Before
Teams likely had to search existing tickets for a possible parent record, inspect the incident type, format the received details, and manually create the new ticket. When a parent relationship existed, the linkage also depended on the person processing the incident identifying and applying it correctly.
How it works
- Receive incident data through a webhook and retrieve existing parent tickets.
- Check whether the incident matches a parent; if it does, create a related ticket, and if it does not, classify the incident as phishing, login failure, or unknown IP.
- Format the relevant details and submit them to ServiceNow as a new trouble ticket.
Workflow details
- Webhook intake: The workflow starts when incident or request data is received through a webhook, providing the details needed for ticket processing.
- Parent-ticket lookup: It retrieves existing parent tickets and evaluates each one to determine whether the incoming incident is related to a known parent record.
- Relationship handling: When a matching parent is found, the workflow creates a new ticket associated with that parent, preserving the relationship between the records.
- Incident classification: When no parent is found, the workflow evaluates the incident type and routes phishing, login failure, and unknown IP cases through their respective message-formatting paths.
- Ticket creation: The formatted incident details are submitted to ServiceNow to create the resulting trouble ticket, with the workflow stopping if the ticket operation fails.
What changed
Parent-ticket lookup, relationship checking, incident-type routing, message formatting, and ticket creation now occur automatically from the webhook event. The resulting ticket is created with the applicable parent relationship or incident classification without requiring a person to perform the initial triage and entry sequence.
Work removed
Searching existing tickets for parent records, reviewing each parent for an incident relationship, classifying supported incident types, formatting incoming details, copying those details into a ticket, and manually creating the ServiceNow record.
Expected outcome
Each qualifying webhook event can remove at least one manual ticket-entry action while applying consistent parent and incident-type checks.
