ServiceNow ThousandEyes Integration Guide

Architecture Overview

Implementation Steps

(function process(request, response) {
    try {
        var requestBody = request.body.data;
        var alert = JSON.parse(requestBody);
        
        var inc = new GlideRecord('incident');
        inc.initialize();
        inc.short_description = 'ThousandEyes Alert: ' + alert.testName + ' - ' + alert.alertType;
        inc.description = 'Alert Details: ' + alert.violationDescription + '\nAffected Agents: ' + alert.agents.join(', ');
        inc.impact = alert.severity === 'critical' ? '1' : alert.severity === 'major' ? '2' : '3';
        inc.urgency = '2';
        inc.category = 'Network';
        inc.u_thousandeyes_alert_id = alert.alertId;
        inc.u_thousandeyes_test_id = alert.testId;
        inc.insert();
        
        response.setStatus(200);
        response.setBody({'status': 'success', 'incident': inc.getDisplayValue()});
    } catch (e) {
        gs.error('ThousandEyes webhook processing error: ' + e.message);
        response.setStatus(400);
        response.setBody({'error': e.message});
    }
})(request, response);

(function executeRule(current, previous) {
    if (current.u_thousandeyes_alert_id && current.u_thousandeyes_test_id) {
        var sm = new sn_ws.RESTMessageV2();
        sm.setEndpoint('https://api.thousandeyes.com/v6/net/path-vis/' + current.u_thousandeyes_test_id);
        sm.setHttpMethod('GET');
        sm.setRequestHeader('Authorization', 'Bearer ' + gs.getProperty('thousandeyes.api.token'));
        sm.setRequestHeader('Accept', 'application/json');
        
        var response = sm.execute();
        if (response.getStatusCode() == 200) {
            var pathData = JSON.parse(response.getBody());
            current.work_notes = 'Network Path Analysis: ' + pathData.net.pathVis.length + ' hops detected\n';
            current.work_notes += 'End-to-end Loss: ' + pathData.net.loss + '%\n';
            current.work_notes += 'Average Latency: ' + pathData.net.avgLatency + 'ms';
            current.update();
        }
    }
})(current, previous);

var gr = new GlideRecord('incident');
gr.addQuery('active', true);
gr.addQuery('u_thousandeyes_alert_id', '!=', '');
gr.query();

while (gr.next()) {
    try {
        var rm = new sn_ws.RESTMessageV2();
        rm.setEndpoint('https://api.thousandeyes.com/v6/alerts/' + gr.u_thousandeyes_alert_id);
        rm.setHttpMethod('GET');
        rm.setRequestHeader('Authorization', 'Bearer ' + gs.getProperty('thousandeyes.api.token'));
        
        var response = rm.execute();
        if (response.getStatusCode() == 200) {
            var alertData = JSON.parse(response.getBody());
            if (alertData.alert && alertData.alert.active === 0) {
                gr.state = 6; // Resolved
                gr.resolution_code = 'Solved (Permanently)';
                gr.close_notes = 'Alert cleared in ThousandEyes at ' + alertData.alert.dateEnd;
                gr.update();
            }
        }
    } catch (e) {
        gs.error('Error synchronizing ThousandEyes alert ' + gr.u_thousandeyes_alert_id + ': ' + e.message);
    }
}

Common Use Cases

Troubleshooting

Pro Tips

• →Implement custom incident classification logic based on ThousandEyes test types to automatically route network, application, and BGP alerts to appropriate assignment groups, improving response efficiency and reducing manual triage overhead.
• →Use ServiceNow's Event Management correlation rules to group related ThousandEyes alerts from multiple tests or locations into single incidents, preventing alert storms during widespread network outages while maintaining visibility into affected services.
• →Create custom dashboards combining ServiceNow incident metrics with embedded ThousandEyes network performance data using iframe widgets or REST API integration to provide unified network health visibility for operations teams.
• →Configure alert suppression logic during scheduled maintenance windows by checking ServiceNow's Change Management schedule before creating incidents from ThousandEyes webhooks, reducing noise during planned network activities.
• →Leverage ServiceNow's Flow Designer to create automated remediation workflows that can trigger network device configuration changes or failover procedures based on specific ThousandEyes alert patterns and severity levels.
• →Implement historical trend analysis by storing ThousandEyes performance metrics in ServiceNow's Performance Analytics warehouse, enabling long-term network health reporting and capacity planning insights alongside incident management data.

Known Limitations

• —ThousandEyes API enforces a rate limit of 240 requests per minute per organization, which may constrain real-time data enrichment capabilities during high-volume alert periods or when implementing comprehensive historical data synchronization. Consider implementing request queuing and caching mechanisms to work within these limits.
• —ServiceNow's Scripted REST API webhook processing occurs synchronously, potentially causing timeout issues when processing complex ThousandEyes payloads or performing multiple API enrichment calls during incident creation. Implement asynchronous processing patterns using business rules or scheduled jobs for complex data operations.
• —ThousandEyes webhook delivery retry mechanisms may not align perfectly with ServiceNow's availability during maintenance windows or system updates, potentially resulting in missed alerts during critical infrastructure events. Implement compensating controls through scheduled API polling for mission-critical monitoring scenarios.
• —The integration requires custom field creation on ServiceNow tables to store ThousandEyes-specific metadata, which may impact upgrade compatibility and require additional testing during ServiceNow platform updates. Document custom fields thoroughly and plan for migration testing.
• —Network path visualization and traceroute data from ThousandEyes may contain large JSON payloads that exceed ServiceNow field size limitations, requiring data truncation or alternative storage strategies for comprehensive network diagnostic information. Consider using attachment storage for large diagnostic datasets.

Frequently Asked Questions