Skip to main content

Define Parameters

General​

Perform the following steps to define general parameters for the Add-On:

Step 1 – Navigate to your add-on folder and select the ITSMSettings.xml file.

Step 2 – Define general parameters such as Auditor connection parameters, the number of tickets the service can create per hour, ability to reopen closed tickets, etc. Most parameters have default values.

Step 3 – Provide new values as follows: <parameter>value</parameter>. You can skip or define parameters depending on your execution scenario and security policies.

ParameterDefault valueDescription
Connection to Netwrix Auditor
NetwrixAuditorHostlocalhost:9699- The add-on runs on the computer where the Auditor Server resides and uses the default Integration API port 9699. To specify a non-default port, provide a new port number (e.g., https://localhost:8788). - The add- on must always run locally, on the computer where the Auditor Server resides.
NetwrixAuditorUserNameCurrent user credentialsUnless specified, the add-on runs under the LocalSystem account. If you want the add-on to use another account to connect to the Auditor Server, specify the account name in the DOMAIN\username format. Alternatively, after deploying the Netwrix Auditor ITSM Integration Service service, specify an account in its properties. The account must be assigned the Global reviewer role in the Auditor or be a member of the Netwrix AuditorAdministrators group. The user must have sufficient permissions to create files on the computer.
NetwrixAuditorPassword–Provide a password for the account. Unless you specify an account, the service runs under the LocalSystem account and doesn't require a password.
TicketFloodLimit10Specify the maximum number of standalone tickets the service can create during TicketFloodInterval. If the service reaches the ticket flood limit, it writes all new alerts into a single ticket.
TicketFloodInterval3600Specify the time period, in seconds. During this time period, the service can create as many tickets as specified in TicketFloodLimit. The default value is 3600 seconds, i.e., 1 hour.
ConsolidationInterval900Specify the time period, in seconds. During this time period, the service doesn't process similar alerts as they happen but consolidates them before updating open tickets in your ITSM. The default values is 900 seconds, i.e., 15 minutes. This option works in combination with UpdateTicketOnRepetitiveAlerts and is helpful if you want to reduce the number of ticket updates on ITSM side. That is, this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new incident ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just ones with all collected data.
CheckAlertQueueInterval5Internal parameter. Check and process the alert queue every N seconds; in seconds.
UpdateTicketOnRepetitiveAlertstrueInstead of creating a new ticket, reopen an existing ticket that is in a closed state (be default, closed, canceled, and resolved) if a similar alert occurs within UpdateInterval. This option works only when UpdateTicketOnRepetitiveAlerts is set to "true". NOTE: If you want to reopen closed tickets, you must have the right to perform Write operations on inactive incidents.
UpdateInterval86400Specify the time period, in seconds. If a similar alert occurs in less than N seconds, the service treats it as part of an existing incident. The default value is 86400 seconds, i.e., 24 hours. If an alerts is triggered after the UpdateInterval is over, a new ticket is created.
EnableTicketCorrelationtrueReview history and complement new tickets with information about similar tickets created previously. The service writes this information to the Description field. This option is helpful if you want to see if there is any correlation between past incidents (occurred during last month, by default) and a current incident.
CorrelationInterval2592000Specify the time period, in seconds. During this time period, the service treats similar tickets as related and complements a new ticket with data from a previous ticket. The default value is 2592000 seconds, i.e., 1 month. The service removes information on alerts older than 1 month from its internal storage.
ProcessActivityRecordQueueInterval5Internal parameter. Process Activity Record queue every N seconds; in seconds.
DisplayOnlyFirstActivityRecordtrueAdd only the first Activity Record in the work notes; the service attaches Activity Records that update this ticket to the ticket. If false, the ticket work notes display all Activity Records.
ActivityRecordRequestsRetention
RequestLimit5000Internal parameter. The maximum number of Activity Record requests the service can store in its internal memory. When the limit is reached, the service clears Activity Record requests starting with older ones.
RequestLimitInterval604800Internal parameter. The service can store the Activity Record requests not older than N seconds; in seconds. The service clears older Activity Record requests.
ActivityRecordWebRequests
RequestLimit200Internal parameter. The maximum number of Activity Records the service can retrieve in a single request.
RequestTimeout180Internal parameter. By default, 3 minutes. Defines the connection timeout.
TicketRequestsRetention
RequestLimit300000Internal parameter. The maximum number of ticket requests the service can store in its internal memory. When the limit is reached, the service clears ticket requests starting with older ones.
RequestLimitInterval604800Internal parameter. The service can store the ticket requests not older than N seconds; in seconds. The service clears older ticket requests.

NOTE: Stop and then restart the service every time you update any of configuration files.

ServiceNow Parameters​

Step 1 – Navigate to your add-on folder and select ServiceNowSettings.xml.

Step 2 – Define parameters such as ServiceNow connection parameters inside the <Connection> section.

Step 3 – Provide new values as follows: <paramenter>value</parameter>.

<Connection> parameterDefault valueDescription
URL—Provide a link to your ServiceNow system (e.g., https://enterprise.service-now.com).
UserName—Specify a user account. Ensure the user has sufficient permissions to create tickets and update them. The itil role is recommended. NOTE: If you want to reopen closed tickets, you must have the right to perform Write operations on inactive incidents.
Password—Provide a password.

Step 4 – Review the <TicketParameters> section. The parameters inside this section correspond to ServiceNow ticket fields and use the same naming (e.g., priority, urgency). To find out a field name in ServiceNow, switch to XML view (on the ticket header, navigate to Show XML).

Each <TicketParameter> includes the <Name></Name> and <Value></Value> pair that defines a ServiceNow ticket field and the value to assign to it. Most parameters have default values. Add more ticket parameters or update values if necessary.

NOTE: The template remains the same for all alerts, and you can't adjust it for individual alerts.

NameValueDescription
short_description[Netwrix Auditor] %AlertName%Sets Short description to alert title (e.g., [Netwrix Auditor] ITSM Add-On: User Account Locked Out).
categorysoftwareSets the incident Category to "Software".
impact1Sets Impact to "1 – High".
urgency1Sets Urgency to "1 – High".
severity1Sets Severity to "1 – High".
assignment_ groupd625dccec0a8016700a22a0 f7900d06Sets Assignment group to "Service Desk". NOTE: You can't use a group name as a value. Provide its guid instead.
description%AlertDescription% %PreviousTicketReference%Provides an alert description and references to related tickets in Description.
work_notesAlert Details: ...Adds the full alert text to Work notes, including data source, who, what, where, etc. To find out what the alert details include, see the ServiceNowSettings.xml file. NOTE: You can write alert details in the Additional comments field instead of Work notes. To do this, rename <Name>work_notes</Name> into <Name>comments</Name>. If you want to write alert details into both fields, create a copy of <TicketParameter> entry containing work_notes and <Name>work_notes</Name> into <Name>comments</Name. To skip alert details, remove entries for work_notes or comments.

Step 5 – Review the <CorrelationTicketFormat> section. It shows what information about related tickets your current ticket includes. Update the template if necessary.

CorrelationTicketFormatDescription
Previous incident for the same alert type: Number: %number% Opened: %opened_at% Assigned to: %assigned_to% Assignment group: %assignment_group% State: %state%Each %parameter% corresponds to a ServiceNow ticket field. The service automatically substitutes these parameters with values from a related ticket. Rearrange fields or add more if necessary. To find out a field name in ServiceNow, switch to XML view (on the ticket header, navigate to Show XML).

Step 6 – Review the <ReopenTicketOptions> section. It defines the tickets the add- on can reopen automatically.

NameDescription
ClosedTicketStates TicketStateLists ticket statuses. Only tickets with this status can be reopened. By default, resolved, closed, and canceled tickets can be reopened. To specify a new status, provide its ID in the <TicketState> tag (e.g., 8 for canceled).
NewStateDefines the ticket status to apply when the service reopens a ticket. By default, new. To specify another status, provide its ID in the <NewState> tag (e.g., 1 for new).

NOTE: Stop and then restart the service every time you update any of configuration files.