Guidance Required for Automatic Incident Creation from ServiceNow RPA Bot Alerts

[abhirupdas09]

Hi,

I have configured an alert for a specific case.
I now want to automatically create a ServiceNow incident whenever an RPA Bot alert is triggered and send a Microsoft Teams notification with the generated incident ID.

Could you please guide me, or connect me with someone who can help me configure this?

Thank you.

[Vikram Reddy]

Hello @abhirupdas09,

You can build this whole thing natively in Flow Designer, no middleware required, once you're clear on where the "alert" actually comes from: is it the bot process itself hitting an error and failing, or the bot detecting something during its run that you want treated as an alert? Those are two different triggers, so it's worth pinning down before you build anything.

Assuming it's the first case, bot fails and you want an incident out of it, this is the pattern RPA Hub is built for:

1. In RPA Studio, wrap the risky steps in a Try/Catch and use the UpdateWorkItem action on the On Error branch. Set State to Failure and push the error text into ResponseContent so it lands on the work queue record instead of just dying in the robot log.
2. In Flow Designer, build a flow with a Created/Updated trigger on that work queue table, filtered to State = Failure. That's the same record RPA Hub already uses to track execution, so you don't need a separate polling job or custom table.
3. Add a Create Record action for Incident, mapping short_description and description from the error message field, and set assignment_group and category so it lands with the right team instead of a generic queue.
4. Chain a Microsoft Teams Spoke, Post a Message action right after it, pulling number and sys_id off the Create Record output so the Teams message shows the actual incident number, not just "an incident was created."

One heads up on that last step: the legacy Microsoft Teams Spoke posts using the old O365 connector card format, and Microsoft has been retiring those connectors inside Teams. If your Post a Message action suddenly stops posting, that's almost certainly why and not a ServiceNow-side bug. Fixing it means either adding a Content-Type: application/json header on the outbound call or rebuilding the webhook against Teams Workflows instead of the old Incoming Webhook connector.

Thank you,
Vikram Karety
Octigo Solutions INC

[abhirupdas09]

Thanks.

How can I attach the exception Screenshot as well in the incident?

When the RPA Bot encounters an exception, I'm capturing Screenshot and saving network drive but how to attach it in incident?

[Vikram Reddy]

Hello @abhirupdas09,

Add a separate UploadAttachment step in your RPA Studio flow, right after the step that creates the incident, and point it at the screenshot's local path. Don't try to make the "create incident" action do double duty as the attach step, it isn't built for that, attaching is its own action in the Attachments group alongside DownloadAttachment.

The reason this trips people up is that the create-incident action only returns a sys_id, it doesn't have a file input. So the flow needs two steps talking to each other: capture the incident sys_id from the create step's output, then feed that sys_id plus the screenshot path into UploadAttachment. A few things worth checking before you wire that up:

• The incident sys_id from the create step is actually being passed forward into the upload step's variables, not just logged.
• The network drive path is reachable from wherever the bot runtime actually executes. If the bot runs on an attended desktop that's fine, but if it's later moved to an unattended runner or a different machine, a mapped drive letter can silently stop resolving and the upload will fail with a generic file-not-found rather than a ServiceNow error.
• The screenshot's extension is on the glide.attachment.extensions allow list (System Properties > Attachments). If that property is populated and png or jpg isn't in the comma separated list, the attach will get rejected even though everything upstream worked.
• The file isn't tripping glide.attachment.max_size, full-screen screenshots are usually tiny but it's worth a glance if you're capturing multi-monitor grabs.

If you're not going through RPA Studio's native component for this, for instance you're calling out from a script step instead, the underlying mechanism is the platform's Attachment API. A POST to api/now/attachment/file with table_name=incident, table_sys_id=<the sys_id> and file_name as query parameters, and the raw file bytes as the body, does the same thing over REST. Multipart is also supported via api/now/attachment/upload if that's easier for whatever HTTP client the bot is using.

Either path lands the file in sys_attachment against the incident record, which is what actually drives it showing up under the attachment icon on the form.

Thank you,
Vikram Karety
Octigo Solutions INC