Ceburu ServiceNow EM Events Connector Setup

Status: Coming soon / not production-ready. The API-key workflow is available in the current UI, and this page records the intended alarms API contract from the current code. Do not enable a production polling schedule or promise customer availability until the EM Events connector release is approved.

Common API-key walkthrough: Service Graph Connector setup video

What this connector will do

The Ceburu ServiceNow EM Events connector will pull active, updated, and resolved Ceburu alarms and submit ServiceNow-ready records to em_event.

Ceburu alarms
        ↓ one versioned alarms endpoint
 ServiceNow EM Events connector
        ↓ stable message key + lifecycle
 ServiceNow em_event → alerts and CI binding

This connector is only for alarms/events. It must not use the Service Graph inventory, health, device, specification, or interface endpoints.

Before you begin

For pre-release validation, confirm that you have:

• Ceburu access that permits API-key management.
• The correct customer selected in the Ceburu portal.
• An approved non-production validation plan.
• A secure ServiceNow credential location for the raw key.
• A release decision confirming when the endpoint and connector may be used.

Generate a dedicated EM Events key. Do not reuse a Service Graph key.

Generate the EM Events API key

The navigation, scope, rate-limit, expiration, one-time secret, rotation, and revocation steps are the same as for the Graph connector. The connector type selection is different and automatically gives this key a different endpoint allowlist.

1. Open Manage API Keys

In Ceburu, select the intended customer, open Integrations Hub, and select Manage API Keys.

Integrations Hub with Manage API Keys highlighted

2. Start key generation

On the API Keys page, select Generate API Key.

Manage API Keys with Generate API Key highlighted

3. Select the connector type

Open Integration Type and select ServiceNow Event Management (em_event) Connector.

Integration Type menu showing ServiceNow Event Management and Graph options

This selection creates an internal em_events_connector key and automatically allows only the alarms endpoint.

4. Complete the key settings

Annotated API key form fields

Select Generate.

5. Copy and protect the raw key

The raw key appears once. Select Copy & Close, then place the value in the approved encrypted credential or secret store.

One-time API key notice after successful generation

Do not place the key in screenshots, tickets, source control, query parameters, application logs, or ServiceNow ECC Queue payloads.

6. Hold production activation until release

Creating the key does not mean the connector is released. Until the release owner approves production use:

• Do not enable a scheduled ServiceNow collection job.
• Do not treat sample or development responses as a production SLA.
• Do not distribute the connector as generally available.
• Keep any test key scoped and stored as a normal secret.

Intended alarms API contract

The EM Events key is intended to call one endpoint only:

GET /integrations/em-events/v1/by-customer/

No Service Graph endpoints are assigned to this key. A cross-connector request should return HTTP 403.

Authentication:

Authorization: Bearer <integration-api-key>
 Accept: application/json

The API key identifies the customer. Do not add a customer ID to override its scope.

Supported query parameters:

Required synchronization behavior

Offset pagination must run inside a fixed time window so events cannot move between pages while a poll is in progress.

last_cursor = previous successful sync.next_cursor
 request first page with updated_after = last_cursor
 server fixes updated_before for this run
 
repeat:
    submit every event in the current results page
    if next is not null, request the complete next URL
 
after every page and submission succeeds:
    save sync.next_cursor as the new last_cursor

Rules:

• The window is last_modified > updated_after and last_modified <= updated_before.
• Advance the cursor only after every page and every ServiceNow submission succeeds.
• Retry the same window after a failure.
• Keep source_type=all and status=all for scheduled lifecycle collection.
• Reuse the server-supplied next URL; it preserves filters and the fixed window.
• Use the stable message_key to make retries idempotent.

Intended ServiceNow event contract

Each result is shaped for ServiceNow em_event ingestion.

Lifecycle mapping

Acknowledgement is an update, not a resolution. It may appear in additional_info, but it must not close the ServiceNow alert.

Severity mapping

CI binding should use the same hostname, FQDN, IP, or MAC identity that the Service Graph connector placed in the CMDB. Supplemental identifiers such as ci_correlation_key, network_map_id, device_id, network_id, and entity_ip belong in the stringified additional_info value, never in custom em_event columns.

Credential lifecycle

Use Regenerate to replace a key. The old raw value becomes invalid immediately. Update the encrypted ServiceNow credential and retest before enabling the next run.

Use Revoke when a test is complete, a connector is retired, or a key may be exposed.

Regenerate and Revoke actions for API keys

Troubleshooting

Release-gate checklist

• Product/release owner confirms that the EM Events connector is ready in the target environment.
• The key type is ServiceNow Event Management (em_event) Connector.
• The key can call only /integrations/em-events/v1/by-customer/.
• A Graph endpoint returns 403 when tested with this key.
• The raw key is stored only in an encrypted credential.
• Initial and incremental windows collect create, update, and resolve lifecycle records.
• Pagination preserves the fixed updated_before value.
• The cursor advances only after all pages and ServiceNow submissions succeed.
• A resolution reuses the original message_key, sends severity 0, and uses Closing.
• Events bind to CIs created by the Service Graph connector.
• Rotation, expiration monitoring, and revocation ownership are documented.