HERE'S WHY
Managing your security compliance can require coordination and collaboration with other members of your organization. Drata makes this easier by integrating with the tools you already use on a daily basis, including ServiceNow. By connecting ServiceNow to Drata with write access enabled, you can create and assign tickets for Controls (DCF and Custom), Tests, and Risk Management in Drata and have them accessible in your ServiceNow account.
Before Diving In
Users with admin or information security leads access can create and view ServiceNow tickets within Drata, however a user must have Admin access in order to set up or edit the ServiceNow connection
'Write Access' is already enabled when creating the initial ServiceNow connection
Limitations / Watchouts
Incidents, Problem Records, and Service Catalog Tasks are the only supported ticket types in Drata for ServiceNow.
Drata does not currently have access to the UI policies or Data policies you have set up in your ServiceNow Account. For example, if a ticket field is required in your ServiceNow account, it will not be shown as required in Drata when creating a ticket. Any field interactions or rules you have set up in your ServiceNow account will not be reflected in Drata when creating a ticket.
When contacting support regarding your ServiceNow connection, please be prepared to review the data policies and UI policies set up in your ServiceNow account for your tickets. These may be affecting your experience in Drata.
To learn more about ServiceNow UI policies, click here.
To learn more about ServiceNow Data policies, click here.
If you have Workspaces enabled in Drata, ticket management is only enabled for your primary workspace.
When creating a ServiceNow ticket in Drata, for the dropdown lists that are directly related to ServiceNow (data source references), if a search is made in it, it will only search based on the first word/character/symbol.
If the ticket field for “Assigned to” isn’t a member from the specified group in the field “Assignment Group” in your account, ServiceNow will throw an error. This will depend on how you have set up your ticket in your ServiceNow account.
Supported ServiceNow Field Types in Drata
ServiceNow offers many data types to assign to ticket form fields. Some of them are incredibly complex and are not supported in the current integration in Drata when creating and tracking tickets. Any field (custom or default) with a supported input type from the below list will be shown in Drata:
String
reference
glide_list
glide_date_time
choice
journal_input
Boolean
HERE'S HOW
Connecting ServiceNow To Drata
In your Connections page, click on Available connections and select the Ticketing type. Scroll down to ServiceNow and click on Connect Now
The slide-out panel will provide step-by-step instructions to set up the connection.
Creating ServiceNow Tickets via Drata
When 'Write Access' is enabled you are able to create tickets from any Control Details, Test Details, or Risk Details (in Risk Management) drawer.
If there are no tickets currently associated to a Control, Test, or Risk, you will be prompted to create one to get started.
Choose a ticket type. You can select Incident, Problem, or Task for any ticket that you create in Drata for ServiceNow.
Complete your ticket details. Drata will pull all the fields (with supported input types) from your ServiceNow account for that ticket type. The short description and Description – if they are fields in your ticket type – will be auto-filled with information about the control.
Note: Drata does not currently have access to the UI policies or Data policies you have set up in your ServiceNow Account. For example, if a ticket field is required in your ServiceNow account, it will not be shown as required in Drata when creating a ticket. Any field interactions or rules you have set up in your ServiceNow account will not be reflected in Drata when creating a ticket.
Click on Create ticket once you are completing the ticket details you’d like to input.
Viewing and Managing Tickets in Drata
When ServiceNow tickets have been created for a specific Control, Test, or Risk (in Risk Management), they will display within the drawer. The most recently added ticket will display at the top of the list.
Each ticket listing includes the following information:
Ticket Summary / Short Description – as entered by the user
Ticket code – as generated by ServiceNow, ex: INC00128
Date the ticket was created
Date the ticket was updated
Ticket Status – as reported by ServiceNow
Name of Assignee – tickets can be assigned to any selectable ServiceNow User. This user does not need to be a information security leads or admin in Drata.
Name of person who created the ticket
To view, edit, and manage a ticket, click the Manage in ServiceNow link and you'll be taken to ServiceNow.
To download the ticket information, click on Download ticket. This will download a zip which will contain a pdf of the ticket details along with any attachments associated to that ticket. Note: PNG attachments will not be included
To unlink a ticket from the control, test, or risk, click Remove. Unlinking a ticket will not delete the ticket in your ServiceNow account. Note: once a ticket is removed, it cannot be re-linked.
A maximum of three ‘In Progress’ tasks will display in the list in the drawer. To see all tickets associated to a particular Control, Test, or Risk (in Risk Management), click the ‘View all tasks’ link and a modal will open.
Here the tickets are divided into two standardized categories, 'In Progress' and 'Done':
In Progress – Tickets in any open state as defined in your ServiceNow instance.
Done – Tickets in any completed state as defined in your ServiceNow instance, i.e. Closed, Done, etc.
Only tickets created in Drata for that specific Control, Test, or Risk (in Risk Management) will display in Drata. Tickets created directly in ServiceNow will not be pulled into the Drata application for ticket management.