The ServiceNow Dynatrace integration connects your application performance monitoring platform with your IT service management workflows, automatically creating incidents from Dynatrace problems, enriching ServiceNow records with performance data, and synchronizing configuration items between platforms. This integration is essential for DevOps teams, site reliability engineers, and IT operations managers who need to bridge the gap between application monitoring alerts and structured incident management processes. The integration supports bi-directional data flows including automated incident creation from Dynatrace problems, enrichment of ServiceNow incidents with Davis AI root cause analysis, synchronization of application and infrastructure entities to the ServiceNow CMDB, and automated incident resolution when Dynatrace problems are resolved. The primary automation pattern uses Dynatrace webhooks to trigger ServiceNow inbound actions, with additional scheduled imports for CMDB synchronization, all managed through the Integration Hub Event Management module and Configuration Management Database.
Prerequisites
- •ServiceNow Tokyo release or later with Event Management plugin activated
- •Integration Hub Professional license or higher for advanced spoke actions
- •Dynatrace SaaS or Managed environment with API access
- •Dynatrace Environment API v2 access token with problems.read and entities.read permissions
- •ServiceNow MID Server (if accessing on-premise Dynatrace Managed deployment)
- •evt_mgmt_integration role for the ServiceNow integration user
- •Dynatrace webhook configuration permissions for problem notifications
Architecture Overview
The ServiceNow Dynatrace integration leverages the official Dynatrace spoke available in the Integration Hub, which provides pre-built actions for retrieving problems, entities, and metrics from the Dynatrace API. Authentication is established using API token-based authentication stored in ServiceNow Connection & Credential Aliases, with the Dynatrace environment URL and API token securely managed through the Connections & Credentials framework. Data flows bi-directionally with inbound webhooks from Dynatrace triggering ServiceNow scripted REST APIs to create incidents, while outbound calls use the Integration Hub spoke actions to enrich incidents with additional context and synchronize CMDB entities on scheduled intervals. A MID Server is only required when connecting to on-premise Dynatrace Managed deployments that are not accessible from the ServiceNow cloud instance. The Dynatrace API enforces rate limits of 50 requests per minute for most endpoints, requiring careful batch processing and error handling in scheduled data synchronization jobs.
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Implementation Steps
Generate Dynatrace API token and create ServiceNow credential
In your Dynatrace environment, navigate to Settings > Integration > Dynatrace API and click 'Generate token' with scopes: problems.read, entities.read, metrics.read, and events.ingest. Copy the generated token immediately as it won't be displayed again. In ServiceNow, navigate to Connections & Credentials > Credentials and create a new Basic Auth credential with username 'dynatrace' and paste the API token as the password. Name the credential 'Dynatrace API Token' and ensure the credential is active and accessible to the integration user account.
Configure Dynatrace connection alias in ServiceNow
Navigate to Connections & Credentials > Connection & Credential Aliases and create a new alias named 'Dynatrace Production'. Set the Connection URL to your Dynatrace environment URL (https://abc12345.live.dynatrace.com for SaaS or your managed URL). Select the credential created in step 1 and set the connection timeout to 30 seconds. Test the connection by clicking 'Test Connection' - you should receive a 200 response confirming successful authentication. Save the alias and note the sys_id for use in Integration Hub flows.
Install and configure Dynatrace Integration Hub spoke
Navigate to System Applications > All Available Applications > All and search for 'Dynatrace' to find the official Dynatrace spoke. Install the spoke and wait for activation to complete. After installation, go to Process Automation > Flow Designer and create a new flow called 'Dynatrace Problem to Incident'. Add the 'Dynatrace - Get Problem Details' spoke action and configure it to use your connection alias. Set up input variables for problem_id and configure the output to map to incident fields including short_description, description, and priority based on Dynatrace impact level.
Create inbound webhook scripted REST API for problem notifications
Navigate to System Web Services > Scripted REST APIs and create a new API called 'Dynatrace Webhook Handler' with base path '/api/x_dynat/webhook'. Create a POST resource called 'problem_notification' that accepts Dynatrace webhook payloads. The script should parse the incoming JSON payload, extract the problem ID, and either create a new incident record or update an existing one based on the problem state. Include error handling for malformed payloads and duplicate problem notifications, and log all webhook activity for troubleshooting purposes.
(function process(request, response) {
try {
var payload = JSON.parse(request.body.data);
var problemId = payload.ProblemID;
var problemTitle = payload.ProblemTitle;
var state = payload.State;
var incident = new GlideRecord('incident');
incident.addQuery('correlation_id', problemId);
incident.query();
if (incident.next()) {
if (state === 'RESOLVED') {
incident.state = 6; // Resolved
incident.close_code = 'Resolved by monitoring tool';
incident.close_notes = 'Problem resolved in Dynatrace';
}
incident.update();
} else if (state === 'OPEN') {
incident.initialize();
incident.short_description = 'Dynatrace Problem: ' + problemTitle;
incident.correlation_id = problemId;
incident.category = 'Software';
incident.priority = payload.ImpactLevel === 'APPLICATION' ? 2 : 3;
incident.insert();
}
response.setStatus(200);
response.getWriter().print(JSON.stringify({status: 'success', incident: incident.number}));
} catch (e) {
gs.error('Dynatrace webhook error: ' + e.message);
response.setStatus(400);
response.getWriter().print(JSON.stringify({error: e.message}));
}
})(request, response);Configure Dynatrace webhook notifications
In Dynatrace, navigate to Settings > Integration > Problem notifications and click 'Set up notifications'. Select 'Custom integration' and choose 'Webhook' as the notification type. Enter your ServiceNow webhook URL (https://instance.service-now.com/api/x_dynat/webhook/problem_notification) and configure authentication using basic auth with your ServiceNow integration user credentials. Set the payload format to JSON and configure triggers for problem opened and problem resolved events. Test the webhook by clicking 'Send test notification' and verify the test incident appears in ServiceNow.
Set up CMDB synchronization scheduled job
Navigate to System Definition > Scheduled Jobs and create a new scheduled script execution called 'Dynatrace CMDB Sync'. Schedule it to run every 6 hours during off-peak times. The script should use the Dynatrace spoke actions to retrieve application and host entities, then create or update corresponding Configuration Items in the ServiceNow CMDB. Include logic to handle entity lifecycle changes, relationship mapping between applications and hosts, and error handling for API rate limit exceeded responses. Add logging to track sync statistics and failed entity updates.
var dtConn = 'Dynatrace Production';
var entityTypes = ['APPLICATION', 'HOST', 'SERVICE'];
for (var i = 0; i < entityTypes.length; i++) {
try {
var request = new RESTMessage('Dynatrace API', 'GET');
request.setEndpoint('https://abc12345.live.dynatrace.com/api/v2/entities?entitySelector=type(' + entityTypes[i] + ')');
request.setRequestHeader('Authorization', 'Api-Token ' + gs.getProperty('dynatrace.api.token'));
var response = request.execute();
if (response.getStatusCode() == 200) {
var entities = JSON.parse(response.getBody()).entities;
for (var j = 0; j < entities.length; j++) {
var entity = entities[j];
var ci = new GlideRecord('cmdb_ci_computer');
ci.addQuery('correlation_id', entity.entityId);
ci.query();
if (!ci.next()) {
ci.initialize();
ci.correlation_id = entity.entityId;
}
ci.name = entity.displayName;
ci.operational_status = entity.lastSeenTms ? 1 : 6;
ci.discovery_source = 'Dynatrace';
if (ci.isNewRecord()) {
ci.insert();
} else {
ci.update();
}
}
}
} catch (e) {
gs.error('CMDB sync error for ' + entityTypes[i] + ': ' + e.message);
}
}Configure incident enrichment with Dynatrace context
Create a business rule on the Incident table that triggers on insert when correlation_id is not empty and starts with 'PROBLEM-'. The business rule should call the Dynatrace spoke to retrieve detailed problem information including root cause analysis from Davis AI, affected entities, and performance metrics. Map this additional context to custom fields on the incident record or store as JSON in the work_notes field. Include timeout handling for the API call and fallback logic if the Dynatrace API is temporarily unavailable. Set the business rule to execute asynchronously to avoid blocking incident creation if Dynatrace response is slow.
(function executeRule(current, previous) {
if (current.correlation_id && current.correlation_id.startsWith('PROBLEM-')) {
try {
var request = new RESTMessage('Dynatrace API', 'GET');
request.setEndpoint('https://abc12345.live.dynatrace.com/api/v2/problems/' + current.correlation_id + '?fields=evidenceDetails,rootCauseEntity,affectedEntities');
request.setRequestHeader('Authorization', 'Api-Token ' + gs.getProperty('dynatrace.api.token'));
var response = request.execute();
if (response.getStatusCode() == 200) {
var problem = JSON.parse(response.getBody());
var enrichmentData = {
rootCause: problem.rootCauseEntity ? problem.rootCauseEntity.name : 'Unknown',
affectedEntities: problem.affectedEntities.length,
evidenceDetails: problem.evidenceDetails
};
current.work_notes = 'Dynatrace Analysis: ' + JSON.stringify(enrichmentData, null, 2);
current.u_root_cause = enrichmentData.rootCause;
current.u_affected_services = enrichmentData.affectedEntities;
}
} catch (e) {
gs.error('Failed to enrich incident with Dynatrace data: ' + e.message);
}
}
})(current, previous);Test end-to-end integration and validate data flow
Create a test problem in Dynatrace by temporarily setting a synthetic monitor to an invalid URL or triggering an application error in your monitored environment. Verify that the webhook fires and creates an incident in ServiceNow with the correct correlation_id, priority mapping, and enrichment data from Davis AI analysis. Test the CMDB synchronization by running the scheduled job manually and confirming that application and host entities appear as Configuration Items with proper relationships. Validate incident resolution by resolving the Dynatrace problem and ensuring the ServiceNow incident automatically closes with appropriate closure codes and notes.
Common Use Cases
Automated incident creation from application performance problems
Dynatrace detects application response time degradation or error rate spikes using Davis AI analysis and automatically creates ServiceNow incidents via webhook notifications. The incidents include detailed problem context, affected user sessions, and root cause analysis from Davis AI. This use case reduces mean time to detection by eliminating manual monitoring dashboard reviews and ensures every performance issue gets tracked in the IT service management workflow with proper priority assignment based on business impact.
CMDB synchronization for application and infrastructure visibility
ServiceNow automatically imports Dynatrace-monitored applications, hosts, services, and their dependencies into the CMDB as configuration items with real-time operational status. The synchronization includes relationship mapping between applications and underlying infrastructure, enabling accurate impact analysis during change management processes. This provides configuration managers with an authoritative source of monitored IT assets and their current health status, supporting more informed change approval decisions and dependency impact assessments.
Problem correlation and duplicate incident prevention
When Dynatrace Davis AI correlates multiple symptoms into a single problem, the integration prevents creation of duplicate ServiceNow incidents by using correlation IDs to link related alerts. If multiple monitoring tools detect the same underlying issue, the Dynatrace correlation serves as the master record with other tools updating the same incident. This reduces incident noise and allows IT teams to focus on root cause resolution rather than managing multiple tickets for the same problem.
Automated incident resolution and closure workflows
When Dynatrace problems resolve automatically due to system recovery or deployment rollbacks, the integration updates corresponding ServiceNow incidents to resolved status with detailed closure notes. The automation includes verification that all related problem symptoms have cleared and adds performance recovery metrics to the incident resolution details. This ensures incident records accurately reflect current system state and provides complete audit trails for post-incident reviews without manual intervention from operations staff.
Performance metrics enrichment for major incident management
During major incidents, ServiceNow automatically retrieves detailed performance metrics, user impact data, and Davis AI insights from Dynatrace to support incident commander decision-making. The integration pulls real-time data including affected user sessions, geographic impact distribution, and service dependency maps directly into incident work notes. This provides incident management teams with comprehensive technical context for communication to stakeholders and helps prioritize resolution activities based on actual business impact measurements.
Troubleshooting
Webhook returns 401 Unauthorized when Dynatrace attempts to notify ServiceNow
Check that the ServiceNow integration user account has the correct roles (evt_mgmt_integration, rest_service) and that the password hasn't expired. Navigate to System Logs > System Log > All to review authentication failures and verify the webhook URL is correctly formatted with HTTPS. Test the webhook endpoint manually using a REST client with the same credentials configured in Dynatrace to isolate authentication vs authorization issues. If using SSO, ensure the integration user is excluded from SSO requirements or configure API-only access.
CMDB synchronization job fails with rate limit exceeded errors
Dynatrace enforces a limit of 50 API requests per minute, so modify your synchronization script to batch entity requests and add 1.5-second delays between API calls. Implement exponential backoff retry logic that waits progressively longer periods when receiving 429 status codes. Check the Integration Hub execution history for specific error details and consider splitting large entity synchronization across multiple scheduled jobs running at different intervals to distribute API load throughout the day.
Incidents created from Dynatrace problems are missing enrichment data or have generic descriptions
Verify that your Dynatrace API token includes the problems.read scope and that the business rule triggering enrichment is active and not failing due to timeout issues. Check System Logs > Outbound HTTP Requests for failed API calls to Dynatrace and review the request/response details. If enrichment is intermittent, implement retry logic in your business rule and consider storing the correlation ID even when enrichment fails so manual enrichment can be performed later.
ServiceNow incidents remain open even after Dynatrace problems are resolved
Confirm that your Dynatrace webhook notification is configured to send notifications for both problem opened and problem resolved states. Review the webhook payload in ServiceNow system logs to ensure the state field contains 'RESOLVED' when problems close. Check that your scripted REST API properly handles the resolved state by querying for existing incidents using correlation_id and updating their state to 6 (Resolved) with appropriate closure codes and notes.
Davis AI root cause analysis data is not appearing in ServiceNow incident records
Ensure your Dynatrace API call includes the fields parameter with evidenceDetails and rootCauseEntity to retrieve Davis AI analysis data. Check that the API token has sufficient permissions to access problem details beyond basic information. Review the JSON response structure in outbound HTTP request logs to verify the expected Davis AI fields are present and modify your parsing logic to handle cases where root cause analysis may not be available for certain problem types.
Integration Hub spoke actions timeout when connecting to Dynatrace API
Increase the connection timeout settings in your Connection & Credential Alias to 60 seconds and verify that any corporate firewalls or proxy servers aren't blocking outbound HTTPS connections to Dynatrace. For on-premise Dynatrace Managed environments, ensure your MID Server has network connectivity to the Dynatrace API endpoints and that SSL certificate validation is properly configured. Test connectivity using the MID Server capability validation tools and check MID Server logs for detailed connection failure information.
Pro Tips
- →Configure custom incident priority mapping based on Dynatrace impact levels (APPLICATION=P2, SERVICE=P3, INFRASTRUCTURE=P4) and business hours to ensure critical application issues get appropriate attention during peak business times while avoiding unnecessary escalations for infrastructure problems during maintenance windows.
- →Implement a custom field mapping strategy that stores Dynatrace entity IDs as related configuration items in ServiceNow, enabling click-through navigation from incidents directly to Dynatrace dashboards and facilitating bidirectional problem investigation workflows for your operations teams.
- →Use ServiceNow Transform Maps when importing large volumes of CMDB data from Dynatrace to handle data type conversions, field validation, and duplicate detection more efficiently than custom scripting, especially when dealing with complex entity relationship hierarchies.
- →Set up custom notification schemes that suppress ServiceNow email notifications for automatically resolved Dynatrace problems lasting less than 5 minutes, reducing alert fatigue while maintaining audit trails for all performance issues in your incident management database.
- →Create dashboard widgets that display real-time Dynatrace metrics alongside ServiceNow incident data using the Performance Analytics module, providing operations managers with integrated views of system health and incident trends for more informed capacity planning decisions.
- →Implement correlation ID standards that include environment prefixes (PROD-PROBLEM-, TEST-PROBLEM-) to enable environment-specific routing rules and prevent test environment alerts from creating production incidents while maintaining traceability across all monitored environments.
Known Limitations
- —The Dynatrace API enforces rate limits of 50 requests per minute for most endpoints, requiring careful batch processing and retry logic in scheduled synchronization jobs, especially when importing large CMDB datasets with thousands of monitored entities. High-frequency integrations may need to implement request queuing and exponential backoff strategies to avoid API throttling.
- —Davis AI root cause analysis data availability depends on Dynatrace having sufficient historical data and monitoring coverage, so newly monitored applications may generate incidents with limited enrichment context until baseline performance patterns are established over several weeks. Complex distributed architectures may also have incomplete root cause detection if not all components are instrumented.
- —ServiceNow Integration Hub Professional license is required for advanced spoke actions and error handling capabilities, while the free Community license only supports basic API calls without sophisticated retry logic or complex data transformations. Enterprise customers may also face additional licensing costs for high-volume webhook processing and CMDB synchronization.
- —Webhook delivery from Dynatrace SaaS environments cannot be guaranteed during network connectivity issues or ServiceNow maintenance windows, potentially causing missed incident notifications that require manual detection and creation. Consider implementing backup notification channels or regular synchronization jobs to catch missed webhooks during system outages.
Frequently Asked Questions
Can I customize which Dynatrace problems create ServiceNow incidents based on severity or affected applications?
Yes, you can configure filtering both in Dynatrace webhook notifications and in your ServiceNow scripted REST API handler. In Dynatrace, set up custom alerting profiles that only trigger webhooks for problems matching specific criteria like impact level or affected entity types. In ServiceNow, add conditional logic to your webhook handler that evaluates problem severity, affected application names, or business hours before creating incidents, allowing you to suppress low-priority alerts or route them to different assignment groups.
How do I handle Dynatrace environments with different authentication requirements or API versions?
Create separate Connection & Credential Aliases for each Dynatrace environment (production, staging, development) with environment-specific API tokens and URLs. Use ServiceNow's multi-instance connection capability to configure different API versions or authentication methods per environment. For Dynatrace Managed deployments with custom SSL certificates, configure certificate validation settings in your MID Server and use environment-specific scripted REST APIs that handle different response formats or API endpoints.
What happens to ServiceNow incidents when a Dynatrace problem is merged with another problem?
When Dynatrace merges problems, you'll need custom logic to handle incident consolidation since Davis AI may combine separate problems into a single root cause analysis. Implement a business rule that detects problem merge notifications (if available in your Dynatrace version) and either merges the corresponding ServiceNow incidents using parent-child relationships or closes duplicate incidents with references to the master problem. Consider using ServiceNow's Related Records functionality to maintain audit trails of the original separate problems.
Can I synchronize Dynatrace synthetic monitor results with ServiceNow availability metrics?
Yes, use the Dynatrace Synthetic API to retrieve monitor execution results and create corresponding ServiceNow availability records in the Performance Analytics application. Set up scheduled jobs that pull synthetic monitor data and populate ServiceNow metric tables with uptime percentages, response times, and error counts. This enables ServiceNow Service Level Management to track SLA compliance using real user and synthetic monitoring data from Dynatrace for comprehensive service availability reporting.
How do I prevent duplicate incidents when multiple Dynatrace environments monitor the same application?
Implement environment-aware correlation IDs that include environment prefixes (like PROD-PROBLEM-12345, STAGE-PROBLEM-67890) and configure your webhook handler to check for existing incidents across all environments before creating new ones. Use ServiceNow's correlation engine to group related incidents from multiple environments under a parent incident when they affect the same configuration item. Consider setting up environment hierarchy rules that prioritize production alerts while suppressing duplicate staging alerts for the same application issue.
What ServiceNow roles and permissions are required for users to manually trigger Dynatrace integration actions?
Users need the evt_mgmt_integration role for basic event management integration access, plus integration_hub_action_designer for creating custom flows using Dynatrace spoke actions. For manual problem retrieval and incident enrichment, grant the dynatrace_integration custom role (which you'll need to create) that includes read access to Connection & Credential Aliases and execute permissions on Integration Hub flows. Assignment group members handling Dynatrace-generated incidents should also have itil role for full incident management capabilities.
Can I use ServiceNow's Event Management module instead of direct incident creation for Dynatrace integration?
Yes, ServiceNow Event Management provides more sophisticated alert processing with deduplication, correlation, and filtering capabilities before incident creation. Configure Dynatrace webhooks to send problem notifications to Event Management's inbound event API instead of directly creating incidents. This allows you to leverage ServiceNow's built-in event correlation rules, noise reduction algorithms, and staged escalation policies. Event Management can also aggregate multiple Dynatrace events and apply business rules before creating a single incident with comprehensive context from multiple related problems.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue