> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# ServiceNow Change Requests

> Use ServiceNow change requests to automatically close endpoint detections tied to planned changes.

## What this integration does

Wirespeed checks recent ServiceNow change requests during endpoint triage. When an escalating endpoint detection is tied to a managed administrator user and a matching endpoint hostname, Wirespeed can recategorize it as `ENDPOINT__PLANNED_CHANGE` and auto-close it.

## Prerequisites

Before connecting ServiceNow, make sure you have:

1. A base URL that exposes the ServiceNow Table API
2. An API key that is accepted in the `apikey` request header
3. Access to the change table you want Wirespeed to query (the default is `change_request`)
4. Change requests where:
   * `cmdb_ci.name` matches the endpoint hostname in the detection
   * `assigned_to.email` matches the managed administrator user's email in Wirespeed

## Connect Wirespeed to ServiceNow

1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse)
2. Select **ServiceNow** and click **Integrate**
3. Fill in the following fields:
   * **Domain** - the full base URL for your ServiceNow instance, including any required sub-path (for example `https://instance.service-now.com` or `https://api.example.com/servicenow`)
   * **API Key** - the key Wirespeed sends in the `apikey` header
   * **Table Name** - optional; defaults to `change_request`
4. Click **Save**

<Info>
  Custom table names must use letters, numbers, and underscores only.
</Info>

## How matching works

* Wirespeed only performs the planned-change lookup for escalating endpoint verdicts
* The detection must include at least one managed administrator user with a queryable identifier
* Wirespeed queries ServiceNow using `(hostname, admin email)` pairs
* It looks for recent change requests from the last 7 days
* If `start_date` is empty, Wirespeed falls back to `sys_created_on`
* The first matching change request is used to mark the detection as a planned change

## Troubleshooting

* If validation fails, confirm the base URL includes any required sub-path and that the table name is valid
* If planned changes are not being found, verify the endpoint hostname and administrator email match the values stored on the ServiceNow change request