Tracelight
All integrations
ServiceNow integration

OSINT alerts as ServiceNow incidents.

Enterprise SOCs running ITSM-style alert + incident workflows in ServiceNow can route Tracelight events into Incident records via Flow Designer + the generic webhook integration. Each Tracelight alert becomes an incident with severity mapped, priority assigned, and owner routed.

What's in this integration

  • Direct ServiceNow integration via Flow Designer + Inbound REST endpoint
  • Map alert.fired → ServiceNow Incident creation
  • Severity translates: Tracelight critical → ServiceNow P1, high → P2, etc.
  • HMAC signature verification at the Flow level for tamper-proof receipt
  • Cross-reference Tracelight case ID in ServiceNow custom field for round-trip context

Setup

  1. 1
    ServiceNow → System Web Services → Scripted REST APIs → create endpoint
  2. 2
    Tracelight → Dashboard → Integrations → New webhook → Kind: generic_json → URL = your ServiceNow Scripted REST endpoint
  3. 3
    Set HMAC secret on both sides for verification
  4. 4
    In ServiceNow Flow Designer, parse payload → create Incident
  5. 5
    Test from Tracelight; check ServiceNow Incidents list for the new record

Events you can subscribe to

alert.firedmonitor.matchcase.created

See the full event payload schemas at /zapier + /docs.

Wire it up.

Sign up, head to Dashboard → Integrations, and turn this on in 60 seconds.

Start free trial Configure now
Other integrations
Slack
Native OAuth bot + /tracelight slash command + alert notifications routed to channels of your choice.
Zapier
Wire Tracelight events into 6,000+ Zapier-connected apps. HMAC-signed webhooks make Zaps tamper-proof.
Discord
Channel webhook for alert digests + per-event notifications. SSRF-guarded outbound dispatch.
Microsoft Teams
Adaptive Card alerts in any Teams channel via incoming-webhook URL. Works with both classic O365 connectors and the new Workflows.
Notion
Pipe Tracelight events into a Notion database — auto-log every case, alert, or report into your team workspace.
Linear
Auto-create Linear issues for high-severity Tracelight alerts. Useful for teams running investigations like an engineering project.
HubSpot
Sync Tracelight cases + alerts into HubSpot CRM as deal records, contacts, or activity timeline entries.
Salesforce
Tracelight events → Salesforce Cases or custom objects via Flow Builder + the generic webhook integration.
Splunk
Stream Tracelight audit events + alerts into Splunk via HEC. Useful for SOCs running Tracelight as one of many investigation feeds.
Datadog
Tracelight alerts → Datadog events. Use Datadog's monitor language to set up follow-on alerting on Tracelight signals.
Jira
Auto-create Jira issues from high-severity Tracelight alerts. Useful for SOC + investigation teams running case management in Jira.
GitHub
Auto-open GitHub issues from Tracelight alerts. Useful for security teams running incident response in Issues + Projects.
Asana
Auto-create Asana tasks from Tracelight alerts + cases. Useful for investigation teams running case management in Asana.
ClickUp
Tracelight events → ClickUp tasks. For teams running case management in ClickUp.
Microsoft 365
Tracelight events into Microsoft 365 — Outlook calendar holds for incidents, OneDrive report archival, Power Automate flows.
Trello
Tracelight events → Trello cards. For investigation teams running Kanban-style case management.
Calendly
Auto-schedule investigator follow-up calls when high-severity alerts fire. Useful for client-facing PI shops.
Generic webhooks
Subscribe any HTTPS endpoint to Tracelight events. HMAC-SHA256 signing. SSRF-safe. Zero glue.