Manual Incident Creation in ServiceNow

You can manually create Incidents from alerts: a ServiceNow ITSM Incident if you are using the ITSM App, or a ServiceNow Security Incident using the SecOps App.

The fields of a manually created Incident are populated based on the Field Mapping settings of the Configuration Profile that ingested the alert. See Configure Alert Field Mapping for ITSM and SecOps Apps.

You must select Carbon Black Cloud - ServiceNow SecOps Integration or Carbon Black Cloud - ServiceNow ITSM Integration in the Select Integration To Create Incident field in the Configuration profile to create Incidents from alerts.

Incidents can only be created for alerts in an Open state.