My colleague, @Ryan Balcom, and I have been plugging away on a side project to get Google Cloud Ops monitoring notifications into Event Management in ServiceNow and wanted to share the results here in case others are doing the same.

We used a Listener Transform Script to receive Google's JSON and map it to the Event record in ServiceNow.

This is definitely work-in-progress, needs further work to meet specific customer needs, and is not officially supported. It should give a head start on getting this set up though.

Some prerequisites:

• The service account in ServiceNow used by Google to connect to the instance should have "Web service access only" checked, and must have the "evt_mgmt_integration" role assigned.
• The url for Google's webhook to post to is https://{Instance-name}.service-now.com/api/global/em/inbound_event?source={URL_parameter_value}
• * URL_parameter_value comes from the "URL parameter value" field on the Listener Transform Script record.
  
  • Note: for customers hosted in GCC, the URL is slightly different: https://{Instance-name}.servicenowservices.com/api/global/em/inbound_event?source={URL_parameter_value}

We configured the Listener Transform Script as follows:

• Name: Google Monitoring Test Events Instance
• Type: Instance (you could use a MID server to receive events as well, but we didn't for testing)
• URL parameter value: googleJson (this can be anything you want, it forms the end of the URL referenced above)
• Header name: generic-header
• Header value: true

Script:

(function process( /*RESTAPIRequest*/ request, body) {
    /*Function that receives a JSON object, adding all its fields to the Additional information object. The field name is a concatenation of the field key and the parent field key if it exists.*/
    function updateAdditionalInfo(event, field, jsonObject, additionalInfo) {
        for (var key in jsonObject) {
            var newKey = key;
            if (field != "") {
                newKey = field + '_' + key;
            }

            /* SAMPLE PAYLOAD FROM GOOGLE
               REFERENCED HERE https://cloud.google.com/monitoring/support/notification-options

              {
                "incident": {
                  "incident_id": "f2e08c333dc64cb09f75eaab355393bz",
                  "resource_id": "i-4a266a2d",
                  "resource_name": "webserver-85",
                  "state": "open",
                  "started_at": 1385085727,
                  "ended_at": null,
                  "policy_name": "Webserver Health",
                  "condition_name": "CPU usage",
                  "url": "https://console.cloud.google.com/monitoring/alerting/incidents?project=PROJECT_ID",
                  "summary": "CPU for webserver-85 is above the threshold of 1% with a value of 28.5%"
                },
                "version": 1.1
              }
             */

            // PERFORM YOUR SPECIFIC TRANSFORMS HERE

            /* Unclear if this should be mapped to message_key
            if(key == "incident_id") {
               event.message_key = jsonObject[key];
            }*/

            /* Alternate to resource_name below, not sure which one to use
            if(key == "resource_id") {
               event.node = jsonObject[key];
            }*/

            if (key == "resource_name") { // OR resource_id depending on need
                event.node = jsonObject[key];
            }

            // Map Google state of "open" to SN state of "New", otherwise assume it's "Closing"
            if (key == "state") {
                if (jsonObject[key] == "open") {
                    event.resolution_state = "New";
                } else {
                    event.resolution_state = "Closing";
                }
            }

            // Map epoch time to SN date time
            if (key == "started_at") { // 1385085727
                event.time_of_event = convertEpochToSNTime(jsonObject[key]);
            }

            /* Not sure this is used in SN
            if (key == "ended_at") { // 1385085738
                if (jsonObject[key] > 0) {
                    event.time_of_event = convertEpochToSNTime(jsonObject[key]);
                }
            }*/

            // Map policy_name to metric_name
            if (key == "policy_name") {
                event.metric_name = jsonObject[key];
            }

            // Map condition_name to resource and type
            if (key == "condition_name") {
                event.resource = jsonObject[key];
                event.type = jsonObject[key];
            }

            // Concatenate the url and summary to the event description text
            if (key == "summary") {
                // If description is empty, add a newline before, otherwise just add the summary or url
                if (event.description == "") {
                    event.description = jsonObject[key];
                } else {
                    event.description = jsonObject[key] + '\n' + event.description;
                }
            }
            if (key == "url") {
                // If description is empty, add a newline before, otherwise just add the summary or url
                if (event.description == "") {
                    event.description = jsonObject[key];
                } else {
                    event.description = event.description + '\n' + jsonObject[key];
                }
            }

            additionalInfo[newKey] = jsonObject[key];
        }
    }

    function convertEpochToSNTime(epochTime) {
        var gdt = new GlideDateTime();
        gdt.setNumericValue(epochTime * 1000);
        return gdt.toString();
    }

    try {
        gs.info("TransformEvents_generic received body:" + body);
        var jsonObject = JSON.parse(body);
        var event = new GlideRecord('em_event');

        //TODO: Need to define
        event.source = "Google"; 

        //TODO: Need to define. Specific instance of the source. For example, SCOM 2012 on 10.20.30.40
        event.event_class = "GoogleMonitoring"; 

        //TODO: Set the event severity. All Google events will be 1-Critical. Scale is 1-5.
        event.severity = "1"; 

        var additionalInfo = {};
        updateAdditionalInfo(event, "", jsonObject, additionalInfo);
        /*Iterates over Additional information JSON object and adds all nested objects' fields as fields of the Additional information object*/
        var notDone = true;
        while (notDone) {
            notDone = false;
            for (var key in additionalInfo) {
                if (Object.prototype.toString.call(additionalInfo[key]) == '[object Object]') {
                    notDone = true;
                    updateAdditionalInfo(event, key, additionalInfo[key], additionalInfo);
                    additionalInfo[key] = "";
                }
            }
        }
        gs.info("TransformEvents_generic generated additional information:" + JSON.stringify(additionalInfo));
        event.additional_info = JSON.stringify(additionalInfo);
        event.insert();
    } catch (er) {
        gs.error(er);
        status = 500;
        return er;
    }
    return "success";
})(request, body);