How to Connect LogicMonitor to ServiceNow Event Management Using the Built-In Connector
ServiceNow ships an out-of-the-box Event Management Connector for LogicMonitor. This guide walks you through the end-to-end setup — from activating the connector in ServiceNow to receiving your first events.
## Prerequisites
On your ServiceNow instance:
- The **Event Management** plugin (`com.glideapp.itom.snac`) installed and activated.
- The **Event Management Connectors** plugin (`sn_em_connector`) installed and activated.
On the LogicMonitor side, you need admin access to create integrations and escalation chains.
Step 1: Activate the LogicMonitor Connector in ServiceNow
Navigate to the "Service Operation Workspace"
This assumes you have the latest ITIOM AIOps configuration center installed: "Add integration"
Search for "Logic Monitor" and this give you the option to use an integration direct to the instance or via a MID server. If there is high event volume MID server is the preferred route.
Fill out the field and activate and save. This will enable the URL to be used in LogicMonitor
The tile gives you a pre-built inbound event URL:
`https://<instance>.service-now.com/api/sn_em_connector/em/inbound_event?source=logicmonitor&sys_id=<connector_sys_id>`
Copy that URL — you'll need it in Step 3.
Step 2: Get the JSON Payload Template
The connector comes with a ready-made JSON payload template that maps LogicMonitor alert tokens to ServiceNow event fields. You'll find it by navigating to **Event Management > Push Connectors** and opening the **LogicMonitor Push Connector** record. The template is in the **Description** field:
{
"type":"##ALERTTYPE##",
"status":"##ALERTSTATUS##",
"level":"##LEVEL##",
"host":"##HOST##",
"datasource":"##DATASOURCE##",
"eventsource":"##EVENTSOURCE##",
"batchjob":"##BATCHJOB##",
"group":"##HOSTGROUP##",
"datapoint":"##DATAPOINT##",
"start":"##START##",
"end":"##END##",
"duration":"##DURATION##",
"date":"##DATE##",
"value":"##VALUE##",
"threshold":"##THRESHOLD##",
"message":"##MESSAGE##",
"alertid":"##ALERTID##"
}
Copy this entire JSON block. The `##TOKEN##` placeholders are LogicMonitor's alert token syntax — they get replaced with actual alert values at runtime. This ensures the ServiceNow Push Connector Listener Script can parse the incoming events correctly.
Step 3: Configure the Custom HTTP Delivery in LogicMonitor
In your LogicMonitor portal:
1. Go to **Settings > Integrations** and click **Add > Custom HTTP Delivery Integration**.
2. Give it a **Name** (e.g., "ServiceNowEventManagement") and a **Description**.
3. Check **Use the same URL and data to notify on various alert activity**.
4. Select which alert activities should fire a notification: **Acknowledged**, **Cleared**, and **Escalated/De-escalated** as needed.
5. Set the HTTP method to **HTTP POST**.
6. Enter the **URL** you copied from the ServiceNow connector tile in Step 1.
7. Fill in **Username** and **Password** — this is a ServiceNow account with the `evt_mgmt_integration` role. Basic Authentication is used. The user need the "evt_mgmt_integration" Role in ServiceNow.
8. Under Alert Data, select **Raw** and set the format to **JSON**.
9. Paste the JSON payload template from Step 2 into the body field.
10. Click **Test Alert Delivery** to verify, then **Save**.
If successfully sending the Event into ServiceNow, it will look like this:
You can see the incoming test event in the Connector setup under "Events"
Now you have the integration working and there rest is LogicMonitor configuration on when to send Events into ServiceNow.
Step 4: Create an Escalation Chain in LogicMonitor
The integration fires when an escalation chain triggers it.
1. Go to **Settings > Alert Settings > Escalation Chains** and click **Add**.
2. Name it (e.g., "ServiceNow Events").
3. Under **Stages**, add a stage Select the User and select the Custom HTTP Delivery integration you just created as the Contact Method.
4. Save.
Step 5: Create Alert Rules in LogicMonitor
1. Go to **Settings > Alert Settings > Alert Rules** and click **Add**.
2. Configure the conditions that should route alerts to ServiceNow.
3. Under **Escalation chain**, select the chain you just created.
4. Save.
## Verification
Fire a test alert in LogicMonitor (or wait for one). In ServiceNow, check **Event Management > All Events** — you should see inbound events with source `logicmonitor`. From there, standard Event Management processing takes over: event rules, alerts, and service mapping.
4 Comments
