Well ended up opening up a HI case regarding the problem. It turns out the issue was the table sys_outbound_http_log isn't notifications enabled. Meaning you can't configure notifications for it.
So I went a different route and created the following scheduled job. It actually worked out better because it will create an incident rather than sending an email. What it does is every hour it runs and looks at the table sys_outbound_http_log for HTTP 400 errors and if it finds any it will create an incident for every 400 error it sees.
//Create query filter
var encQuery = 'response_status=400^sys_created_onONCurrent hour@javascript:gs.beginningOfCurrentHour()@javascript:gs.endOfCurrentHour()';
//Check logs to see if there are 400 Errors
var http_logs = new GlideRecord('sys_outbound_http_log');
http_logs.addEncodedQuery(encQuery);
http_logs.query();
//If results set answer to true
while(http_logs.next()){
//Create Incident Glide record
var gr = new GlideRecord('incident');
//Create Incident
gr.initialize();
gr.caller_id = 'ServiceNow svc';
gr.category = 'servicenow';
gr.subcategory = 'other_servicenow';
gr.impact = '3';
gr.urgency = '3';
gr.short_description = "HTTP 400 Errors Detected from " + http_logs.hostname;
gr.description = 'HTTP 400 errors have been detected. Please review table sys_outbound_http_log for details. \n\nTarget Hostname: ' + http_logs.hostname + '\n\nResponse Body: ' + http_logs.response_body + '\n\nRequest Body: ' + http_logs.request_body + '\n\nCreated: '+ http_logs.sys_updated_on;
gr.u_error_message = 'HTTP 400 errors detected.';
gr.u_troubleshooting_steps_taken = 'N/A I am just a script :)';
gr.insert();
}
