Automating major incident management

Problem

Managing major incidents for priority 1 (P1) and priority 2 (P2) tickets requires fast communication, root cause assignment, and consistent updates across teams. Handling these tasks manually causes delays and errors, and slows resolution in IT service management (ITSM) platforms such as ServiceNow. This extends downtime and reduces productivity.

Solution

Nexthink helps you automate major incident management (MIM) for P1 and P2 tickets by integrating with an ITSM solution such as ServiceNow. The integration consists of two parts:

1. A ServiceNow workflow built in ServiceNow Flow Designer, that creates the ticket, retrieves the devices of MIM team members, and queries Nexthink over the Nexthink Query Language (NQL) API.
2. A Nexthink workflow triggered by the ServiceNow workflow through the Nexthink Workflows API, that sends a Nexthink campaign to notify MIM team members, collects their response, and calls the ServiceNow API to move the ticket to the resolving team.

This integration reduces manual effort and improves team coordination during major incidents. While this guide uses ServiceNow as an example, you can apply the same pattern to integrate with other ITSM tools.

Prerequisites

Before you integrate ServiceNow with Nexthink for major incident management, ensure you have the following:

• A Nexthink license including Flow — required to trigger a Nexthink workflow through the Workflows API, as described in Step 5: Trigger the Nexthink MIM workflow
• ServiceNow integrated with Nexthink.
• Nexthink API credentials (a client ID and client secret) created in your Nexthink instance — refer to API credentials for details.
• Administrator permissions in both ServiceNow and Nexthink.

Integration flow

This integration automates the first part of the MIM notification process to ensure immediate awareness of P1 or P2 tickets and collaboration to find the root cause.

1

Create a ticket

To create a P1 or P2 ticket:

1. In ServiceNow, go to Flow Designer.
2. Click Create new, and select Flow.

1. In the Flow properties, fill in the relevant properties, and click Submit.
2. Define the trigger for the workflow in ServiceNow Flow Designer.

2

Retrieve MIM group members and devices

Once the P1 or P2 ticket exists, the ServiceNow workflow retrieves MIM group members from Active Directory (AD) through Lightweight Directory Access Protocol (LDAP) synchronization, checks the Configuration Management Database (CMDB) for their assigned devices, and gathers the necessary resources.

To retrieve MIM group members:

1. In ServiceNow, go to Flow Designer.
2. Click Create new, and select Action.

1. In the Action properties, fill in the relevant properties, and click Submit.
2. Click + to add a script that retrieves the users from the group and their devices.

Script example:

(function execute(inputs, outputs) {
   var deviceList = [];
   var j=0;
   for (i=0; i<8; i++){
		deviceList[i] = "empty"
	}
	// Get the users from the group
	var gr = new GlideRecord('sys_user_grmember');
	gr.addEncodedQuery('group=4dcd9658870c465029c687f60cbb356e');
	gr.query();
	while(gr.next()) {
		// Get the computers from the users
		var gr2 = new GlideRecord('cmdb_ci_computer');
		gr2.addQuery('assigned_to',gr.user);
		gr2.addQuery("u_testing_usage","false");
		gr2.addActiveQuery();
		gr2.query();
		while(gr2.next())
		{
			deviceList[j]= gr2.name;
			j++;
		}        
	}			
	// Get the specified count and time frame in seconds
	var specifiedCount = 2;
	var timeFrameSeconds = 120;

	// Get the current date and time in UTC format
	var now = new GlideDateTime();

	// Create a new GlideDateTime for the time frame limit (120 seconds ago)
	var timeFrameLimit = new GlideDateTime();
	timeFrameLimit.addSeconds(-timeFrameSeconds);

	// Query for P1 and P2 incidents created within the time frame
	var incidentGr = new GlideRecord('incident');
	var q1 = incidentGr.addQuery('sys_created_on', '>=', timeFrameLimit);
	var q2 = incidentGr.addQuery('priority',1);
	q2.addOrCondition('priority',2);
	incidentGr.query();

	// Save the devices as the first output
	outputs.devices = deviceList;
	
	// Get the incident Sys ID
	var sysid = incidentGr.sys_id;
	while (incidentGr.next()){
		sysid = incidentGr.sys_id;
	}
	// Save the Sys ID as the second output
	outputs.sysid = sysid
})(inputs, outputs);

The script above saves the list of user devices in an array. This array is set as the output in the script’s Output Variables section. Additionally, the sys_id of the incident is saved as another output.

3

Generate an API authentication token

To obtain the token required for API transactions with Nexthink, create a REST step in the ServiceNow workflow with the following fields:

• Connection: Define Connection Inline.
• Base URL: https://<instancename>.api.<region>.nexthink.cloud
• Resource Path: /oauth2/default/v1/token
• HTTP Method: POST
• Headers:

  • Authorization: Basic <Base64 encoded clientId:clientSecret>. Encode your client ID and client secret in Base64 format to get this value.
• Click the icon in the top-right corner to save the fields.

4

Send device information to the Nexthink API

The ServiceNow workflow retrieves the device names from the CMDB and sends them to the Nexthink API, which returns the Collector IDs associated with those devices. ServiceNow then uses this information to update the ticket.

Create a second REST step in the ServiceNow workflow with the following fields:

• Connection: Define Connection Inline.
• Base URL: https://<instancename>.api.<region>.nexthink.cloud
• Resource Path: /api/v2/nql/execute
• HTTP Method: POST
• Headers:

  • Accept: application/json,text/csv
  • Authorization: use the Data Picker — click the icon next to the field, and select 2 - Rest Step > Response Body. Apply the following filters using the Fx icon:

    1. String > Split, with separator "access_token":
    2. Utilities > Get Last Item from Array
    3. String > Split, with separator ,"scope"
    4. Utilities > Get First Item from Array
  • Content-Type: application/json
• Request Content: add the body content needed for the Nexthink API query execution, for example an NQL query.

Request body example:

{
"queryId": "<#yourqueryId>",
"parameters":{
"device0": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 0)",
"device1": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 1)",
"device2": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 2)",
"device3": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 3)",
"device4": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 4)",
"device5": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 5)",
"device6": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 6)",
"device7": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 7)",
}

Execute an NQL API Query in Nexthink that retrieves a list of the Collector UIDs for the devices sent. Use the following NQL query code:

devices during past 7d
| where device.name in [$device0,$device1,$device2,$device3,$device4,$device5,$device6,$device7]
| list collector.uid

5

Trigger the Nexthink MIM workflow

Before ServiceNow can trigger it, the Nexthink workflow that sends the MIM campaign and calls back to ServiceNow must already exist and be enabled for API calls.

In Nexthink:

1. Confirm you have an active Nexthink workflow with the following Workflow details:

   • Workflow name to automatically get a unique workflowId — use this ID in the request body below.
   • Ticked API checkbox to make the workflow available for API calls.
2. Ensure the Campaign thinklet within the workflow logic uses the related MIM campaign — you must have preconfigured and published in Nexthink — with an API trigger set up.

   • Confirm the campaign has only single-answer questions. Refer to the Notify MIM team members with a Nexthink campaign section on this page.
3. Ensure there is a Service/API thinklet after the Campaign thinklet within the workflow logic, to call back to ServiceNow.

With the Nexthink workflow ready, the ServiceNow workflow retrieves the Collector IDs for the devices belonging to MIM team members and sends this data through the Nexthink Workflows API to trigger the Nexthink workflow.

Refer to the following documentation for setup details:

• Creating and configuring campaigns

• Creating workflows

  • Campaign thinklet

  • Service/API thinklet

• Nexthink Workflow API

In ServiceNow:

Create a new REST step in the ServiceNow workflow with the following fields:

• Connection: Define Connection Inline.
• Base URL: https://<instancename>.api.<region>.nexthink.cloud
• Resource Path: /api/v1/workflows/execute
• HTTP Method: POST
• Headers:

  • Authorization: same Data Picker and filter steps as in Step 4, using the token generated in Step 3.
  • Content-Type: application/json
• Request Body: add the body content needed to trigger the Nexthink Workflow.

{
  "workflowId": "<#yourworkflowId>",
  "devices": [
    "<use the data picker to select 3 - REST Step > Response Body and apply the filters to extract the Collector UIDs from Step 4>"
  ],
  "params": {
    "sysId": "<use the data picker to select 1 - Script Step > sysID>"
  }
}

6

Notify MIM team members with a Nexthink campaign

Once triggered, the Nexthink workflow — configured in Step 5: Trigger the Nexthink MIM workflow— sends an urgent Nexthink campaign to MIM team member devices, notifying them so they can take immediate action to resolve the issue.

The following screenshot displays how the MIM team members see the campaign:

The campaign includes the following:

• General information: Details about the incident or issue.
• Link to join the war room: A direct link for team members to join the virtual war room for real-time collaboration.
• Two options for response:

Campaign response option: Acknowledge

The Acknowledge campaign response confirms receipt of the message and participation.

If the MIM team member clicks on Acknowledge, Nexthink assumes they have used the link to join the War Room call.

Afterward, the system sends another urgent campaign where team members can choose from a list of possible root causes of the P1/P2 incident.

Once the MIM team member selects an option in the campaign, the workflow triggers a conditional check based on their response. It then calls the ServiceNow API to move the initial P1/P2 ticket to the Resolving Team's queue.

Campaign response option: Remind me later

The Remind me Later campaign response lets team members postpone their response.

If an MIM team member selects Remind me Later, the Nexthink workflow waits until the set time ends and then resends the initial campaign. The following screenshot displays how it looks in Nexthink workflow logic designer.

The Nexthink workflow waits until the MIM team member acknowledges the campaign or takes action before the team proceeds with the next steps.

If the MIM team member selects Remind me Later a second time, the workflow waits until the set time ends and sends a final-call campaign that includes only one option: Acknowledge. Observe in the image below what the users see.

7

Validate integration

After automating MIM notification, verify the integration by triggering a test P1 or P2 ticket and confirm ServiceNow receives the ticket update once the root cause is selected.