Create synthetic monitors from incidents

Create synthetic monitors from incidents to proactively track endpoint failures and reduce repeat occurrences.

Before you begin

Role required: sn_sow_synthetics.synthetics_editor or sn_sow_synthetics.synthetics_admin

• Recommended Action for ITSM and Synthetic monitoring application is installed on your ServiceNow® instance
• The incident should have a valid configuration item (CI) and a service associated with it
• At least one execution location ( self hosted MID Server) is available and configured

About this task

This feature helps operations teams quickly assess and respond to incidents by automatically correlating incidents with the impacted business service and related Configuration Items (CIs). It provides instant visibility into all affected endpoints and clearly highlights monitoring coverage, enabling teams to understand impact, identify gaps, and take action. Administrators currently must use the Synthetic monitoring application to configure monitors. The application now recommends and enables synthetic monitor creation directly from the Incidents page, helping improve incident actionability and strengthening service resilience.

When incident analysis shows failing endpoints were not monitored, synthetic admin users access the incident and set up synthetic monitors to prevent the occurrence in the future.

While creating these synthetic monitors from a post-incident recommended action, the system automatically discovers HTTP endpoints associated with the incident's affected services. Users can select from the discovered endpoints to create monitors without manually entering URLs. The system automatically selects the mid server location based on the endpoints as part of the recommendations from incidents.

Procedure

1. Navigate to All > Service Operations Workspace, and to the incidents page.
2. Select the incident that has a valid configuration item (CI) and a service associated with the incident.
3. On the incident details page, locate the Recommendations panel.
   If Synthetic monitoring is available and there are no monitors for the affected endpoints, the Add monitors action card is displayed.

   Note:

   You must have either the administrator role or admin privileges to install the applications. If you don't, contact your system administrator to install the application.

4. Select Add monitors to open the monitor creation form.
5. Select the endpoints for which you want to create synthetic monitors.

   Synthetic Monitoring automatically selects an available MID Server as the execution location when creating monitors. To configure a default MID Server for auto-selection, set the following system property:

   sn_sow_synthetics.default_mid_location

   Note:

   Default values are configured for response code, frequency, and trigger status for an alert on the incident.
6. Select Create monitor.
   The following template is used to create synthetic monitors from Recommendations. name: autogenerated type: "single_api", interval: 5, should_create_alert: true, alert_severity: 1, method: "GET", valid_http_code: "200", valid_http_code_type: "equals", locations: The first available MID Server location is selected from available Synthetics locations of type Self hosted MID

   Note:

   If you select the same endpoints and click Create monitor again, the application prevents duplicate monitors from being created.
7. Select the link on the success message to view the monitors created in Synthetic monitoring landing page.