Інтеграція ServiceNow
OpenFactory включає disabled-by-default ServiceNow integration modules для Change Management, CMDB, Incident Management, Event Management і GRC evidence delivery. Кожен module і кожен automatic hook мають бути enabled explicitly.
Це operator integration, не image feature. Adding servicenow build feature стосується software inside image і не configure control-plane integration described here.
Prerequisites
- approved ServiceNow instance і OAuth client;
- dedicated least-privilege service account/application;
- outbound network access restricted to expected instance;
- explicit table, field, state, assignment, ownership mapping;
- stable platform-settings encryption key; and
- nonproduction ServiceNow environment for acceptance testing.
Client secret Fernet-encrypted in stored platform settings і omitted from normal responses. If platform encryption key changes or lost, stored secret cannot be decrypted and must be replaced.
Configure in layers
- Configure instance URL, client ID, secret through admin integration settings.
- Run integration health check і retain each individual check result.
- Enable one module without automatic hooks.
- Exercise manual endpoint against test record.
- Verify resulting ServiceNow record, OpenFactory linkage, idempotency, error behavior.
- Enable one automatic hook і repeat test.
Never enable every hook as first integration test.
Modules
| Module | Current surface | Important boundary |
|---|---|---|
| Change Management | Manual change request creation/status refresh, polling or webhook approval updates, live-deploy gate | Linked request does not mean approval received; map states and rejection behavior explicitly. |
| CMDB | Manual machine sync/retire plus fleet snapshots and diffs | Successful API write does not prove CI reconciliation or relationship completeness. |
| Incident Management | Manual incidents and optional drift, attestation, CVE hooks; bounded feedback actions | Incoming webhooks must be authenticated and each action independently authorized. |
| Event Management | Buffered/manual event delivery and selected build/live-state hooks | Buffers are not guaranteed audit log; monitor delivery, loss, duplicates, retry behavior. |
| GRC | Build test/attestation evidence push with configurable mapping | Technical results are evidence, not automatic control or compliance conclusion. |
All module settings and operational endpoints are administrator surfaces unless endpoint documents narrower internal consumer.
Approval safety
Before using ServiceNow to gate deployment, test:
- approved, rejected, canceled, expired, unknown, unreachable states;
- duplicate webhooks and out-of-order updates;
- HMAC validation where configured;
- polling recovery after missed webhooks;
- fail-closed behavior when policy requires approval; and
- operator recovery path that cannot bypass accountable decision silently.
Retain OpenFactory build/deploy ID and ServiceNow sys_id/number together.
Operational evidence
Monitor integration health endpoint, module-specific recent status, background task logs, buffer depth, failed deliveries, stale lifecycle findings, secrets/key rotation. Green connection test proves only checks it ran at that time.
Use sandbox instance and synthetic records for acceptance. Review exact ServiceNow ACLs, business rules, data residency, retention, licensing with instance owner before production enablement.