Valid values for status for ServiceNow tickets

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

We are looking for a complete list of valid values for checking the status of ServiceNow tickets. The PAM online documentation does not appear to contain correct information. As of Jan 3 2020 it lists the following possible status values for ServiceNow incidents:

assigned, cancelled, closed, inprogress, new, pending, resolved

We don't think this can be right. E.g. we do have incidents in state "In Progress" in ServiceNow, but any attempt to filter on this state using "status==inprogress", "status==In Progress" etc fails. It looks like this state is not accepted by PAM. Also, the example given in online documentation is "status==active", which doesn't match any of the listed status strings.

 

Environment

Release : 3.4, 4.0

Component : PRIVILEGED ACCESS MANAGEMENT

Cause

PAM uses a Normalized Integration Module (NIM) to communicate with Service Desk implementations. NIM has a default hardcoded list of status strings mapped to state numbers in ServiceNow. This list can be customized, but only with assistance by PAM support at this time.

Resolution

The default mapping in NIM for integration with ServiceNow is as follows for status of tickets of type Incident:

New=1
Active=2
Awaiting Problem=3
Awaiting User Info=4
Awaiting Evidence=5
Resolved=6
Closed=7

The strings on the left are used in query filter definitions in a password view policy in PAM, in lower case. NIM converts these to the numbers/values on the right before sending the filter query to ServiceNow.The following is a list of possible query filters for the individual possible ticket states:

status==new
status==active
status==awaiting problem
status==awaiting user info
status==awaiting evidence
status==resolved
status==closed

 

These can be combined with logic operators as defined in PAM online documentation. E.g. the following query filter should match ServiceNow incidents in state 2 or 3:

status==active||status==awaiting problem

 

For tickets of type Change, the default mapping between PAM status and ticket state is as follows:

Pending=-5
Open=1
Work In Progress=2
Closed Complete=3
Closed Incomplete=4
Closed Skipped=7

 

For tickets of type Request, the status maps to request_state in ServiceNow as follows:

Pending Approval=requested
Approved=in_process
Closed Complete=closed_complete
Closed Incomplete=closed_incomplete
Closed Cancelled=closed_cancelled
Closed Rejected=closed_rejected

 

PAM/NIM can also filter on impact urgency or priority.

For urgency and priority, high, medium or low can be used as filter in the password view policy for all ticket types, mapping to the ServiceNow values as follows:

High=1
Medium=2
Low=3

 

The priority mapping is also the same for all ticket types:

Critical=1
High=2
Moderate=3
Low=4
Planning=5

Additional Information

If you need to customize the mappings to match states defined in your ServiceNow implementation, please contact PAM support.