Skip to main content

​
What this integration does

Wirespeed checks recent ServiceNow change requests during endpoint triage. When an escalating endpoint detection is tied to a managed administrator user and a matching endpoint hostname, Wirespeed can recategorize it as ENDPOINT__PLANNED_CHANGE and auto-close it.

​
Prerequisites

Before connecting ServiceNow, make sure you have:
  1. A base URL that exposes the ServiceNow Table API
  2. An API key that is accepted in the apikey request header
  3. Access to the change table you want Wirespeed to query (the default is change_request)
  4. Change requests where:
    • cmdb_ci.name matches the endpoint hostname in the detection
    • assigned_to.email matches the managed administrator user’s email in Wirespeed

​
Connect Wirespeed to ServiceNow

  1. Log in to Wirespeed
  2. Navigate to Integrations > Add Integration
  3. Select ServiceNow and click Integrate
  4. Fill in the following fields:
    • Domain - the full base URL for your ServiceNow instance, including any required sub-path (for example https://instance.service-now.com or https://api.example.com/servicenow)
    • API Key - the key Wirespeed sends in the apikey header
    • Table Name - optional; defaults to change_request
  5. Click Save
Custom table names must use letters, numbers, and underscores only.

​
How matching works

  • Wirespeed only performs the planned-change lookup for escalating endpoint verdicts
  • The detection must include at least one managed administrator user with a queryable identifier
  • Wirespeed queries ServiceNow using (hostname, admin email) pairs
  • It looks for recent change requests from the last 7 days
  • If start_date is empty, Wirespeed falls back to sys_created_on
  • The first matching change request is used to mark the detection as a planned change

​
Troubleshooting

  • If validation fails, confirm the base URL includes any required sub-path and that the table name is valid
  • If planned changes are not being found, verify the endpoint hostname and administrator email match the values stored on the ServiceNow change request