The ServiceNow Palo Alto Networks integration enables organizations to streamline security operations by connecting Cortex XSOAR and Prisma Cloud with ServiceNow's Security Operations and IT Service Management modules. This integration automatically routes firewall alerts and security findings into ServiceNow security incidents, maintains synchronized block lists, and generates compliance reports for security teams and auditors. Security operations centers (SOCs), IT security teams, and compliance officers rely on this integration to reduce manual triage work and ensure consistent incident response procedures. The integration supports bi-directional data flows including inbound alert ingestion from Palo Alto Networks platforms and outbound indicator sharing from ServiceNow to firewall block lists. Primary automation patterns include webhook-triggered incident creation, scheduled compliance data synchronization, and real-time threat intelligence updates managed through the Security Incident Response application and Integration Hub.
Prerequisites
- •ServiceNow Tokyo release or later with Security Incident Response application installed
- •Integration Hub Professional license for advanced spoke functionality
- •Palo Alto Networks Cortex XSOAR administrator access with API key generation privileges
- •Prisma Cloud Enterprise edition with API access enabled
- •ServiceNow Event Management plugin (com.snc.em) activated for alert correlation
- •MID Server installed and configured for outbound firewall communication if behind corporate proxy
- •Security Operations workspace configured with appropriate user roles (sn_si.admin, itil)
Architecture Overview
The integration utilizes the official ServiceNow Integration Hub Palo Alto Networks spoke (com.snc.palo_alto_networks) which provides pre-built Actions for Cortex XSOAR and Prisma Cloud communication. Authentication credentials are stored securely in ServiceNow Connection & Credential Aliases, supporting both API key authentication for Prisma Cloud and OAuth 2.0 for XSOAR integrations. Data flows bi-directionally with inbound webhooks from Palo Alto platforms creating security incidents and outbound REST calls updating firewall policies and block lists. A MID Server is required when ServiceNow instances need to reach Palo Alto Networks on-premises firewalls behind corporate firewalls, but cloud-to-cloud communication typically works without MID Server involvement. API rate limiting considerations include Prisma Cloud's default 1000 requests per hour limit and XSOAR's 100 concurrent API sessions, requiring proper error handling and retry logic in Flow Designer workflows.
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Implementation Steps
Install and activate the Palo Alto Networks Integration Hub spoke
Navigate to System Applications > All Available Applications > All and search for 'Palo Alto Networks' to locate the official Integration Hub spoke. Click Install to add the spoke to your instance, which includes pre-built Actions for Cortex XSOAR and Prisma Cloud operations. After installation, navigate to Process Automation > Flow Designer and verify that Palo Alto Networks Actions appear in the Action palette under the 'IntegrationHub' category. Activate the spoke by navigating to Integration Hub > Spokes and setting the Palo Alto Networks spoke status to 'Active', ensuring all dependent applications are properly loaded.
Create Palo Alto Networks API credentials and Connection Aliases
Navigate to Connections & Credentials > Credentials and create a new credential record for Prisma Cloud API access, setting the Type to 'API Key' and storing your Prisma Cloud access key in the API Key field and secret key in the API Secret field. Create a second credential for Cortex XSOAR with Type 'Basic Authentication', entering your XSOAR username and API key as the password. Navigate to Connections & Credentials > Connection & Credential Aliases and create aliases pointing to your newly created credentials, using descriptive names like 'PrismaCloud_Prod' and 'CortexXSOAR_Prod'. Verify credential functionality by testing a simple API call through the REST API Explorer before proceeding to workflow configuration.
// Test Prisma Cloud credential connectivity
var rm = new RESTMessage('PrismaCloud API Test', 'GET');
rm.setEndpoint('https://api.prismacloud.io/login');
rm.setAuthenticationProfile('oauth2', 'PrismaCloud_Prod');
rm.setRequestHeader('Content-Type', 'application/json');
var response = rm.execute();
gs.info('Prisma Cloud API Response: ' + response.getStatusCode() + ' - ' + response.getBody());Configure inbound webhook endpoints for Palo Alto alerts
Navigate to System Web Services > Scripted REST APIs and create a new API called 'PaloAltoWebhook' with a Resource Name of 'incident_webhook' and HTTP Method 'POST' to receive alert payloads from Cortex XSOAR and Prisma Cloud. Configure the script to parse incoming JSON payloads and create security incident records, mapping Palo Alto alert fields to ServiceNow incident fields like priority, category, and assignment group. Set up proper authentication for the webhook using either API key validation or mutual TLS depending on your security requirements. Test the webhook endpoint using Postman or similar tools to ensure proper JSON parsing and incident creation before configuring Palo Alto platforms to send alerts.
(function process(request, response) {
try {
var payload = JSON.parse(request.body.dataString);
var inc = new GlideRecord('sn_si_incident');
inc.initialize();
inc.short_description = payload.alert_name || 'Palo Alto Security Alert';
inc.priority = mapPaloAltoPriority(payload.severity);
inc.category = 'Security';
inc.subcategory = 'Firewall Alert';
inc.u_external_id = payload.alert_id;
var sysId = inc.insert();
response.setStatus(200);
response.setBody({result: 'success', incident: sysId});
} catch (e) {
gs.error('Palo Alto webhook error: ' + e.message);
response.setStatus(400);
response.setBody({error: e.message});
}
})(request, response);Build Flow Designer workflows for outbound threat intelligence sharing
Navigate to Process Automation > Flow Designer and create a new flow triggered by security incident updates to automatically share threat indicators with Palo Alto Networks firewalls. Add the 'Palo Alto Networks - Update Block List' Action from the Integration Hub spoke, configuring it to use your Connection Alias and mapping ServiceNow IOC fields to Palo Alto threat intelligence formats. Configure conditional logic to only trigger block list updates for incidents marked as 'Confirmed Threat' with threat indicators present in the IOC related list. Set up error handling subflows to retry failed API calls and log detailed error messages to the Flow execution history for troubleshooting purposes.
// Custom script in Flow Designer for IOC extraction
var iocList = [];
var iocGr = new GlideRecord('sn_ti_observable');
iocGr.addQuery('incident', inputs.incident_sys_id);
iocGr.addQuery('type', 'IN', 'ip_address,domain,file_hash');
iocGr.query();
while (iocGr.next()) {
iocList.push({
type: iocGr.getValue('type'),
value: iocGr.getValue('value'),
confidence: iocGr.getValue('confidence')
});
}
outputs.ioc_array = JSON.stringify(iocList);Set up scheduled compliance reporting workflows
Create a scheduled Flow Designer workflow that runs daily to synchronize compliance data between Palo Alto Prisma Cloud and ServiceNow GRC applications, using the 'Palo Alto Networks - Get Compliance Report' Action. Configure the workflow to query Prisma Cloud for policy violations, compliance posture data, and remediation status, then create or update corresponding GRC policy statements and control test results in ServiceNow. Map Prisma Cloud compliance frameworks (SOX, PCI-DSS, GDPR) to ServiceNow GRC framework records and establish automated risk scoring based on violation severity and count. Set up email notifications to compliance officers when critical violations are detected or when compliance scores drop below predefined thresholds.
// Process Prisma Cloud compliance data in Flow Designer
var complianceData = JSON.parse(inputs.prisma_response);
var policyGr = new GlideRecord('sn_grc_policy_statement');
for (var i = 0; i < complianceData.policies.length; i++) {
var policy = complianceData.policies[i];
policyGr.initialize();
policyGr.addQuery('u_external_id', policy.policy_id);
policyGr.query();
if (policyGr.next()) {
policyGr.u_compliance_score = policy.compliance_percentage;
policyGr.u_last_scan_date = new GlideDateTime();
policyGr.update();
}
}Configure XSOAR playbook integration for automated response
Navigate to the ServiceNow Integration Hub Action Designer and configure the 'Cortex XSOAR - Trigger Playbook' Action to automatically execute XSOAR investigation playbooks when high-severity security incidents are created. Map ServiceNow incident fields to XSOAR incident context variables including affected CIs, user information, and initial triage data to provide complete context for automated response actions. Set up bi-directional status synchronization so XSOAR playbook progress and results are reflected back in the ServiceNow incident work notes and resolution status. Configure timeout handling for long-running playbooks and establish escalation procedures when XSOAR automation fails or requires human intervention.
// XSOAR playbook trigger with context mapping
var xsoarPayload = {
'incident_type': 'ServiceNow Security Incident',
'severity': inputs.incident_priority,
'details': inputs.incident_description,
'custom_fields': {
'servicenow_incident_id': inputs.incident_sys_id,
'affected_ci': inputs.affected_ci_name,
'caller_id': inputs.caller_user_id,
'assignment_group': inputs.assignment_group
},
'playbook_id': 'ServiceNow_Auto_Investigation'
};
outputs.xsoar_payload = JSON.stringify(xsoarPayload);Implement real-time firewall log ingestion and correlation
Configure the ServiceNow Event Management application to receive and process real-time firewall logs from Palo Alto Networks devices using syslog forwarding or the Palo Alto Networks logging API. Navigate to Event Management > Collection Definitions and create collection rules that parse Palo Alto log formats and extract key security events like blocked connections, malware detections, and policy violations. Set up event correlation rules to automatically group related firewall events and escalate them to security incidents when patterns indicate coordinated attacks or policy violations. Configure event retention policies and archival procedures to maintain firewall log data for compliance and forensic analysis while managing ServiceNow database storage effectively.
// Event correlation rule for Palo Alto firewall logs
var events = new GlideRecord('em_event');
events.addQuery('source', 'PaloAltoFirewall');
events.addQuery('severity', '1');
events.addQuery('sys_created_on', '>', gs.minutesAgoStart(15));
events.addEncodedQuery('additional_info.threat_nameISNOTEMPTY');
events.query();
var threatCount = events.getRowCount();
if (threatCount > 5) {
var incident = new GlideRecord('sn_si_incident');
incident.initialize();
incident.short_description = 'Multiple firewall threats detected from Palo Alto';
incident.priority = '1';
incident.insert();
}Test end-to-end integration and establish monitoring
Create comprehensive test scenarios covering all integration touchpoints including webhook alert ingestion, outbound threat intelligence sharing, compliance report synchronization, and XSOAR playbook execution. Navigate to System Logs > REST Messages to verify successful API communications and check Flow Designer execution history for any failed automation workflows. Set up ServiceNow monitoring dashboards in Performance Analytics to track integration health metrics like API response times, failed authentication attempts, and incident creation rates from Palo Alto sources. Establish alerting mechanisms using ServiceNow's built-in notification framework to notify administrators when integration components fail or when API rate limits are approaching threshold values.
// Integration health check script for scheduled execution
var healthCheck = {
prisma_api: checkAPIConnectivity('PrismaCloud_Prod'),
xsoar_api: checkAPIConnectivity('CortexXSOAR_Prod'),
webhook_status: checkWebhookEndpoint('/api/x_company/paloaltowh/incident_webhook'),
recent_incidents: getRecentPaloAltoIncidents()
};
gs.info('Palo Alto Integration Health: ' + JSON.stringify(healthCheck));
if (!healthCheck.prisma_api || !healthCheck.xsoar_api) {
gs.eventQueue('palo_alto_integration_failure', null, null, JSON.stringify(healthCheck));
}Common Use Cases
Automated Security Incident Creation from Firewall Alerts
High-severity firewall alerts from Palo Alto Networks devices automatically trigger security incident creation in ServiceNow through configured webhooks or API polling. The integration maps alert severity, affected systems, and threat indicators to appropriate ServiceNow incident fields and automatically assigns incidents to the security operations team based on predefined criteria. This eliminates manual alert triage and ensures consistent incident response procedures across all firewall-detected threats. Business value includes reduced mean time to detection (MTTD) and improved security operations center efficiency through automated alert correlation and prioritization.
Real-time Threat Intelligence Block List Updates
When security analysts mark ServiceNow security incidents as confirmed threats and add threat indicators to the IOC related list, automated workflows immediately update Palo Alto Networks firewall block lists with the new threat intelligence. The integration supports various indicator types including IP addresses, domain names, file hashes, and URL patterns, automatically formatting them according to Palo Alto threat intelligence feed specifications. Updates are synchronized across all connected firewall devices and XSOAR threat intelligence databases within minutes of analyst confirmation. This rapid threat intelligence sharing significantly reduces the attack window for confirmed threats and prevents lateral movement across the network infrastructure.
Compliance Posture Reporting and GRC Integration
Scheduled workflows automatically retrieve compliance posture data from Palo Alto Prisma Cloud and synchronize it with ServiceNow GRC applications, creating detailed compliance reports for frameworks like SOC 2, PCI-DSS, and GDPR. The integration maps Prisma Cloud policy violations to ServiceNow control test failures and automatically calculates risk scores based on violation severity and remediation timelines. Compliance officers receive automated notifications when critical violations are detected or when overall compliance scores drop below acceptable thresholds. This provides continuous visibility into security compliance posture and enables proactive remediation of compliance gaps before audit cycles.
Automated XSOAR Playbook Execution for Incident Response
High-priority security incidents automatically trigger corresponding Cortex XSOAR investigation and response playbooks, providing immediate automated containment and investigation actions. ServiceNow incident context including affected configuration items, user details, and initial triage information is passed to XSOAR playbooks to provide complete situational awareness for automated response decisions. Playbook execution status and results are synchronized back to ServiceNow incident work notes, providing security analysts with complete visibility into automated response actions and their outcomes. This integration significantly reduces incident response times and ensures consistent application of security procedures across all incident types.
Firewall Configuration Change Management
ServiceNow Change Management processes automatically create corresponding configuration changes in Palo Alto Networks firewalls through approved change requests, ensuring proper governance and audit trails for all security policy modifications. The integration validates proposed firewall rule changes against security policies and compliance requirements before implementation, automatically rejecting changes that violate established security standards. Change implementation status and results are tracked in ServiceNow change records, providing complete visibility into firewall configuration drift and compliance with change management procedures. This ensures all firewall changes follow proper approval workflows and maintains detailed audit logs for compliance reporting and security reviews.
Troubleshooting
401 Unauthorized errors when calling Palo Alto Networks APIs
Navigate to Connections & Credentials > Credentials and verify that API keys are correctly formatted and have not expired in the Palo Alto platform. Check the credential test functionality by executing a simple API call through System Web Services > REST Message and review the outbound HTTP logs under System Logs > REST Messages for detailed authentication error messages. Verify that the ServiceNow instance IP address is whitelisted in Palo Alto Networks access control policies and that the API user has appropriate permissions for the specific operations being performed. For Cortex XSOAR integrations, ensure the API key has the correct role assignments and has not been revoked or rotated in the XSOAR user management interface.
Webhook payloads received but no security incidents created
Navigate to System Logs > Application Logs and filter for errors related to your Scripted REST API webhook endpoint to identify JSON parsing errors or field mapping issues. Check the sn_si_incident table ACLs to ensure the webhook execution context has create permissions on security incident records and verify that required fields are properly populated from the incoming payload. Review the webhook script for try-catch error handling and add comprehensive logging to identify where payload processing is failing. Test the webhook endpoint manually using tools like Postman with sample Palo Alto payload formats to isolate script logic issues from authentication or network connectivity problems.
Flow Designer workflows failing with timeout errors on Palo Alto API calls
Navigate to Process Automation > Flow Designer and examine the execution history for your Palo Alto integration flows to identify which specific Action is timing out. Increase the timeout values in the Integration Hub Palo Alto Networks spoke configuration or implement asynchronous processing patterns using Flow Designer subflows for long-running operations like compliance report generation. Check for API rate limiting by reviewing Palo Alto platform logs and implement proper retry logic with exponential backoff in your Flow Designer error handling subflows. Consider breaking large API operations into smaller batches and using scheduled flows rather than real-time processing for operations that require processing large datasets from Palo Alto platforms.
Duplicate security incidents created from the same Palo Alto alert
Implement deduplication logic in your webhook processing script by checking for existing incident records with the same external alert ID before creating new incidents. Navigate to your Scripted REST API webhook and add GlideRecord queries to search for incidents with matching u_external_id or correlation_id fields from the Palo Alto payload. Configure Event Management correlation rules to group related alerts from Palo Alto devices within specific time windows before escalating to incident creation. Review Palo Alto platform alert configurations to ensure alerts are not being sent to multiple ServiceNow endpoints simultaneously and verify that alert retry mechanisms are not causing duplicate webhook deliveries.
XSOAR playbook results not synchronizing back to ServiceNow incidents
Verify that Cortex XSOAR playbooks include the correct ServiceNow integration steps and that the XSOAR ServiceNow connector is properly configured with valid authentication credentials. Navigate to System Import Sets > Import Set Tables and check for failed imports of XSOAR response data, reviewing transformation maps for field mapping errors or data type mismatches. Configure proper webhook endpoints in XSOAR to push playbook status updates back to ServiceNow rather than relying solely on polling mechanisms that may be delayed or unreliable. Review XSOAR playbook logs to ensure that ServiceNow update tasks are executing successfully and handle network connectivity issues between XSOAR and ServiceNow environments with appropriate retry mechanisms.
Compliance report data from Prisma Cloud showing stale or incorrect values
Check the scheduled execution frequency of your Prisma Cloud compliance synchronization flows and ensure they are running at appropriate intervals to capture compliance posture changes. Navigate to Process Automation > Flow Context and verify that Prisma Cloud API calls are returning current data by examining the raw API response payloads for timestamp and freshness indicators. Review Prisma Cloud policy scanning schedules to ensure that compliance assessments are running frequently enough to provide current data for ServiceNow synchronization. Implement data validation logic in your Flow Designer workflows to detect and flag stale compliance data and configure alerting when Prisma Cloud APIs return unexpected or outdated information.
Pro Tips
- →Implement correlation rules in Event Management to group related Palo Alto firewall events before creating security incidents, reducing alert fatigue and improving analyst efficiency. Use the em_alert_correlation_rule table to define time-based and pattern-based correlation logic that can identify coordinated attacks or system-wide security events requiring unified incident response.
- →Configure Connection & Credential Aliases with multiple failover credentials to ensure integration availability during API key rotation or platform maintenance windows. Set up credential health monitoring using scheduled flows that test API connectivity and automatically switch to backup credentials when primary authentication fails.
- →Use ServiceNow's Transform Maps feature when importing large compliance datasets from Prisma Cloud to implement field-level data validation, format standardization, and automatic data enrichment during the import process. This prevents data quality issues and reduces manual cleanup work for compliance reporting.
- →Implement proper rate limiting and retry logic in Flow Designer workflows using the 'Wait' action and conditional logic to respect Palo Alto API quotas while ensuring reliable data synchronization. Configure exponential backoff patterns for failed API calls to prevent overwhelming Palo Alto platforms during high-volume integration scenarios.
- →Leverage ServiceNow Performance Analytics to create custom dashboards tracking integration health metrics like API response times, incident creation rates, and threat intelligence sharing effectiveness. Set up automated alerting when integration performance degrades or when security incident volumes indicate potential security events requiring immediate attention.
- →Create custom ServiceNow business rules on security incident tables to automatically enrich Palo Alto-sourced incidents with additional context from CMDB configuration items, user records, and historical incident data. This provides security analysts with comprehensive situational awareness without manual data gathering during incident response.
Known Limitations
- —Palo Alto Prisma Cloud API rate limits restrict integration to 1000 requests per hour per API key, which may require request batching and scheduling for large-scale compliance reporting and threat intelligence synchronization. Organizations with high-volume security environments may need multiple API keys or extended synchronization windows to accommodate rate limiting constraints.
- —Cortex XSOAR concurrent session limits of 100 active API connections may cause integration failures during high-incident-volume scenarios or when multiple ServiceNow instances connect to the same XSOAR environment. This requires careful connection pooling and session management in Flow Designer workflows to prevent authentication failures.
- —Real-time firewall log ingestion through Event Management can generate substantial database growth in ServiceNow, requiring careful retention policy configuration and potentially necessitating Integration Hub ETL licenses for high-volume log processing. Organizations must balance real-time visibility requirements with storage and performance considerations.
- —The Integration Hub Palo Alto Networks spoke requires Professional licensing tier and may not include all custom API endpoints or newer Palo Alto platform features, potentially requiring custom REST Message configurations for advanced integration scenarios. Custom integrations bypass spoke benefits like automatic error handling and credential management.
- —Bi-directional synchronization of threat intelligence and incident status between ServiceNow and Palo Alto platforms can create data consistency challenges during network outages or API failures, requiring careful conflict resolution and data reconciliation procedures. Organizations must implement proper error handling and manual override capabilities for integration failures.
Frequently Asked Questions
Can ServiceNow integrate with on-premises Palo Alto firewalls behind corporate firewalls?
Yes, ServiceNow can integrate with on-premises Palo Alto firewalls using a MID Server deployed in your network environment that has connectivity to both ServiceNow and your firewall management interfaces. The MID Server handles authentication, SSL termination, and protocol translation between ServiceNow Integration Hub workflows and on-premises Palo Alto devices. You'll need to configure Connection & Credential Aliases to use the MID Server and ensure proper network access controls allow the MID Server to communicate with firewall management APIs. The Integration Hub Palo Alto Networks spoke fully supports MID Server deployments for hybrid cloud and on-premises integration scenarios.
How does the integration handle Palo Alto alert severity mapping to ServiceNow incident priorities?
The integration provides configurable severity mapping between Palo Alto alert levels (Critical, High, Medium, Low) and ServiceNow incident priorities (1-5) through transform maps or custom JavaScript in webhook processing scripts. You can customize the mapping logic based on your organization's incident response procedures and SLA requirements, potentially incorporating additional factors like affected CI criticality or business hours. The Integration Hub spoke includes default mapping configurations that can be modified through Flow Designer conditional logic or by updating the spoke configuration parameters. Best practices include creating organization-specific mapping rules that consider both technical severity and business impact when determining ServiceNow incident priority levels.
What happens if ServiceNow is unavailable when Palo Alto platforms try to send security alerts?
Palo Alto platforms should be configured with alert queuing and retry mechanisms to handle ServiceNow unavailability, typically through XSOAR or syslog server configurations that buffer alerts during outages. When ServiceNow becomes available again, queued alerts are delivered and processed normally through webhook endpoints or scheduled import jobs depending on your integration architecture. For critical environments, consider implementing redundant alert delivery mechanisms such as email notifications or secondary SIEM integration to ensure security teams are notified even during ServiceNow maintenance windows. The Integration Hub provides connection health monitoring capabilities that can detect and alert on integration failures, enabling rapid restoration of alert processing capabilities.
Can the integration automatically create ServiceNow change requests for firewall rule modifications?
Yes, you can configure Flow Designer workflows that automatically create ServiceNow change requests when security incidents require firewall policy modifications, integrating with ServiceNow Change Management processes for proper governance. The workflows can populate change request fields with technical details, risk assessments, and approval requirements based on the type of firewall modification needed for incident remediation. Once change requests are approved through normal ServiceNow workflows, additional automation can execute the approved changes through Palo Alto Networks APIs and update the change request with implementation results. This approach ensures all firewall modifications follow proper change management procedures while enabling rapid security response through automated change creation and execution workflows.
How can I monitor the health and performance of the Palo Alto Networks integration?
ServiceNow provides several monitoring mechanisms including Integration Hub execution history, Flow Designer workflow monitoring, and REST Message logging that track API call success rates, response times, and error patterns for Palo Alto integrations. You can create Performance Analytics dashboards that aggregate integration metrics and set up automated alerts when API failures exceed threshold percentages or when incident creation rates indicate integration problems. The System Diagnostics application includes specific health checks for Integration Hub spokes and Connection Alias connectivity testing for proactive monitoring. Consider implementing custom scheduled flows that test API connectivity to Palo Alto platforms and create ServiceNow events when integration components fail, enabling rapid detection and resolution of integration issues before they impact security operations.
What data residency and compliance considerations apply to the Palo Alto ServiceNow integration?
Data residency requirements depend on your ServiceNow instance location and Palo Alto cloud service regions, with some organizations requiring data processing and storage within specific geographic boundaries for compliance with regulations like GDPR or data sovereignty laws. ServiceNow Connection & Credential Aliases encrypt stored API credentials and support field-level encryption for sensitive security data exchanged with Palo Alto platforms. You should review data classification requirements for firewall logs, threat intelligence, and compliance data to ensure appropriate handling and retention policies in both ServiceNow and Palo Alto environments. The integration supports audit logging and data lineage tracking to meet compliance reporting requirements and can be configured to exclude sensitive data elements from cross-platform synchronization when required by organizational security policies.
Is it possible to customize the Integration Hub Palo Alto Networks spoke for organization-specific requirements?
The Integration Hub Palo Alto Networks spoke can be extended through custom Flow Designer workflows and Action configurations, but the core spoke Actions should not be modified directly to preserve upgrade compatibility and vendor support. You can create custom Subflows and additional Actions that leverage the base spoke functionality while implementing organization-specific logic for field mappings, validation rules, and business process integration. For requirements not supported by the standard spoke, you can develop custom REST Message configurations or Scripted REST APIs that operate alongside the Integration Hub spoke to provide additional integration capabilities. ServiceNow best practices recommend using Flow Designer conditional logic and custom tables to extend spoke functionality rather than modifying the vendor-provided spoke components directly.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue