> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/solutions/automating-major-incident-management.md).

# Automating major incident management

## Problem

Managing major incidents for priority 1 (P1) and priority 2 (P2) tickets requires fast communication, root cause assignment, and consistent updates across teams. Handling these tasks manually causes delays and errors, and slows resolution in IT service management (ITSM) platforms such as ServiceNow. This extends downtime and reduces productivity.

## Solution

Nexthink helps you automate major incident management (MIM) for P1 and P2 tickets by integrating with an ITSM solution such as ServiceNow. The integration consists of two parts:

1. A **ServiceNow workflow** built in ServiceNow Flow Designer, that creates the ticket, retrieves the devices of MIM team members, and queries Nexthink over the Nexthink Query Language (NQL) API.
2. A **Nexthink workflow** triggered by the ServiceNow workflow through the Nexthink Workflows API, that sends a Nexthink campaign to notify MIM team members, collects their response, and calls the ServiceNow API to move the ticket to the resolving team.

{% hint style="info" %}
This integration reduces manual effort and improves team coordination during major incidents. While this guide uses ServiceNow as an example, you can apply the same pattern to integrate with other ITSM tools.
{% endhint %}

## Prerequisites

Before you integrate ServiceNow with Nexthink for major incident management, ensure you have the following:

* A Nexthink license including Flow — required to trigger a Nexthink workflow through the Workflows API, as described in Step 5: [#trigger-the-nexthink-mim-workflow](#trigger-the-nexthink-mim-workflow "mention")
* ServiceNow integrated with Nexthink.
* Nexthink API credentials (a client ID and client secret) created in your Nexthink instance — refer to [API credentials](https://docs.nexthink.com/api) for details.
* Administrator permissions in both ServiceNow and Nexthink.

## Integration flow

This integration automates the first part of the MIM notification process to ensure immediate awareness of P1 or P2 tickets and collaboration to find the root cause.

{% stepper %}
{% step %}

### Create a ticket

To create a P1 or P2 ticket:

1. In ServiceNow, go to **Flow Designer**.
2. Click **Create new**, and select **Flow**.

<div align="left"><figure><img src="/files/DRpOULLLoyJ7eKdqRYNM" alt="" width="138"><figcaption></figcaption></figure></div>

3. In the **Flow properties**, fill in the relevant properties, and click **Submit**.
4. Define the trigger for the workflow in ServiceNow Flow Designer.

<div align="left"><figure><img src="/files/9u6fA8WbWhNXJZzGltEQ" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### Retrieve MIM group members and devices

Once the P1 or P2 ticket exists, the ServiceNow workflow retrieves MIM group members from Active Directory (AD) through Lightweight Directory Access Protocol (LDAP) synchronization, checks the Configuration Management Database (CMDB) for their assigned devices, and gathers the necessary resources.

To retrieve MIM group members:

1. In ServiceNow, go to **Flow Designer**.
2. Click **Create new**, and select **Action**.

<div align="left"><figure><img src="/files/6klCjIB0fCAfLSCyuzNW" alt="" width="173"><figcaption></figcaption></figure></div>

3. In the **Action properties**, fill in the relevant properties, and click **Submit**.
4. Click **+** to add a script that retrieves the users from the group and their devices.

<div align="left"><figure><img src="/files/EcefBqQQTbFASjg8fuhA" alt=""><figcaption></figcaption></figure></div>

**Script example**:

```javascript
(function execute(inputs, outputs) {
   var deviceList = [];
   var j=0;
   for (i=0; i<8; i++){
		deviceList[i] = "empty"
	}
	// Get the users from the group
	var gr = new GlideRecord('sys_user_grmember');
	gr.addEncodedQuery('group=4dcd9658870c465029c687f60cbb356e');
	gr.query();
	while(gr.next()) {
		// Get the computers from the users
		var gr2 = new GlideRecord('cmdb_ci_computer');
		gr2.addQuery('assigned_to',gr.user);
		gr2.addQuery("u_testing_usage","false");
		gr2.addActiveQuery();
		gr2.query();
		while(gr2.next())
		{
			deviceList[j]= gr2.name;
			j++;
		}        
	}			
	// Get the specified count and time frame in seconds
	var specifiedCount = 2;
	var timeFrameSeconds = 120;

	// Get the current date and time in UTC format
	var now = new GlideDateTime();

	// Create a new GlideDateTime for the time frame limit (120 seconds ago)
	var timeFrameLimit = new GlideDateTime();
	timeFrameLimit.addSeconds(-timeFrameSeconds);

	// Query for P1 and P2 incidents created within the time frame
	var incidentGr = new GlideRecord('incident');
	var q1 = incidentGr.addQuery('sys_created_on', '>=', timeFrameLimit);
	var q2 = incidentGr.addQuery('priority',1);
	q2.addOrCondition('priority',2);
	incidentGr.query();

	// Save the devices as the first output
	outputs.devices = deviceList;
	
	// Get the incident Sys ID
	var sysid = incidentGr.sys_id;
	while (incidentGr.next()){
		sysid = incidentGr.sys_id;
	}
	// Save the Sys ID as the second output
	outputs.sysid = sysid
})(inputs, outputs);
```

{% hint style="info" %}
The script above saves the list of user `devices` in an array. This array is set as the output in the script’s Output Variables section. Additionally, the `sys_id` of the incident is saved as another output.
{% endhint %}
{% endstep %}

{% step %}

### Generate an API authentication token

To obtain the token required for API transactions with Nexthink, create a REST step in the ServiceNow workflow with the following fields:

* **Connection**: Define Connection Inline.
* **Base URL**: `https://<instancename>.api.<region>.nexthink.cloud`
* **Resource Path**: `/oauth2/default/v1/token`
* **HTTP Method**: POST
* **Headers**:
  * **Authorization**: Basic \<Base64 encoded clientId:clientSecret>. Encode your client ID and client secret in Base64 format to get this value.
* Click the icon in the top-right corner to save the fields.
  {% endstep %}

{% step %}

### Send device information to the Nexthink API

The ServiceNow workflow retrieves the device names from the CMDB and sends them to the Nexthink API, which returns the Collector IDs associated with those devices. ServiceNow then uses this information to update the ticket.

Create a second REST step in the ServiceNow workflow with the following fields:

* **Connection**: Define Connection Inline.
* **Base URL**: `https://<instancename>.api.<region>.nexthink.cloud`
* **Resource Path**: `/api/v2/nql/execute`
* **HTTP Method**: POST
* **Headers**:
  * **Accept**: application/json,text/csv
  * **Authorization**: use the Data Picker — click the icon next to the field, and select **2 - Rest Step > Response Body**. Apply the following filters using the **Fx** icon:
    1. **String > Split**, with separator `"access_token":`
    2. **Utilities > Get Last Item from Array**
    3. **String > Split**, with separator `,"scope"`
    4. **Utilities > Get First Item from Array**
  * **Content-Type**: application/json
* **Request Content**: add the body content needed for the Nexthink API query execution, for example an NQL query.

**Request body example**:

```json
{
"queryId": "<#yourqueryId>",
"parameters":{
"device0": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 0)",
"device1": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 1)",
"device2": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 2)",
"device3": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 3)",
"device4": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 4)",
"device5": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 5)",
"device6": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 6)",
"device7": "(here use the data picker to select 1 - Script Step > devices and apply the filter Get Item from Array with the value 7)",
}
```

Execute an NQL API Query in Nexthink that retrieves a list of the Collector UIDs for the devices sent. Use the following NQL query code:

```
devices during past 7d
| where device.name in [$device0,$device1,$device2,$device3,$device4,$device5,$device6,$device7]
| list collector.uid
```

{% endstep %}

{% step %}

### Trigger the Nexthink MIM workflow

Before ServiceNow can trigger it, the Nexthink workflow that sends the MIM campaign and calls back to ServiceNow must already exist and be enabled for API calls.

**In Nexthink:**

1. Confirm you have an active Nexthink workflow with the following **Workflow details:**
   * Workflow name to automatically get a unique `workflowId` — use this ID in the request body below.
   * Ticked **API** checkbox to make the workflow available for API calls.
2. Ensure the **Campaign** thinklet within the workflow logic uses the related MIM campaign — you must have preconfigured and published in Nexthink — with an **API** trigger set up.
   * Confirm the campaign has only **single-answer** questions. Refer to the [#notify-mim-team-members-with-a-nexthink-campaign](#notify-mim-team-members-with-a-nexthink-campaign "mention") section on this page.
3. **Ensure there is a Service/API** thinklet after the **Campaign** thinklet within the workflow logic, to call back to ServiceNow.

With the Nexthink workflow ready, the ServiceNow workflow retrieves the Collector IDs for the devices belonging to MIM team members and sends this data through the Nexthink Workflows API to trigger the Nexthink workflow.

{% hint style="info" %}
Refer to the following documentation for setup details:

* [Creating and configuring campaigns](/platform/user-guide/campaigns/managing-campaigns/creating-campaigns.md)
* [Creating workflows](/platform/user-guide/workflows/creating-workflows.md)
  * [Campaign thinklet](/platform/user-guide/workflows/creating-workflows/configuring-thinklets/campaign-thinklet.md)
  * [Service/API thinklet](/platform/user-guide/workflows/creating-workflows/configuring-thinklets/service-api-thinklet.md)
* [Nexthink Workflow API](https://docs.nexthink.com/api/workflows)
  {% endhint %}

**In ServiceNow:**

Create a new **REST** step in the ServiceNow workflow with the following fields:

* **Connection**: Define Connection Inline.
* **Base URL**: `https://<instancename>.api.<region>.nexthink.cloud`
* **Resource Path**: `/api/v1/workflows/execute`
* **HTTP Method**: POST
* **Headers**:
  * **Authorization**: same Data Picker and filter steps as in Step 4, using the token generated in Step 3.
  * **Content-Type**: application/json
* **Request Body**: add the body content needed to trigger the Nexthink Workflow.

{% code overflow="wrap" %}

```json
{
  "workflowId": "<#yourworkflowId>",
  "devices": [
    "<use the data picker to select 3 - REST Step > Response Body and apply the filters to extract the Collector UIDs from Step 4>"
  ],
  "params": {
    "sysId": "<use the data picker to select 1 - Script Step > sysID>"
  }
}
```

{% endcode %}
{% endstep %}

{% step %}

### Notify MIM team members with a Nexthink campaign

Once triggered, the Nexthink workflow — configured in Step 5: [#trigger-the-nexthink-mim-workflow](#trigger-the-nexthink-mim-workflow "mention")— sends an urgent Nexthink campaign to MIM team member devices, notifying them so they can take immediate action to resolve the issue.

The following screenshot displays how the MIM team members see the campaign:

<div align="left"><figure><img src="/files/lvpdPAEKaptSzvoNSzVa" alt="" width="338"><figcaption></figcaption></figure></div>

The campaign includes the following:

* **General information:** Details about the incident or issue.
* **Link to join the war room:** A direct link for team members to join the virtual war room for real-time collaboration.
* Two options for response:

<details>

<summary>Campaign response option: <strong>Acknowledge</strong></summary>

The **Acknowledge** campaign response confirms receipt of the message and participation.

If the MIM team member clicks on **Acknowledge,** Nexthink assumes they have used the link to join the War Room call.

Afterward, the system sends another urgent campaign where team members can choose from a list of possible root causes of the P1/P2 incident.

<div align="left"><figure><img src="/files/XHP25LPN12GBx5eyA0vK" alt="" width="248"><figcaption></figcaption></figure></div>

Once the MIM team member selects an option in the campaign, the workflow triggers a conditional check based on their response. It then calls the ServiceNow API to move the initial P1/P2 ticket to the Resolving Team's queue.

</details>

<details>

<summary>Campaign response option: <strong>Remind me later</strong></summary>

The **Remind me Later** campaign response lets team members postpone their response.

If an MIM team member selects **Remind me Later**, the Nexthink workflow waits until the set time ends and then resends the initial campaign. The following screenshot displays how it looks in Nexthink workflow logic designer.

<div align="left"><figure><img src="/files/sp5Spmeungcxw9YsEyTl" alt="" width="315"><figcaption></figcaption></figure></div>

The Nexthink workflow waits until the MIM team member acknowledges the campaign or takes action before the team proceeds with the next steps.

If the MIM team member selects **Remind me Later** a second time, the workflow waits until the set time ends and sends a final-call campaign that includes only one option: **Acknowledge***.* Observe in the image below what the users see.

<div align="left"><figure><img src="/files/LydfnjIGYvVibeSfYdYa" alt="" width="338"><figcaption></figcaption></figure></div>

</details>
{% endstep %}

{% step %}

### Validate integration

After automating MIM notification, verify the integration by triggering a test P1 or P2 ticket and confirm ServiceNow receives the ticket update once the root cause is selected.
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.nexthink.com/platform/solutions/automating-major-incident-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.