Convert Prisma SD-WAN Events to ServiceNow Constructs
Table of Contents
Convert Prisma SD-WAN Events to ServiceNow Constructs
Before a ticket is created on ServiceNow,
the Prisma SD-WAN event JSON is converted to a data structure understood
by the ServiceNow instance. This mapping is dependent on the parameters
configured on the CloudBlade. For example, the CloudBlade configuration
below is translated in the following manner:
| Prisma SD-WAN Event Attributes | ServiceNow Construct |
|---|---|
| code | u_code |
| correlation_id | u_correlation_id |
| severity | u_urgency |
| id | u_event_id |
| time | u_time |
| site_id | u_site |
| element_id | u_element |
| entity_ref | u_entity_ref |
| info | u_info |
| acknowledged | u_acknowledged |
| cleared | u_cleared |
| type | u_type |
| severity | impact |
The following Prisma SD-WAN attributes are translated before
converting to the ServiceNow construct:
Entity_Ref
The IDs in the entity_ref are translated to their respective
names and a meaningful string is generated that provides the user
information about the entity of the alarm
For example, the entity_ref below:
tenants/1083/sites/15282991838450011/elements/15230097588400085/interfaces/15230098062640233"
is translated to the string:
Site: Portland Office Element: Portland3K-A Interface: internet1
The ServiceNow CloudBlade does a topology mapping once
a week. If new VPN links are created since the last topology mapping,
then it may result in certain VPN link IDs not being translated
to names.
Info
Similar to entity_ref, the IDs in the info are also translated
to their respective names.
Site ID
If a site_id exists in the Prisma SD-WAN
event, it is translated to its name before populating the ServiceNow
construct with the value.
Element ID
If an element_id exists in the Prisma
SD-WAN event, it is also translated to its name before populating
the ServiceNow construct with the value.
Severity
In the above example, the Prisma SD-WAN severity is directly
mapped to u_urgency. However, this field
is also mapped to another attribute named impact.
The following translation takes place before the ServiceNow construct
is populated.
| Prisma SD-WAN Severity | ServiceNow Impact |
|---|---|
| critical | 1 - High |
| major | 2 - Medium |
| minor | 3 - Low |
The impact value may change depending on the tags configured
at the site and/or element level. More about this feature is discussed
in length under the section CloudBlade Advanced Configurations.
Along with the attributes above, the CloudBlade also populates
the tenant name in an attribute called company.
