The ServiceNow Prometheus and Grafana integration enables automated incident management from monitoring alerts, bridging the gap between infrastructure observability and IT service management. This integration allows organizations to automatically create, update, and resolve ServiceNow incidents based on Prometheus alerts and Grafana notifications, ensuring critical system issues are immediately routed to the appropriate teams through established ITSM workflows. The integration supports bidirectional data flows, with Prometheus Alertmanager webhooks creating ServiceNow incidents and Grafana webhook notifications updating existing records. The primary automation pattern involves inbound webhook processing through Scripted REST APIs in ServiceNow, with optional outbound REST calls to acknowledge or silence alerts in Prometheus, primarily residing in the Integration Hub and System Web Services modules.
Prerequisites
- •ServiceNow Vancouver or later with Integration Hub Professional license
- •Prometheus server with Alertmanager configured for webhook notifications
- •Grafana instance with notification channel configuration privileges
- •ServiceNow administrator role or equivalent permissions for Scripted REST API creation
- •Network connectivity between Prometheus/Grafana and ServiceNow instance (inbound HTTPS on port 443)
- •Basic authentication credentials or ServiceNow integration user account
- •JSON Web Service plugin activated in ServiceNow
Architecture Overview
This integration primarily uses ServiceNow Scripted REST APIs to receive webhook notifications from Prometheus Alertmanager and Grafana, eliminating the need for Integration Hub spokes in most scenarios. Authentication is established using HTTP Basic Authentication with ServiceNow integration user credentials stored securely in Prometheus and Grafana webhook configurations, or alternatively through API key authentication using Connection & Credential Aliases for outbound calls from ServiceNow. The data flow is predominantly inbound from monitoring systems to ServiceNow, triggered by alert state changes in Prometheus or notification conditions in Grafana dashboards. A MID Server is typically not required since ServiceNow acts as the webhook receiver, though it may be needed for outbound API calls to Prometheus in air-gapped environments. Rate limiting considerations include ServiceNow's standard REST API limits of 5000 requests per hour per user, and Prometheus Alertmanager's webhook timeout of 10 seconds, requiring efficient processing in ServiceNow Scripted REST APIs.
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Implementation Steps
Create ServiceNow integration user and configure authentication
Navigate to User Administration > Users and create a dedicated integration user account with the 'itil' and 'web_service_admin' roles for webhook processing. Set a strong password and ensure the account is active with no password expiration policy applied. Document these credentials securely as they will be configured in Prometheus Alertmanager and Grafana webhook settings. Verify the user can authenticate by testing a simple REST API call to your ServiceNow instance using tools like Postman or curl.
Create Scripted REST API for Prometheus webhook ingestion
Navigate to System Web Services > Scripted Web Services > Scripted REST APIs and create a new API named 'Prometheus Integration' with API ID 'prometheus_webhook'. Add a new resource with HTTP method POST, relative path '/alert', and ensure 'Enforce authentication' is checked. Configure the resource to accept JSON payloads and set up proper error handling for malformed webhook data. This endpoint will receive Prometheus Alertmanager webhook notifications and process them into ServiceNow incidents based on alert severity and labels.
(function process(request, response) {
try {
var payload = JSON.parse(request.body.data);
var alerts = payload.alerts || [];
for (var i = 0; i < alerts.length; i++) {
var alert = alerts[i];
if (alert.status === 'firing') {
var inc = new GlideRecord('incident');
inc.initialize();
inc.short_description = alert.labels.alertname + ' - ' + alert.labels.instance;
inc.description = alert.annotations.description || alert.annotations.summary;
inc.urgency = alert.labels.severity === 'critical' ? '1' : '3';
inc.impact = '2';
inc.caller_id = gs.getUserID();
inc.assignment_group = 'Network';
inc.work_notes = 'Created from Prometheus alert: ' + alert.generatorURL;
var incidentSysId = inc.insert();
gs.log('Created incident ' + inc.number + ' from Prometheus alert: ' + alert.labels.alertname);
}
}
response.setStatus(200);
response.setBody({status: 'success', processed: alerts.length});
} catch (e) {
gs.error('Prometheus webhook processing error: ' + e.message);
response.setStatus(400);
response.setBody({error: e.message});
}
})(request, response);Configure Prometheus Alertmanager webhook integration
Edit your Prometheus Alertmanager configuration file (typically alertmanager.yml) to add a webhook receiver pointing to your ServiceNow Scripted REST API endpoint. The webhook URL should follow the format https://your-instance.service-now.com/api/now/prometheus_webhook/alert with proper authentication headers. Configure the webhook to trigger on specific alert labels or severity levels to avoid creating unnecessary incidents for informational alerts. Test the configuration using Alertmanager's amtool or by triggering a test alert to verify webhook delivery and ServiceNow incident creation.
global:
smtp_smarthost: 'localhost:587'
route:
group_by: ['alertname']
group_wait: 10s
group_interval: 10s
repeat_interval: 1h
receiver: 'servicenow-webhook'
receivers:
- name: 'servicenow-webhook'
webhook_configs:
- url: 'https://your-instance.service-now.com/api/now/prometheus_webhook/alert'
http_config:
basic_auth:
username: 'integration_user'
password: 'your_password'
send_resolved: trueCreate Scripted REST API for Grafana webhook notifications
Create another Scripted REST API resource for Grafana notifications with relative path '/grafana' under the same Prometheus Integration API or create a separate API. Grafana webhook payloads have a different structure than Prometheus, containing dashboard and panel information along with alert rules and thresholds. Configure the endpoint to handle Grafana's notification format and map dashboard alerts to appropriate ServiceNow incident categories based on dashboard tags or folder organization. Include logic to prevent duplicate incident creation by checking for existing incidents with matching Grafana alert identifiers.
(function process(request, response) {
try {
var payload = JSON.parse(request.body.data);
if (payload.state === 'alerting') {
// Check for existing incident to prevent duplicates
var existingInc = new GlideRecord('incident');
existingInc.addQuery('work_notes', 'CONTAINS', 'Grafana Alert ID: ' + payload.ruleId);
existingInc.query();
if (!existingInc.hasNext()) {
var inc = new GlideRecord('incident');
inc.initialize();
inc.short_description = payload.ruleName + ' - ' + payload.title;
inc.description = payload.message;
inc.urgency = payload.state === 'alerting' ? '2' : '3';
inc.impact = '2';
inc.caller_id = gs.getUserID();
inc.assignment_group = 'Network';
inc.work_notes = 'Created from Grafana alert. Dashboard: ' + payload.ruleName + ', Alert ID: ' + payload.ruleId + ', URL: ' + payload.ruleUrl;
inc.insert();
gs.log('Created incident from Grafana alert: ' + payload.ruleName);
}
}
response.setStatus(200);
response.setBody({status: 'processed'});
} catch (e) {
gs.error('Grafana webhook processing error: ' + e.message);
response.setStatus(400);
response.setBody({error: e.message});
}
})(request, response);Configure Grafana notification channels for ServiceNow integration
In Grafana, navigate to Alerting > Notification channels and create a new webhook notification channel pointing to your ServiceNow Grafana webhook endpoint. Configure the webhook to include necessary alert context such as dashboard name, panel information, and metric values in the JSON payload. Set up appropriate alert rules on critical dashboards to trigger ServiceNow incident creation when thresholds are exceeded or data sources become unavailable. Test the notification channel using Grafana's test notification feature to ensure proper webhook delivery and incident creation in ServiceNow.
{
"name": "ServiceNow Integration",
"type": "webhook",
"settings": {
"url": "https://your-instance.service-now.com/api/now/prometheus_webhook/grafana",
"username": "integration_user",
"password": "your_password",
"httpMethod": "POST",
"maxAlerts": 10
}
}Implement incident resolution automation from monitoring systems
Create additional Scripted REST API resources to handle alert resolution notifications from both Prometheus (when alerts stop firing) and Grafana (when alert conditions return to normal). Configure these endpoints to automatically resolve or close corresponding ServiceNow incidents when the underlying monitoring conditions are restored. Implement proper incident matching logic using correlation IDs or unique identifiers from the monitoring systems to ensure the correct incidents are updated. Add business rules or workflows to validate that incidents should be auto-resolved based on organization policies and incident priority levels.
(function process(request, response) {
try {
var payload = JSON.parse(request.body.data);
var alerts = payload.alerts || [];
for (var i = 0; i < alerts.length; i++) {
var alert = alerts[i];
if (alert.status === 'resolved') {
var inc = new GlideRecord('incident');
inc.addQuery('work_notes', 'CONTAINS', alert.labels.alertname);
inc.addQuery('state', '!=', '6'); // Not resolved
inc.addQuery('state', '!=', '7'); // Not closed
inc.query();
while (inc.next()) {
inc.state = '6'; // Resolved
inc.resolution_code = 'Solved Remotely (Hardware)';
inc.resolution_notes = 'Alert resolved automatically by monitoring system at ' + alert.endsAt;
inc.update();
gs.log('Auto-resolved incident ' + inc.number + ' - Alert cleared: ' + alert.labels.alertname);
}
}
}
response.setStatus(200);
response.setBody({status: 'resolved alerts processed'});
} catch (e) {
response.setStatus(400);
response.setBody({error: e.message});
}
})(request, response);Create outbound REST integration for alert acknowledgment
Navigate to System Web Services > Outbound > REST Message and create REST messages to send acknowledgments back to Prometheus Alertmanager when ServiceNow incidents are assigned or updated. Configure Connection & Credential Aliases to store Prometheus API credentials securely for outbound authentication. Set up HTTP methods for silencing alerts in Alertmanager when incidents are being actively worked on to prevent alert noise. Create Business Rules on the Incident table to trigger these outbound REST calls when incident state changes occur, ensuring bidirectional communication between ServiceNow and the monitoring infrastructure.
var restMessage = new sn_ws.RESTMessageV2('PrometheusAPI', 'POST');
restMessage.setStringParameterNoEscape('alertname', current.work_notes.toString().match(/alertname=([^\s,]+)/)[1]);
restMessage.setRequestBody(JSON.stringify({
'matchers': [{
'name': 'alertname',
'value': alertname,
'isRegex': false
}],
'startsAt': new GlideDateTime().getDisplayValue(),
'endsAt': new GlideDateTime().addSeconds(3600).getDisplayValue(),
'createdBy': 'ServiceNow',
'comment': 'Alert silenced - ServiceNow incident ' + current.number + ' assigned to ' + current.assigned_to.getDisplayValue()
}));
var response = restMessage.execute();
var responseBody = response.getBody();
var httpStatus = response.getStatusCode();
if (httpStatus == 200) {
gs.log('Alert silenced in Prometheus for incident: ' + current.number);
} else {
gs.error('Failed to silence alert in Prometheus: ' + responseBody);
}Test end-to-end integration and configure monitoring dashboards
Create comprehensive test scenarios covering alert firing, incident creation, incident assignment, alert resolution, and incident closure workflows between Prometheus, Grafana, and ServiceNow. Set up ServiceNow Performance Analytics or custom reports to monitor integration health, including webhook success rates, incident creation volumes, and resolution times from monitoring alerts. Configure Grafana dashboards to visualize ServiceNow incident metrics alongside infrastructure monitoring data, providing a unified view of system health and ITSM activities. Document the integration architecture, webhook endpoints, authentication methods, and troubleshooting procedures for operational teams.
// Test script to validate webhook endpoints
var testPayload = {
'alerts': [{
'status': 'firing',
'labels': {
'alertname': 'TestAlert',
'instance': 'test-server',
'severity': 'warning'
},
'annotations': {
'description': 'This is a test alert for integration validation',
'summary': 'Test Alert Summary'
},
'generatorURL': 'http://prometheus:9090/graph'
}]
};
var request = new sn_ws.RESTMessageV2();
request.setEndpoint('https://your-instance.service-now.com/api/now/prometheus_webhook/alert');
request.setHttpMethod('POST');
request.setBasicAuth('integration_user', 'your_password');
request.setRequestHeader('Content-Type', 'application/json');
request.setRequestBody(JSON.stringify(testPayload));
var response = request.execute();
gs.log('Test webhook response: ' + response.getStatusCode() + ' - ' + response.getBody());Common Use Cases
Critical Infrastructure Alert Automation
Automatically create high-priority ServiceNow incidents when Prometheus detects critical infrastructure failures such as server downtime, database connection losses, or storage capacity issues. The integration maps Prometheus alert severity levels to ServiceNow urgency and impact fields, ensuring critical alerts become Priority 1 incidents with appropriate assignment group routing. Business value includes reduced mean time to detection (MTTD) and faster incident response through automated ITSM workflows, eliminating manual alert monitoring and reducing the risk of missing critical system failures.
Application Performance Degradation Incidents
Create ServiceNow incidents from Grafana dashboard alerts when application response times exceed defined thresholds or error rates spike above acceptable levels. The integration includes contextual information from Grafana panels such as affected services, performance metrics, and dashboard links within ServiceNow incident descriptions. This enables rapid problem identification and provides development teams with immediate access to performance data through established ServiceNow assignment and escalation processes, improving application reliability and user experience.
Capacity Planning and Resource Utilization Alerts
Generate ServiceNow service requests or incidents when Prometheus monitoring detects resource utilization approaching critical thresholds, such as CPU usage above 85% or disk space below 10%. The integration can differentiate between immediate incidents requiring urgent attention and capacity planning requests for proactive resource scaling. ServiceNow workflows can automatically assign these to appropriate teams (infrastructure for immediate issues, capacity management for planning) while maintaining historical records for trend analysis and capacity forecasting.
Security Event and Anomaly Response
Automatically escalate security-related alerts from Prometheus and Grafana into ServiceNow security incidents with proper categorization and urgency assignment. This includes anomaly detection alerts, failed authentication attempts, suspicious network traffic patterns, or compliance monitoring violations detected through monitoring dashboards. The integration ensures security events follow established incident response procedures while maintaining audit trails and compliance requirements through ServiceNow's security incident management workflows and approval processes.
Business Service Impact Correlation
Create ServiceNow incidents that correlate infrastructure alerts from Prometheus with business service impacts tracked in ServiceNow's Configuration Management Database (CMDB). When monitoring detects failures in underlying infrastructure components, the integration can automatically identify affected business services and create incidents with appropriate business impact assessments. This enables IT teams to prioritize response efforts based on business criticality while providing stakeholders with accurate service status information through ServiceNow's business service management capabilities.
Troubleshooting
Webhook returns 401 Unauthorized error from ServiceNow
Check the integration user credentials configured in Prometheus/Grafana webhook settings and verify the ServiceNow user account is active with proper roles assigned. Navigate to System Logs > System Log > All to review authentication failure details and confirm the username/password combination is correct. Ensure the ServiceNow user has 'web_service_admin' and 'itil' roles, and test authentication using a REST client like Postman before troubleshooting the webhook configuration further.
Webhook payload received but no ServiceNow incident created
Enable debug logging in your Scripted REST API by adding gs.log statements to track payload processing and check System Logs > System Log > All for JavaScript errors or null pointer exceptions. Verify the JSON payload structure matches your parsing logic by logging the raw request body data and comparing against expected Prometheus/Grafana webhook formats. Common issues include missing required fields, incorrect field mappings, or business rule validation failures preventing incident insertion, which can be diagnosed through the ServiceNow script debugger.
Duplicate incidents created for the same alert
Implement proper correlation logic in your Scripted REST API to check for existing incidents before creating new ones, using alert fingerprints or unique identifiers from Prometheus/Grafana. Query existing incidents using GlideRecord with specific alert identifiers stored in work notes or custom fields to prevent duplicates. Review Prometheus Alertmanager grouping configuration and repeat intervals to ensure alert deduplication is properly configured at the source, and consider implementing a time-based correlation window in ServiceNow to handle rapid-fire duplicate webhooks.
ServiceNow outbound REST calls to Prometheus API fail with SSL errors
Configure proper SSL certificate validation in ServiceNow by importing Prometheus server certificates into the ServiceNow certificate store via System Security > Certificates. If using self-signed certificates in development environments, temporarily disable SSL verification in REST Message configurations for testing, but ensure proper certificates are used in production. Check MID Server logs if using a MID Server for outbound connections and verify network connectivity and firewall rules allow HTTPS traffic between ServiceNow and Prometheus on the required ports.
Grafana test notifications succeed but real alerts do not trigger webhooks
Verify Grafana alert rules are properly configured with the correct notification channel assignments and check that alert conditions are actually being met by reviewing Grafana's alert rule evaluation logs. Navigate to Grafana Alerting > Alert Rules and confirm the notification channel is attached to the specific alert rules, not just configured globally. Review Grafana server logs for webhook delivery failures and ensure the ServiceNow endpoint URL is accessible from the Grafana server network, testing connectivity using curl or similar tools from the Grafana host.
High latency or timeouts in webhook processing causing Prometheus/Grafana to retry
Optimize ServiceNow Scripted REST API performance by minimizing database queries, avoiding complex GlideRecord operations, and implementing asynchronous processing for non-critical operations using scheduled jobs. Review ServiceNow instance performance metrics and consider implementing webhook payload queuing through the Event Management system for high-volume alert scenarios. Increase timeout settings in Prometheus Alertmanager webhook configuration if ServiceNow processing legitimately requires more than the default 10-second timeout, and implement proper error handling to return appropriate HTTP status codes quickly even when processing fails.
Pro Tips
- →Implement alert correlation and deduplication by creating custom fields on the Incident table to store Prometheus alert fingerprints and Grafana panel IDs, enabling sophisticated matching logic that prevents duplicate incident creation and supports proper incident lifecycle management. Use ServiceNow's Event Management functionality to process webhook payloads asynchronously, improving webhook response times and providing better error handling and retry mechanisms for high-volume alert scenarios.
- →Create dynamic assignment group routing by mapping Prometheus alert labels and Grafana dashboard folders to ServiceNow assignment groups through a configuration table, allowing non-technical teams to manage alert routing without modifying code. Implement alert enrichment by calling ServiceNow CMDB APIs to automatically populate incident records with configuration item details based on monitoring target hostnames or IP addresses.
- →Set up ServiceNow Performance Analytics widgets to track integration health metrics such as webhook success rates, incident creation volumes by alert source, and mean time to resolution for monitoring-generated incidents. Create custom ServiceNow reports that correlate infrastructure alerts with business service outages, providing valuable insights for capacity planning and infrastructure investment decisions.
- →Implement intelligent alert suppression by integrating with ServiceNow's Maintenance Schedule functionality, automatically silencing Prometheus alerts and preventing incident creation during planned maintenance windows. Use ServiceNow's Machine Learning capabilities to identify patterns in monitoring alerts and suggest optimal assignment groups or resolution procedures based on historical incident data.
- →Configure webhook authentication using ServiceNow OAuth instead of basic authentication for enhanced security, implementing proper token refresh mechanisms and credential rotation procedures. Create ServiceNow workflows that automatically escalate unresolved monitoring incidents based on business impact and alert severity, ensuring critical infrastructure issues receive appropriate attention even during off-hours.
Known Limitations
- —ServiceNow's default REST API rate limiting of 5000 requests per hour per user can become a bottleneck in high-volume monitoring environments, requiring careful webhook batching or multiple integration user accounts for large-scale deployments. Prometheus Alertmanager's 10-second webhook timeout may be insufficient for complex ServiceNow processing involving multiple database operations, CMDB lookups, or external API calls, necessitating asynchronous processing patterns.
- —The integration requires manual maintenance of alert routing logic and field mappings within ServiceNow Scripted REST APIs, as there is no official ServiceNow spoke for Prometheus/Grafana integration available in the Integration Hub store. Changes to Prometheus label schemas or Grafana notification formats may break existing webhook processing code, requiring careful version management and testing procedures.
- —ServiceNow incident deduplication relies on custom correlation logic since Prometheus and Grafana do not provide universally unique alert identifiers across system restarts or configuration changes. This can lead to orphaned incidents when monitoring system configurations change or alert definitions are modified without corresponding ServiceNow integration updates.
Frequently Asked Questions
Can this integration automatically resolve ServiceNow incidents when Prometheus alerts clear?
Yes, the integration supports bidirectional alert lifecycle management by processing resolved alert webhooks from Prometheus Alertmanager and automatically updating corresponding ServiceNow incidents to resolved status. You need to configure Prometheus Alertmanager with send_resolved: true in the webhook configuration and implement correlation logic in ServiceNow to match resolved alerts with existing incidents. The integration can also handle Grafana alert state changes from alerting to ok status, providing complete alert lifecycle automation across both monitoring platforms.
How do I prevent duplicate incident creation when the same alert fires multiple times?
Implement deduplication logic in your ServiceNow Scripted REST API by storing unique alert identifiers (such as Prometheus alert fingerprints or Grafana rule IDs) in incident custom fields or work notes and querying existing open incidents before creating new ones. Configure Prometheus Alertmanager with appropriate grouping and repeat interval settings to reduce webhook frequency for the same alert condition. Consider using ServiceNow Event Management for more sophisticated correlation and deduplication capabilities, which provides built-in mechanisms for handling duplicate events and alert correlation across multiple monitoring sources.
What ServiceNow roles and permissions are required for the integration user account?
The integration user requires the 'web_service_admin' role for Scripted REST API access, 'itil' role for incident creation and management, and 'import_set_loader' role if using Import Sets for bulk data processing. Additionally, consider granting 'event_management_user' if leveraging Event Management functionality and 'cmdb_read' for Configuration Item lookups during alert enrichment. Avoid using admin accounts for integration purposes and instead create a dedicated service account with minimal required permissions to follow security best practices and maintain proper audit trails.
Can I customize incident priority and assignment based on specific Prometheus labels or Grafana dashboard properties?
Yes, you can implement sophisticated routing and prioritization logic by parsing Prometheus alert labels (such as severity, service, environment) and Grafana dashboard properties (folder, tags, panel names) within your ServiceNow Scripted REST API code. Create mapping tables in ServiceNow to maintain label-to-assignment-group relationships that can be updated by operations teams without code changes. The integration can also leverage ServiceNow's Service Mapping and Business Service Management capabilities to automatically determine business impact based on affected configuration items identified through monitoring target metadata.
How can I troubleshoot webhook delivery failures between monitoring systems and ServiceNow?
Enable comprehensive logging in both directions by adding detailed gs.log statements in ServiceNow Scripted REST APIs and reviewing Prometheus Alertmanager and Grafana server logs for webhook delivery attempts and failures. Use ServiceNow's REST API Explorer to test webhook endpoints manually and verify authentication, payload format, and response handling. Monitor ServiceNow System Logs for JavaScript errors, authentication failures, and performance issues, and consider implementing webhook retry mechanisms with exponential backoff in your monitoring system configurations to handle temporary ServiceNow unavailability.
Is it possible to send ServiceNow incident updates back to Prometheus or Grafana for alert annotation?
Yes, you can implement bidirectional communication by creating ServiceNow Business Rules that trigger outbound REST calls to Prometheus Alertmanager's silence API when incidents are assigned or resolved, and to Grafana's annotation API to add incident details to relevant dashboards and time series data. Configure ServiceNow REST Messages with proper authentication to external monitoring systems and use incident workflow events (assignment, state changes, resolution) as triggers for outbound notifications. This creates a complete feedback loop where incident management activities in ServiceNow are reflected in monitoring dashboards and alert states.
What are the network and security requirements for this integration?
The integration requires inbound HTTPS connectivity (port 443) from Prometheus and Grafana servers to your ServiceNow instance for webhook delivery, with proper firewall rules and network security group configurations. For bidirectional communication, ServiceNow needs outbound HTTPS access to Prometheus and Grafana APIs, which may require MID Server deployment in air-gapped or highly secured environments. Implement proper authentication mechanisms using dedicated service accounts, consider IP address whitelisting for webhook endpoints, and ensure SSL/TLS encryption for all API communications. Follow ServiceNow security best practices by regularly rotating integration credentials and monitoring API access logs for suspicious activity.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue