of the **x.509 Certificates** page.
4. From the **New record** page, enter the following information:
| Field | Value | Example |
| ----------------------- | ------------------------------------------- | ------------------------------------------------------------------ |
| Name | Name for the Oleria's public key | Oleria ServiceNow Incident Creation X.509 Certificate - tenantName |
| Format | PEM | PEM |
| Expiration Notification | Uncheck | Uncheck |
| Type | Trust Store Cert | Trust Store Cert |
| Active | Check | Check |
| Short Description | Description that mentions the Oleria tenant | servicenow\_ticketing.tenantName.oleria.io |
5. For **PEM Certificate**, copy and paste Oleria's public certificate.
6. Select **Submit**.
1. From the **All** menu, navigate to **Application Registry** under **System OAuth**.
2. From **Application Registries**, select **New** from the upper right-hand corner.
3. From **What kind of OAuth application?**, select **Create an OAuth JWT API endpoint for external clients**.
4. From **OAuth JWT - New Record**, reveal the **Public Client** hidden field in the form layout:
1. Select the three horizontal lines icon next to **New Section New Record** in the upper-left corner.
2. Select **Configure** → **Form Layout**.
3. From **Configuring OAuth JWT form**, under the **Available** column, find and select the **Public Client** field, then select the arrow pointing right to move it to the **Selected** column.
If you cannot find "Public Client" under "Available", check "Selected" instead. If "Public Client" is already in "Selected", proceed to the next step.
5. Select **Save** in the upper right-hand corner.
6. From **OAuth JWT - New Record**, enter the following information:
| Field | Value | Example |
| ------------- | ---------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| Name | Name that indicates Oleria will create incidents, including the Oleria tenant name | Oleria ServiceNow Incident Creation JWT OAuth - tenantName |
| Active | Check | Check |
| Public Client | Check | Check |
7. Leave the remaining fields with their default values (including leaving **Client Secret** blank).
8. **COPY** the **Client ID** value to use later during Oleria integration.
9. Add **useraccount** to the **Auth Scope** for the JWT application:
1. From the **Auth Scope** section, double-click **Insert a new row…**
2. In the textbox, search for **useraccount**, select a result from the dropdown, and select the green check icon.
3. Select **Submit**.
1. From **Application Registries**, find and view the OAuth JWT application you created (e.g., **Oleria ServiceNow Incident Creation JWT OAuth - tenantName**).
* To navigate there: from the **All** menu, go to **Application Registry** under **System OAuth**.
2. From the **OAuth JWT Application** page, scroll to the bottom to the **Jwt Verifier Maps** tab.
3. Add a **Jwt Verifier Map** - select **New** from the **Jwt Verifier Map** tab.
4. From **Jwt Verifier Map - New Record**, enter the following information:
| Field | Value | Example |
| --------------- | ------------------------------------------------------------------------ | ------------------------------------------------------------------ |
| Name | Name that indicates Oleria's public key including the Oleria tenant name | Oleria JWT Verifier Map - tenantName |
| Sys certificate | Name you created for Oleria's public certificate | Oleria ServiceNow Incident Creation X.509 Certificate - tenantName |
5. **COPY** the **Kid** (Key ID or Key IDentifier) value to use later during Oleria integration.
6. Select **Submit**.
1. From the **OAuth JWT Application** page, scroll to the bottom to the **OAuth JWT Claim Validations** tab.
2. Select **New**.
3. From **OAuth JWT Claim Validation - New Record**, enter the following information:
| Field | Value | Example |
| ---------------- | ------------------------------------------- | --------------------------------------------------------------- |
| Claim Value Type | string | string |
| Claim Name | sub | sub |
| Claim Value | email address of the Oleria service account | [oleriaticketing@oleria.com](mailto:oleriaticketing@oleria.com) |
4. **COPY** the **Claim Value** (Oleria service account email address) to use later during Oleria integration.
5. Select **Submit**.
1. From the **All** menu, navigate to **Roles** under **System Security → Users and Groups**.
2. Search for a role named **sn\_incident\_write**. If found, continue to the next step. If not found, create a new role.
1. From the **All** menu, navigate to **Users** under **User Administration**.
2. Select **New** from the upper right-hand corner.
3. From **User - New Record**, enter the following information:
| Field | Value | Example |
| ----------------------- | --------------------------------------------------------- | --------------------------------------------------------------- |
| User ID | name for the Oleria service account including tenant name | Oleria Integrator - tenantName |
| Email | Oleria service account's email | [oleriaticketing@oleria.com](mailto:oleriaticketing@oleria.com) |
| First Name | Oleria service account's first name | Oleria |
| Last Name | Oleria service account's last name | Ticketing |
| Password needs reset | Uncheck | Uncheck |
| Locked out | Uncheck | Uncheck |
| Active | Check | Check |
| Web service access only | Uncheck | Uncheck |
4. Select **Submit**.
1. From the **All** menu, navigate to **Users** under **User Administration**.
2. Find the Oleria service account (e.g., "Oleria Integrator - tenantName") and select its name.
3. From the **User** page, scroll to the bottom and select the **Roles** tab.
4. Select **Edit…**.
5. From **Edit Members**, search for **sn\_incident\_write** in the **Collection** column, select the role, and select the **Add** icon to add it to the selection list.
6. Select **Save**.
1. From the **All** menu, navigate to **Groups** under **System Security → Users and Groups**.
2. Find the group you want to assign incidents to (e.g., RiskRemediators) and view it. Create a new group if needed.
3. From the **Group** page, select the three horizontal lines icon in the upper left-hand corner, then select **Copy sys\_id**.
4. **COPY** the **sys\_id** (assignment group sys\_id) to use later during Oleria integration.
## Connect ServiceNow to Oleria
Ticketing system is not configured from the Integrations page.
There are 2 ways to reach the ticketing system page:
* From the **Risk Monitoring** page, select any risk and you will be prompted to integrate a ticketing system.
* From the **Avatar** in the upper right-hand corner, select the Avatar and then select **Ticketing system**.
From the **Ticketing system** page, confirm you have completed the prerequisite steps in ServiceNow above.
Under the desired ticketing system (ServiceNow), select **Connect**.
From the **Ticketing System Authentication** page, provide the following and select **Connect**:
| Field | Value | Example |
| --------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------- |
| Instance name | Instance name portion of the ServiceNow URL | instanceName |
| Client ID | Client ID for the Oleria OAuth JWT application in ServiceNow | abc12345d6789d0123f456g78hi9jk012 |
| Key ID | Key ID that maps the Oleria OAuth JWT application to the Oleria public key | a1234567b901c2345d6e7890fgh12ij3 |
| Service Account email | Email for the Oleria service account used to create tickets | [oleriaticketing@oleria.com](mailto:oleriaticketing@oleria.com) |
From the **Ticketing System Configuration** page, provide the following and select **Done**:
| Field | Value | Example |
| ------------------- | ------------------------------------------------------------------ | -------------------------------- |
| Assignment Group ID | sys\_id for the group that will be assigned to the created tickets | a1bcdef2345g67890hi12j345klm67n8 |
A confirmation message will appear. The **Ticketing system** page will show the configured ticketing system.
## Created ticket
A ticket created for a risk from Risk Monitoring will contain the following default field values:
| Field | Default Value | Note |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Caller | Oleria Ticketing | This is the name of the service account that is used by Oleria to generate tickets in ServiceNow. |
| Assignment group | \[provided during configuration] | This is the assignment group provided during the ServiceNow ticketing system integration. |
| Short description | "Risk was identified by Oleria: " + \[value] | This contains a standard prefix for all tickets created from a risk and it will contain the risk name that appeared in Oleria for the risk the ticket was created for. |
| Description | Risk: \[value] Potential Impact: \[value] Recommendation: \[value] Details: Risk Severity: \[value] Risk Type: \[value] Application: \[value] Application Instance: \[value] View risks in Oleria: \[URL] | This contains the details about the risk from where the ticket was created. It also contains the link to the risk. |
## Troubleshoot
**Caller value does not appear in the Ticket**
The Oleria Service Account's email address exists with another user account that is causing confusion on which email user to list as the caller.
**Resolution:**
Change the Oleria Service Account's email address to another email address and then update the email address associated with the Application Registration for the OAuth JWT Claim Validation email address listed in the JWT Application that was created for Oleria.
## Contact us
For questions, contact us at [support@oleria.com](mailto:support@oleria.com).