Configure observability agents for ServiceNow Otto

  • Release version: Australia
  • Updated May 27, 2026
  • 7 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Configure observability agents for ServiceNow Otto

    This guide explains how to configure observability agents in ServiceNow Otto for integrating third-party application performance monitoring (APM) and network performance monitoring (NPM) tools. These agents support theanalyze alert impact agentic workflow, enabling ServiceNow customers to surface detailed information from external alerts directly within the Service Operations Workspace. This integration helps improve investigation and resolution of incidents by providing enriched alert context.

    Show full answer Show less

    Connections to third-party vendors primarily use Managed Connection Provider (MCP) protocols when available, or fallback to API connections. Proper credentials and connection details are required to establish communication. Note that these observability agents differ from data sources used in Service Observability dashboards.

    Before You Begin

    • Install ServiceNow Otto for IT Operations Management (ITOM).
    • Integrate third-party alerts with Event Management.
    • Gather connection and credential requirements specific to each vendor from the provided information tables.
    • Required roles: connectionadmin and credentialadmin.

    Key Vendors and Connection Details

    The guide includes detailed connection parameters for several major vendors, each with specific agent names, connection types, data returned, required credentials, and scopes. Key vendors supported include:

    • AWS CloudWatch – via MCP server or API connection; returns alarm details, logs, metric trends, and root cause analyses.
    • Datadog – MCP server connection providing service health, traces, logs, incidents, and compliance data.
    • Dynatrace – MCP connection delivering logs, topology, root causes, and impacted entities with specific token and IAM scope requirements.
    • Google Cloud (Gemini Cloud Assist) – agent-to-agent connection offering summaries, root-cause hypotheses, and recommended actions based on Google Cloud resources.
    • Kentik – API connection for network performance, connectivity issues, DDOS detection, and anomalies.
    • LogicMonitor – API agent returning alert details, device health, CMDB associations, and root cause analysis with verdicts.
    • Microsoft Azure – MCP connection providing alert details, resource health, logs, and metric trends; requires Azure MCP server deployment.
    • New Relic – MCP server connection focused on service/user impact and root cause theories.
    • Prometheus – API connection for querying metrics, alerts, and scrape target health.
    • SolarWinds – API connection delivering node health, network metrics, alerts, and trend analysis for root cause investigation.
    • Splunk – MCP server agent providing SPL query results, metadata, and investigation findings.
    • ThousandEyes – MCP server connection offering network test metrics, anomalies, outages, path visualizations, and root cause analysis.

    Practical Configuration Steps

    1. Go to All > sysalias.LIST in ServiceNow.
    2. Search for the relevant vendor connection alias as per the vendor tables.
    3. Select Create New Connection & Credential.
    4. Complete the form using the vendor-specific connection URL, credentials, and scope information.
    5. Click Create to save the connection.
    6. The configured agents become immediately available for use by the analyze alert impact agentic workflow.

    Why This Matters

    By configuring these observability agents, ServiceNow customers can enhance their ITOM and incident management processes. The integration enables automated, AI-driven analysis of third-party alerts with enriched context, root cause insights, and actionable recommendations, all surfaced within ServiceNow's Service Operations Workspace. This improves operational efficiency and accelerates incident resolution.

    Configure observability agents for third-party application performance monitoring (APM) or network performance monitoring (NPM) vendors. These agents are invoked by the analyze alert impact agentic workflow. You must configure connections to those vendors before they can be invoked.

    Important:
    This AI agent is turned on by default. For more information, see Now Assist skills, agents, and agentic workflows on by default.

    After you configure the agent(s), they can surface information from alerts generated by third-party systems to help you investigate alerts and incidents in the Service Operations Workspace.

    Connections to vendors use MCP when possible, otherwise they use an API connection. You need connection and credential information to complete the connection process as shown in the following tables.

    Note:
    These agents are different from the data sources used in the Service Observability dashboards.

    Before you begin

    Before configuring the integration agents, you must do the following:

    Role required: connection_admin and credential_admin

    AWS CloudWatch MCP

    Connection information Value
    Agent name AWS CloudWatch MCP Server Agent
    Overview of data returned Alarm details, metric trend analysis, CloudWatch logs (anomalies, error patterns, log insights queries), CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps
    Credential & Connection Alias name AWS CloudWatch MCP server
    Connection type MCP
    Returned data type APM
    Connection URL

    https://your-mcp-server-host/mcp

    This assumes you have deployed the CloudWatch MCP server using a MID Server instead of a publicly exposed EC2 instance. For more information about deploying the MCP server, see the AWS CloudWatch MCP Server — MID Server Deployment Guide [KB3030674] article in the Now Support Knowledge Base.
    Required credentials
    • AWS access key ID
    • AWS secret access key
    Required scope

    AWS IAM permissions:

    • cloudwatch:Describe*
    • cloudwatch:Get*
    • cloudwatch:List*
    • logs:Describe*
    • logs:Get*
    • logs:StartQuery
    • logs:StopQuery
    • logs:GetQueryResults

    AWS CloudWatch API

    Connection information Value
    Agent name AWS CloudWatch API Agent
    Overview of data returned Alarm details, metric trend analysis, CloudWatch logs (anomalies, error patterns, log insights queries), CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps
    Credential & Connection Alias name AWS CloudWatch API Credentials
    Connection type API (MCP fallback mechanism)
    Returned data type APM
    Connection URL N/A
    Credential type AWS Credentials
    Authentication algorithm AWS CloudWatch Algorithm
    Required credentials
    • AWS access key ID
    • AWS secret access key
    Required scope

    AWS IAM permissions:

    • cloudwatch:Describe*
    • cloudwatch:Get*
    • cloudwatch:List*
    • logs:Describe*
    • logs:Get*
    • logs:StartQuery
    • logs:StopQuery
    • logs:GetQueryResults

    Datadog

    Connection information Value
    Agent name Datadog APM MCP Server Agent
    Overview of data returned Service health, distributed traces, triggered monitors, log analysis, incidents, SLO compliance, deployment events, and service dependencies
    Credential & Connection Alias name Datadog APM MCP Connection
    Connection type MCP
    Returned data type APM
    Connection URL https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core,alerting,apm,error-tracking
    Required credentials
    • Datadog API key
    • Datadog application key
    Required scope
    • mcp_read
    • apm_read
    • timeseries_query
    • dashboards_read
    • logs_read_data
    • logs_read_index_data
    • user_access_read
    • apm_service_catalog_read
    • teams_read
    • slos_read
    • metrics_read
    • cloud_cost_management_read
    • incident_read
    • monitors_read

    Dynatrace

    Connection information Value
    Agent name Dynatrace MCP Server Agent
    Overview of data returned Insights about logs, topology, recent changes, root causes, impacted entities, and environments.
    Credential & Connection Alias name Dynatrace MCP server
    Connection type MCP
    Returned data type APM
    Connection URL

    URL of your Dynatrace instance. Dynatrace URLs follow this format:

    https://<your-resource-name>.apps.dynatrace.com/platform-reserved/mcp-gateway/v0.1/servers/dynatrace-mcp/mcp
    Required credentials Platform token (must be prefixed with Bearer). For example, Bearer dt0s01.STABCDEF12345.G3HIJKLMNOP.
    Required scope

    IAM policy and group assignment that allows the following scopes:

    • davis-copilot:nl2dql:execute
    • davis-copilot:dql2nl:execute
    • davis-copilot:conversations:execute
    • davis:analyzers:read
    • davis:analyzers:execute
    • mcp-gateway:servers:invoke
    • mcp-gateway:servers:read
    • storage:buckets:read
    • storage:logs:read
    • storage:events:read
    • storage:security.events:read
    • storage:metrics:read
    • storage:bizevents:read
    • storage:spans:read
    • storage:entities:read
    • storage:smartscape:read
    • storage:system:read
    Required Dynatrace Intelligence settings
    • Enable generative AI
    • Enable document suggestions
    • Enable environment-aware queries

    Google Cloud

    Note:
    Before configuring this connection, create a keystore file by following the steps in Create a Java KeyStore certificate.
    Connection information Value
    Agent name Gemini Cloud Assist A2A Investigation Agent
    Overview of data returned Summary, findings, root-cause hypotheses, next steps, impact on affected Google Cloud resources, ownership, recommended actions, supporting evidence, and sources
    Credential & Connection Alias name Google Gemini Cloud Assist Agent
    Connection type Agent-to-agent
    Returned data type APM
    Required credentials
    • Google Project ID
    • Service Account Email
    • Private Key ID
    • Keystore Password
    • Keystore file (.jks)
    Required scope Google Cloud IAM permissions:
    • Assign the Investigation Creator role to the service account
    • Give the service account read-access to the resources that you want it to investigate
    Required Google Cloud settings
    • Enable the required APIs for your Google Cloud project: logging.googleapis.com, monitoring.googleapis.com, cloudresourcemanager.googleapis.com, and geminicloudassist
    • Gemini Cloud Assist must be set up in the Google Cloud project

    Kentik

    Connection information Value
    Agent name Kentik analysis AI agent
    Overview of data returned Service network performance, connectivity, DDOS attacks, and anomalies
    Credential & Connection Alias name Kentik analysis AI agent
    Connection type API
    Returned data type APM
    Connection URL

    URL of your Kentik instance. Kentik URLs follow this format:

    https://<your-resource-name>.api.kentik.com
    Required credentials
    • User email
    • API token
    Required scope Can view devices

    LogicMonitor

    Connection information Value
    Agent name LogicMonitor API Agent
    Overview of data returned Alert details, metric trend analysis, device properties and classification, collector health, SDT/maintenance windows, related entity topology, CMDB service associations, recent ServiceNow Change records, top processes, and root cause analysis with verdict (degraded / healthy / cleared-and-sustained / likely-false-positive / inconclusive) and recommended next steps.
    Credential & Connection Alias name LogicMonitor API connection
    Connection type API
    Returned data type APM
    Connection URL

    https://<account>.logicmonitor.com/santaba/rest

    Replace <account> with your LogicMonitor portal subdomain.
    Required credentials API bearer token: An LMv2 personal access token
    Required scope LogicMonitor API v3 read-only access: Devices (view), Alerts (view), Dashboards/Metrics (view), Collectors (view), SDTs (view), Device Groups (view). The API token inherits the creating user's role. Any user with the default read only or administrator role has sufficient access.

    Microsoft Azure

    Connection information Value
    Agent name Azure Monitor MCP Agent
    Overview of data returned Alert details, resource health status, activity logs, Log Analytics query results, metric trend analysis, CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps
    Credential & Connection Alias name Azure Monitor MCP Connection
    Connection type MCP
    Returned data type APM
    Connection URL http://<your-azure-mcp-server>
    Required credentials
    • Azure connection URL
    • Azure username
    • Azure password
    Required scope
    • Reader role on target Azure subscriptions
    • Log Analytics Reader role on target Log Analytics workspaces
    Required Microsoft Azure settings
    • Microsoft Azure MCP Server must be deployed and reachable
    • Log Analytics workspaces must exist in the target subscription
    • Azure Monitor must be enabled for target resources

    New Relic

    Connection information Value
    Agent name New Relic MCP Server Agent
    Overview of data returned Service and user impact, root cause theories, and responsible teams.
    Credential & Connection Alias name New Relic MCP Connection
    Connection type MCP
    Returned data type APM
    Connection URL https://mcp.newrelic.com/mcp/
    Required credentials

    API key (also known as "User Key")

    Header name: api-key
    Required scope N/A

    Prometheus

    Connection information Value
    Agent name Prometheus API Agent
    Overview of data returned PromQL metric queries (CPU, memory, disk, network), active alerts, alert rule definitions, and scrape target health
    Credential & Connection Alias name Prometheus connection
    Connection type API
    Returned data type APM
    Connection URL https://<your-onprem-prometheus-server>
    Required credentials
    • MID Server Prometheus is installed on
    • User name (for outbound connection)
    • Password (for outbound connection)
    Required scope N/A

    SolarWinds

    Connection information Value
    Agent name SolarWinds analysis AI agent
    Overview of data returned On-premises data from SolarWinds Orion: node health/status, CPU/memory, packet loss/latency, interface utilization/errors/discards, active alerts/history, affected entities/services, and trend/baseline metrics used for root-cause investigation
    Credential & Connection Alias name SolarWinds AI Agent
    Connection type API
    Returned data type NPM
    Connection URL https://<your-onprem-solarwinds-server>
    Required credentials
    • MID Server SolarWinds is installed on
    • User name
    • Password
    Required scope SolarWinds Orion API/SWQL read access (NPM/APM) via MID Server

    Splunk

    Connection information Value
    Agent name Splunk MCP Server Agent
    Overview of data returned SPL query results from Splunk indexes, index/sourcetype metadata, and structured investigation findings including affected entities, root cause analysis, and recommended actions
    Credential & Connection Alias name Splunk MCP Connection
    Connection type MCP
    Returned data type APM
    Connection URL https://<your-splunk-instance>.splunkcloud.com
    Required credentials Splunk MCP token
    Required scope

    For Splunk token generation:

    • mcp_user role (or any role with mcp_tool_execute) required for all MCP tool calls
    • Search capability and read access to the relevant indexes for running queries
    • Knowledge object read permissions for Get Knowledge Objects
    • Token must be generated using the Splunk MCP Server app with audience = mcp (not a standard Splunk API token)

    ThousandEyes

    Connection information Value
    Agent name ThousandEyes MCP Server Agent
    Overview of data returned Test configuration and status, aggregated metrics (response time, packet loss, latency, jitter, throughput, availability), metric anomalies with deviation analysis, network events and routing changes, ISP/network outages with provider and ASN details, hop-by-hop path visualization, and root cause analysis with ranked probable causes and recommended next steps
    Credential & Connection Alias name ThousandEyes MCP Connection
    Connection type MCP
    Returned data type NPM
    Connection URL https://api.thousandeyes.com/mcp
    Required credentials API key prefixed with Bearer. For example, Bearer <api-key>.
    Required scope ThousandEyes API access with permissions to read tests, metrics, anomalies, events, outages, and path visualization data

    Procedure

    1. Navigate to All > sys_alias.LIST.
    2. Search for and select the vendor's connection name as shown in the preceding tables.
    3. Select Create New Connection & Credential.
    4. Fill in the form, using the information in the preceding tables.
    5. Select Create.

      Your connection appears in the Connections tab.

    The agents are now ready to be used by the analyze alert impact agentic workflow