Trigger an impersonation start event

[Community Alums]

Can we trigger an impersonation start event when a particular group user is impersonated?

[PritamG]

yes, you can trigger an impersonation start event in ServiceNow when a user from a specific group is impersonated by:

Business Rule on syslog Table

create a before insert business rule on syslog.

Filter where message contains "Impersonation started". 

Check if the impersonated user belongs to the specific group (sys_user_grmember).

Trigger an event using gs.eventQueue(). 

[Valentin CLOUP]

Do NOT do this. Log table can have thousands of record by second in some case. You do not want any BR to run on it.

[Mark Manders]

What do you want that event to do? If you check the security center on Xanadu and later (with Yokohama being released soon, any N-1 instance will be on Xanadu+ soon), there are all kinds of security related notifications, including impersonation. 

But even before Xanadu, it is already logged, so you could already report on it.

[Community Alums]

@Mark Manders , We need to trigger a notification when "Desktop support" group member is impersonated.