Version 3.0.0 of the ServiceNow App updates to the Alert Forwarder Schema v2.0.

If you are ingesting Alerts using the Data Forwarder and AWS S3 option then the Carbon Black Cloud Data Forwarder Configuration must be updated to the Alert Forwarder Schema v2.0.

ServiceNow does not successfully ingest the Forwarder Alert Schema 1.0.

Prerequisites

Deactivate all Configuration Profiles and verify that no alerts are being ingested.

If profiles are not deactivated, then ServiceNow will automatically stop the alert ingestion during the upgrade and restart after the upgrade is complete Manually stopping ingest is recommended to reduce the likelihood of issues occurring during the upgrade.

Procedure

  1. In the Carbon Black Cloud console, go to Carbon Black Cloud > Settings > Data Forwarders.
  2. Locate the Data Forwarder that is being used by ServiceNow.
  3. Click the Pencil icon pencil icon to edit the Data Forwarder.
  4. Change the Schema selection to 2.0.0.
  5. Click Save.
  6. Upgrade the ServiceNow app.
  7. Verify that alerts are being ingested correctly.