Create a ServiceNow incident from a failing CCM control test

The Create ticket action on a CCM control lets you turn a failing control into a tracked ServiceNow incident. From the control, you pick an active ServiceNow workflow (instance), review and edit the prefilled Title and Description, and click Create ticket. The incident is created in ServiceNow and linked back from the control's detail panel for easy follow-through.

This page walks the entire round-trip in five steps, then covers what to do when nothing happens (no admin set up a workflow yet, or your role does not allow you to create one).

note

The label you see in the modal is Workflow, and the label you see on the Instances tab is Instance. They refer to the same object - they are interchangeable. The modal says ticket for every provider; for ServiceNow, each ticket is an incident.

The same Create ticket modal also serves Jira. If more than one provider is set up, the Workflow dropdown lists the active workflows for all of them, so pick a workflow whose name tells you it is a ServiceNow destination. See Create a Jira ticket from a failing CCM control test for the Jira version of this flow.

Prerequisites

• At least one Active ServiceNow instance. If none exist, see Configure a ServiceNow connection and Create a ServiceNow instance first
• Creating a ticket from a control requires the full admin role. If you are not a full admin, the Create ticket button is disabled with the message Full admin access is required to create a ticket. Anyone who can see a control can still see the tickets already linked to it
• A control whose test is Failing to act on

Step 1: Find a failing control

1. From the JupiterOne left navigation, open Compliance > Controls
2. The Controls view defaults to All controls. The header summary cards at the top show your overall health
3. Use the status filter to narrow the list to Fail
4. Click any row in the failing-controls table to open the control's detail panel on the right

Step 2: Review the control and open the modal

The detail panel shows the control's summary, last-test metadata, framework mappings, and the Linked tickets section listing every prior ticket created from this control - from ServiceNow or Jira - each with its own View in ServiceNow or View in Jira link. At the bottom of the panel is a prominent full-width Create ticket button.

Click Create ticket. The Create ticket modal opens.

You can also open the modal from the control's own page: open Compliance > Controls, open the control, click the actions menu (...) in the top right, and choose Create ticket.

info

Existing Linked tickets rows do not block creating another ticket. Tickets stack and each one is independently created in ServiceNow. Use the existing rows as context (a colleague may have already filed it) before deciding to file again.

Step 3: Fill the three fields

For a ServiceNow workflow, the Create ticket modal has three fields. Which ServiceNow instance receives the incident is determined by the Workflow you select. The incident table, assignment, and other incident fields are not exposed in this modal.

#	Field	Behavior
1	Workflow	Required. Dropdown of every Active ticketing workflow (instance) in your workspace. If exactly one exists, it is preselected. The Workflow you pick determines which ServiceNow connection receives the incident.
2	Title	Required. Single-line text input, sent as the incident's Short description. Prefilled with Control failure: {control name} - for example, `Control failure: 8.11a (AWS)
3	Description	Optional. Markdown editor with a formatting toolbar. Prefilled with a Failing control tests heading and a bulleted list of the failing tests, each with its entity count and a link to the test in JupiterOne. When the control has no failing tests, it is prefilled from the control's description. Sent as the incident's Description.

warning

ServiceNow incidents receive the Description as plain text. JupiterOne does not convert the markdown for ServiceNow, so formatting characters are shown literally. In ServiceNow, a prefilled heading reads ## Failing control tests, and each link reads [test name](https://...) instead of rendering as a heading or a link. The information is all there; it just is not formatted. If you want a cleaner incident, remove the markdown characters in the editor before you click Create ticket.

There is no Assignee field for ServiceNow workflows. When you pick a ServiceNow workflow, the modal hides the Assignee field entirely. The incident is created unassigned, so use your ServiceNow assignment rules or triage process to route it. (For Jira workflows, the modal shows an Assignee picker.)

Step 4: Click Create ticket

When the fields are filled in to your liking, click Create ticket at the bottom-right of the modal. The modal closes and a toast reads Creating ticket..., then Ticket created on success or Failed to create ticket on failure.

What is not in this modal for ServiceNow - intentionally:

• Table picker - ServiceNow Data Out always creates incidents
• Assignee and Assignment group - not available for ServiceNow workflows
• Caller, Category, Urgency, Impact, and other incident fields - not set by Data Out. Set defaults for these in ServiceNow if your process needs them

If you need the incident to land somewhere different, switch which Workflow you pick from the dropdown - or have an admin create a new instance with a connection that points at the ServiceNow instance you need.

Step 5: Confirm in CCM and jump to the ServiceNow incident

After Create ticket succeeds, two surfaces update. The incident is created asynchronously, so give it a moment, then refresh the control detail panel if the new row is not there yet.

Linked tickets on the control detail panel

The control detail panel that originated the modal now lists the new incident in the Linked tickets section, along with any prior tickets created for the same control. Each row shows a ServiceNow icon, the incident title, and a View in ServiceNow external-link button.

Tickets are not deduplicated automatically; if your team only wants one open incident per control at a time, encourage the team to check this section before clicking Create ticket again.

View in ServiceNow

Click View in ServiceNow on any row to open that incident directly in ServiceNow. You should see:

• Number assigned by ServiceNow, for example INC0010001
• Short description prefixed with Control failure:
• Description with the failing control tests listed as plain text
• Caller, Assignment group, and Assigned to as determined by your ServiceNow defaults and rules - Data Out sets none of them

View in ServiceNow links inherit the user's existing ServiceNow permissions - people who cannot see incidents in ServiceNow cannot open the link.

For the underlying outbound delivery record (status, timing, error message), open the originating Workflow's instance detail page (Data out > Instances > {Workflow name}) - the call you just made appears at the top of the per-instance Jobs table. See Per-instance Jobs table.

Vulnerability case tickets

Remediation cases in Vulnerability Management use the same Create ticket modal and the same ServiceNow instances. The destination is pre-selected from the case's organizational unit, so you only need an Active ServiceNow instance selected as the OU's Ticketing workflow. See Use an instance for organizational unit routing and Ticketing workflows and routing.

Empty states

If you click Create ticket but no Active ticketing workflow exists, the modal renders an empty state instead of the form. The message changes based on your role.

Role	What you see	What to do
Full admin	No active ticket workflows with the explanation Set up a ticketing integration (Jira or ServiceNow) in Data out to get started. and a Go to connections button pointing at Data out > Connections	Click the button. Follow Configure a ServiceNow connection end-to-end. Once a workflow is Active, return to the control and click Create ticket again.
Non-admin	Ask an admin to set up a data-out ticketing workflow.	Notify a workspace admin. They can use the link above to set up the first workflow.

If workflows exist but none are Active, a full admin sees All ticketing workflows are paused or in error. Activate a workflow to create tickets. instead. The Workflow dropdown only lists Active instances, so Start any stopped instance from the Instances tab, or fix the instance's error.

Failure handling

The modal closes as soon as you click Create ticket, so check the toast: Failed to create ticket means JupiterOne could not hand the request to the workflow at all. If the toast says Ticket created but no row appears under Linked tickets, ServiceNow may have rejected the incident after hand-off - for example, because the service account's password expired between when the workflow was created and when you clicked Create ticket, or because ServiceNow requires a field Data Out does not send. In that case the delivery is recorded as a Failed job; open the instance's detail page to read the Error message. Common follow-ups:

• Password expired or account locked - have an admin re-authorize the connection, then create the ticket again
• A required incident field is missing - set a default for the field in ServiceNow, then create the ticket again
• Access denied on incidents - have your ServiceNow administrator restore the service account's access to the Incident table

For a fuller list, see Troubleshoot ServiceNow Data Out.