---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Configure observability agents for ServiceNow Otto

# Configure observability agents for ServiceNow Otto {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Configure observability agents for ServiceNow Otto

This guide explains how to configure observability agents within ServiceNow Otto to integrate third-party application performance monitoring (APM) and network performance monitoring (NPM) tools.
These agents support theanalyze alert impact agentic workflowand theAIOps AI specialist, enabling enhanced alert and incident investigation in the Service Operations Workspace by surfacing data from third-party alerts.
Show full answer Show less  
Connections primarily use the Managed Cloud Platform (MCP) protocol or fallback to API connections, requiring specific credentials and connection details for each vendor.

## Before You Begin

* Install ServiceNow Otto for IT Operations Management (ITOM).
* Integrate third-party alerts with Event Management.
* Gather connection and credential requirements for the chosen vendor(s) as detailed in the vendor-specific tables.
* Ensure you have the **connectionadmin** and **credentialadmin** roles to configure connections.

## Vendor Agent Configuration Highlights

Each vendor agent requires specific connection URLs, credential types, scopes, and returned data types, summarized as follows:

* **AWS CloudWatch MCP Agent:** Uses MCP via a MID Server; returns alarm details, logs, and root cause analysis. Requires AWS access keys and IAM permissions.
* **AWS CloudWatch API Agent:** API fallback option with similar data returned; requires AWS credentials.
* **Datadog APM MCP Server Agent:** Provides service health, traces, incidents, and SLO compliance; requires Datadog API and application keys with specific read scopes.
* **Dynatrace MCP Server Agent:** Offers logs, topology, root causes, and impacted entities; requires a bearer token and specific IAM scopes.
* **Google Cloud Gemini Cloud Assist Agent:** Delivers investigation summaries and root-cause hypotheses; requires Google Cloud IAM roles, service account credentials, and enabled APIs.
* **Kentik Analysis AI Agent:** Focuses on network performance, connectivity, and anomalies; requires user email and API token.
* **LogicMonitor API Agent:** Returns alert details, device metrics, and root cause with verdicts; requires API bearer token and read-only access scopes.
* **Microsoft Azure Monitor MCP Agent:** Provides alert and resource health, logs, and root cause analysis; requires Azure credentials, deployed MCP Server, and appropriate permissions.
* **New Relic MCP Server Agent:** Gives service impact and root cause theories; requires API key.
* **Prometheus API Agent:** Supports PromQL queries and alert data; requires MID Server and credentials for outbound access.
* **SolarWinds Analysis AI Agent:** Offers on-premises network and node health metrics; requires MID Server and user credentials.
* **Splunk MCP Server Agent:** Returns SPL query results and structured investigation findings; requires MCP token with specific roles and permissions.
* **ThousandEyes MCP Server Agent:** Provides network test metrics, anomalies, routing changes, and root cause analysis; requires API key with read permissions.

## Configuration Procedure

1. Navigate to **All \> sysalias.LIST** in ServiceNow.
2. Search for and select the desired vendor's connection alias as identified in the vendor tables.
3. Click **Create New Connection \& Credential**.
4. Complete the form using the vendor-specific connection URLs, credential types, and required scopes.
5. Click **Create** to save the connection.
6. The configured agents become available for use within the **analyze alert impact agentic workflow** and related AI workflows.

## Practical Benefits for ServiceNow Customers

By configuring these agents, customers can enrich alert and incident investigations with detailed telemetry and root cause insights sourced from integrated third-party monitoring tools. This integration streamlines operational workflows, improves incident response, and leverages AI capabilities within ServiceNow Otto to reduce mean time to resolution (MTTR).  
Configure observability agents for third-party application performance monitoring (APM) or network performance monitoring (NPM) vendors. These agents are used by the analyze alert impact agentic workflow and the AIOps AI specialist.  
Important:  
This AI agent is turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).

After you configure the agent(s), they can surface information from alerts generated by third-party systems to help you investigate alerts and incidents in the Service Operations Workspace.

Connections to vendors use MCP when possible, otherwise they use an API connection. You need connection and credential information to complete the connection process as shown in the following tables.  
Note:  
These agents are different from the data sources used in the Service Observability dashboards.

## Before you begin {#configure-integration-agents-for-now-assist__section_rdf_mqh_gjc}

Before configuring the integration agents, you must do the following:

* [Install ServiceNow Otto for IT Operations Management (ITOM)](https://www.servicenow.com/docs/access?context=install-now-assist-feature-plugins&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).
* [Integrate third-party alerts with Event Management](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2113973).
* Copy the connection requirements for the vendor as noted in the following tables. You will need these to create credentials and connections to the third-party vendor.
{#configure-integration-agents-for-now-assist__ul_ejl_kwv_w2c}

Role required: connection_admin and credential_admin

## AWS CloudWatch MCP {#configure-integration-agents-for-now-assist__section_lsf_zqh_gjc}

{#configure-integration-agents-for-now-assist__table_i2t_5th_gjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | AWS CloudWatch MCP Server Agent |
| Overview of data returned | Alarm details, metric trend analysis, CloudWatch logs (anomalies, error patterns, log insights queries), CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps |
| Credential \& Connection Alias name | AWS CloudWatch MCP server |
| Connection type | MCP |
| Returned data type | APM |
| Connection URL | `https://your-mcp-server-host/mcp` This assumes you have deployed the CloudWatch MCP server using a MID Server instead of a publicly exposed EC2 instance. For more information about deploying the MCP server, see the [AWS CloudWatch MCP Server --- MID Server Deployment Guide \[KB3030674\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3030674) article in the Now Support Knowledge Base. |
| Required credentials | * AWS access key ID * AWS secret access key |
| Required scope | AWS IAM permissions: * `cloudwatch:Describe*` * `cloudwatch:Get*` * `cloudwatch:List*` * `logs:Describe*` * `logs:Get*` * `logs:StartQuery` * `logs:StopQuery` * `logs:GetQueryResults` |
[ ]

{#configure-integration-agents-for-now-assist__table_i2t_5th_gjc}

## AWS CloudWatch API {#configure-integration-agents-for-now-assist__section_aws_api_gjc}

{#configure-integration-agents-for-now-assist__table_aws_api_gjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | AWS CloudWatch API Agent |
| Overview of data returned | Alarm details, metric trend analysis, CloudWatch logs (anomalies, error patterns, log insights queries), CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps |
| Credential \& Connection Alias name | AWS CloudWatch API Credentials |
| Connection type | API (MCP fallback mechanism) |
| Returned data type | APM |
| Connection URL | N/A |
| Credential type | AWS Credentials |
| Authentication algorithm | AWS CloudWatch Algorithm |
| Required credentials | * AWS access key ID * AWS secret access key |
| Required scope | AWS IAM permissions: * `cloudwatch:Describe*` * `cloudwatch:Get*` * `cloudwatch:List*` * `logs:Describe*` * `logs:Get*` * `logs:StartQuery` * `logs:StopQuery` * `logs:GetQueryResults` |
[ ]

{#configure-integration-agents-for-now-assist__table_aws_api_gjc}

## Datadog {#configure-integration-agents-for-now-assist__section_xpq_1rh_gjc}

{#configure-integration-agents-for-now-assist__table_usq_mvh_gjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | Datadog APM MCP Server Agent |
| Overview of data returned | Service health, distributed traces, triggered monitors, log analysis, incidents, SLO compliance, deployment events, and service dependencies |
| Credential \& Connection Alias name | Datadog APM MCP Connection |
| Connection type | MCP |
| Returned data type | APM |
| Connection URL | `https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core,alerting,apm,error-tracking` |
| Required credentials | * Datadog API key * Datadog application key |
| Required scope | * `mcp_read` * `apm_read` * `timeseries_query` * `dashboards_read` * `logs_read_data` * `logs_read_index_data` * `user_access_read` * `apm_service_catalog_read` * `teams_read` * `slos_read` * `metrics_read` * `cloud_cost_management_read` * `incident_read` * `monitors_read` {#configure-integration-agents-for-now-assist__ul_s5w_h5z_1kc} |
[ ]

{#configure-integration-agents-for-now-assist__table_usq_mvh_gjc}

## Dynatrace {#configure-integration-agents-for-now-assist__section_ky2_brh_gjc}

{#configure-integration-agents-for-now-assist__table_hvw_mvh_gjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | Dynatrace MCP Server Agent |
| Overview of data returned | Insights about logs, topology, recent changes, root causes, impacted entities, and environments. |
| Credential \& Connection Alias name | Dynatrace MCP server |
| Connection type | MCP |
| Returned data type | APM |
| Connection URL | URL of your Dynatrace instance. Dynatrace URLs follow this format: `https://<your-resource-name>.apps.dynatrace.com/platform-reserved/mcp-gateway/v0.1/servers/dynatrace-mcp/mcp` |
| Required credentials | Platform token (must be prefixed with `Bearer`). For example, `Bearer dt0s01.STABCDEF12345.G3HIJKLMNOP`. |
| Required scope | IAM policy and group assignment that allows the following scopes: * `davis-copilot:nl2dql:execute` * `davis-copilot:dql2nl:execute` * `davis-copilot:conversations:execute` * `davis:analyzers:read` * `davis:analyzers:execute` * `mcp-gateway:servers:invoke` * `mcp-gateway:servers:read` * `storage:buckets:read` * `storage:logs:read` * `storage:events:read` * `storage:security.events:read` * `storage:metrics:read` * `storage:bizevents:read` * `storage:spans:read` * `storage:entities:read` * `storage:smartscape:read` * `storage:system:read` |
| Required Dynatrace Intelligence settings | * Enable generative AI * Enable document suggestions * Enable environment-aware queries |
[ ]

{#configure-integration-agents-for-now-assist__table_hvw_mvh_gjc}

## Google Cloud {#configure-integration-agents-for-now-assist__section_hqq_xqz_1kc}

Note:  
Before configuring this connection, create a keystore file by following the steps in [Create a Java KeyStore certificate](https://www.servicenow.com/docs/access?context=setup-google-translator&version=australia&pubname=australia-integrate-applications&section=create-jks-google&ft:locale=en-US).
{#configure-integration-agents-for-now-assist__table_iqq_xqz_1kc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | Gemini Cloud Assist A2A Investigation Agent |
| Overview of data returned | Summary, findings, root-cause hypotheses, next steps, impact on affected Google Cloud resources, ownership, recommended actions, supporting evidence, and sources |
| Credential \& Connection Alias name | Google Gemini Cloud Assist Agent |
| Connection type | Agent-to-agent |
| Returned data type | APM |
| Required credentials | * Google Project ID * Service Account Email * Private Key ID * Keystore Password * Keystore file (`.jks`) {#configure-integration-agents-for-now-assist__ul_q1m_qrz_1kc} |
| Required scope | Google Cloud IAM permissions: * Assign the Investigation Creator role to the service account * Give the service account read-access to the resources that you want it to investigate {#configure-integration-agents-for-now-assist__ul_ggz_yrz_1kc} |
| Required Google Cloud settings | * Enable the required APIs for your Google Cloud project: `logging.googleapis.com`, `monitoring.googleapis.com`, `cloudresourcemanager.googleapis.com`, and `geminicloudassist` * Gemini Cloud Assist must be set up in the Google Cloud project {#configure-integration-agents-for-now-assist__ul_hdc_bsz_1kc} |
[ ]

{#configure-integration-agents-for-now-assist__table_iqq_xqz_1kc}

## Kentik {#configure-integration-agents-for-now-assist__section_yhd_crh_gjc}

{#configure-integration-agents-for-now-assist__table_y2j_nvh_gjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | Kentik analysis AI agent |
| Overview of data returned | Service network performance, connectivity, DDOS attacks, and anomalies |
| Credential \& Connection Alias name | Kentik analysis AI agent |
| Connection type | API |
| Returned data type | APM |
| Connection URL | URL of your Kentik instance. Kentik URLs follow this format: `https://<your-resource-name>.api.kentik.com` |
| Required credentials | * User email * API token |
| Required scope | Can view devices |
[ ]

{#configure-integration-agents-for-now-assist__table_y2j_nvh_gjc}

## LogicMonitor {#configure-integration-agents-for-now-assist__section_ubw_mql_rjc}

{#configure-integration-agents-for-now-assist__table_vbw_mql_rjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | LogicMonitor API Agent |
| Overview of data returned | Alert details, metric trend analysis, device properties and classification, collector health, SDT/maintenance windows, related entity topology, CMDB service associations, recent ServiceNow Change records, top processes, and root cause analysis with verdict (degraded / healthy / cleared-and-sustained / likely-false-positive / inconclusive) and recommended next steps. |
| Credential \& Connection Alias name | LogicMonitor API connection |
| Connection type | API |
| Returned data type | APM |
| Connection URL | `https://<account>.logicmonitor.com/santaba/rest ` Replace `<account>` with your LogicMonitor portal subdomain. |
| Required credentials | API bearer token: An LMv2 personal access token. Prefix the token with `Bearer` followed by a space, for example, `Bearer <your_token>`. |
| Required scope | LogicMonitor API v3 read-only access: Devices (view), Alerts (view), Dashboards/Metrics (view), Collectors (view), SDTs (view), Device Groups (view). The API token inherits the creating user's role. Any user with the default read only or administrator role has sufficient access. |
[ ]

{#configure-integration-agents-for-now-assist__table_vbw_mql_rjc}

## Microsoft Azure {#configure-integration-agents-for-now-assist__section_eb3_m4z_1kc}

{#configure-integration-agents-for-now-assist__table_pry_z4z_1kc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | Azure Monitor MCP Agent |
| Overview of data returned | Alert details, resource health status, activity logs, Log Analytics query results, metric trend analysis, CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps |
| Credential \& Connection Alias name | Azure Monitor MCP Connection |
| Connection type | MCP |
| Returned data type | APM |
| Connection URL | `http://<your-azure-mcp-server>` |
| Required credentials | * Azure connection URL * Azure username * Azure password {#configure-integration-agents-for-now-assist__ul_sc3_kpz_1kc} |
| Required scope | * Reader role on target Azure subscriptions * Log Analytics Reader role on target Log Analytics workspaces {#configure-integration-agents-for-now-assist__ul_kwd_4pz_1kc} |
| Required Microsoft Azure settings | * Microsoft Azure MCP Server must be deployed and reachable * Log Analytics workspaces must exist in the target subscription * Azure Monitor must be enabled for target resources {#configure-integration-agents-for-now-assist__ul_fw3_4pz_1kc} |
[ ]

{#configure-integration-agents-for-now-assist__table_pry_z4z_1kc}

## New Relic {#configure-integration-agents-for-now-assist__section_hp4_drh_gjc}

{#configure-integration-agents-for-now-assist__table_a14_nvh_gjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | New Relic MCP Server Agent |
| Overview of data returned | Service and user impact, root cause theories, and responsible teams. |
| Credential \& Connection Alias name | New Relic MCP Connection |
| Connection type | MCP |
| Returned data type | APM |
| Connection URL | `https://mcp.newrelic.com/mcp/` |
| Required credentials | API key (also known as "User Key") Header name: `api-key` |
| Required scope | N/A |
[ ]

{#configure-integration-agents-for-now-assist__table_a14_nvh_gjc}

## Prometheus {#configure-integration-agents-for-now-assist__section_xf5_hrh_gjc}

{#configure-integration-agents-for-now-assist__table_e4t_nvh_gjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | Prometheus API Agent |
| Overview of data returned | PromQL metric queries (CPU, memory, disk, network), active alerts, alert rule definitions, and scrape target health |
| Credential \& Connection Alias name | Prometheus connection |
| Connection type | API |
| Returned data type | APM |
| Connection URL | `https://<your-onprem-prometheus-server>` |
| Required credentials | * MID Server Prometheus is installed on * User name (for outbound connection) * Password (for outbound connection) |
| Required scope | N/A |
[ ]

{#configure-integration-agents-for-now-assist__table_e4t_nvh_gjc}

## SolarWinds {#configure-integration-agents-for-now-assist__section_fkp_frh_gjc}

{#configure-integration-agents-for-now-assist__table_fhy_nvh_gjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | SolarWinds analysis AI agent |
| Overview of data returned | On-premises data from SolarWinds Orion: node health/status, CPU/memory, packet loss/latency, interface utilization/errors/discards, active alerts/history, affected entities/services, and trend/baseline metrics used for root-cause investigation |
| Credential \& Connection Alias name | SolarWinds AI Agent |
| Connection type | API |
| Returned data type | NPM |
| Connection URL | `https://<your-onprem-solarwinds-server>` |
| Required credentials | * MID Server SolarWinds is installed on * User name * Password |
| Required scope | SolarWinds Orion API/SWQL read access (NPM/APM) via MID Server |
[ ]

{#configure-integration-agents-for-now-assist__table_fhy_nvh_gjc}

## Splunk {#configure-integration-agents-for-now-assist__section_fgp_2rh_gjc}

{#configure-integration-agents-for-now-assist__table_ghd_4vh_gjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | Splunk MCP Server Agent |
| Overview of data returned | SPL query results from Splunk indexes, index/sourcetype metadata, and structured investigation findings including affected entities, root cause analysis, and recommended actions |
| Credential \& Connection Alias name | Splunk MCP Connection |
| Connection type | MCP |
| Returned data type | APM |
| Connection URL | `https://<your-splunk-instance>.splunkcloud.com` |
| Required credentials | Splunk MCP token |
| Required scope | For Splunk token generation: * `mcp_user` role (or any role with `mcp_tool_execute`) required for all MCP tool calls * Search capability and read access to the relevant indexes for running queries * Knowledge object read permissions for Get Knowledge Objects * Token must be generated using the Splunk MCP Server app with `audience = mcp` (not a standard Splunk API token) |
[ ]

{#configure-integration-agents-for-now-assist__table_ghd_4vh_gjc}

## ThousandEyes {#configure-integration-agents-for-now-assist__section_xmk_krh_gjc}

{#configure-integration-agents-for-now-assist__table_qwj_4vh_gjc__entry__2}

| Connection information | Value |
|-|-|
| Agent name | ThousandEyes MCP Server Agent |
| Overview of data returned | Test configuration and status, aggregated metrics (response time, packet loss, latency, jitter, throughput, availability), metric anomalies with deviation analysis, network events and routing changes, ISP/network outages with provider and ASN details, hop-by-hop path visualization, and root cause analysis with ranked probable causes and recommended next steps |
| Credential \& Connection Alias name | ThousandEyes MCP Connection |
| Connection type | MCP |
| Returned data type | NPM |
| Connection URL | `https://api.thousandeyes.com/mcp` |
| Required credentials | API key prefixed with `Bearer`. For example, `Bearer <api-key>`. |
| Required scope | ThousandEyes API access with permissions to read tests, metrics, anomalies, events, outages, and path visualization data |
[ ]

{#configure-integration-agents-for-now-assist__table_qwj_4vh_gjc}

## Procedure {#configure-integration-agents-for-now-assist__section_kxn_lrh_gjc}

1. Navigate to Allsys_alias.LIST.
2. Search for and select the vendor's connection name as shown in the preceding tables.
3. Select Create New Connection \& Credential.
4. Fill in the form, using the information in the preceding tables.
5. Select Create.

   Your connection appears in the Connections tab.
{#configure-integration-agents-for-now-assist__ol_eks_rrh_gjc}

The agents are now ready to be used by the [analyze alert impact agentic workflow](https://www.servicenow.com/docs/52wLj6WmDNfWtdSt0anG3Q "Use the analyze alert impact agentic workflow to investigate an alert and get the context that you need to respond efficiently.").

*[\>]: and then