Streamwake + ServiceNow.
ServiceNow incidents, into the detection surface.
ServiceNow is Streamwake's first inbound ITSM source — the reverse direction from the +X data-vendor catalog. Instead of Streamwake reading a vendor's signals, your ServiceNow instance pushes incidents straight into Streamwake's detection surface via a signed webhook.
Every incoming incident is classified against the streaming failure-mode taxonomy (manifest drift, CDN brownout, per-title encoder regression, DRM cert failure) and lands in the Streamwake audit trail with a confidence score and the remediation the agent applied — closing the loop back into the same ServiceNow record.
Alert ingestion from ServiceNow incidents into Streamwake's detection surface.
Push, not poll
A ServiceNow Business Rule fires on incident.created / incident.updated and POSTs the record straight to Streamwake — incidents land in seconds, not on the next scheduled sync.
Classified on arrival
Every ServiceNow incident is run against the same streaming failure-mode taxonomy the agent uses for every other signal source, with a confidence score attached.
Loop closes back
The remediation the agent applies is annotated back onto the ServiceNow incident and recorded permanently in the Streamwake audit trail.
Auth, webhook, and secret config
on both sides of the connection.
No OAuth flow, no Azure-style app registration — the connection is a signed webhook. Four steps to a verified test incident.
- 1
Generate the Streamwake inbound signing secret
From /app/integrations, generate a ServiceNow inbound secret — a per-tenant HMAC key Streamwake uses to verify every incoming request came from your ServiceNow instance, not a spoofed sender.
- 2
Create the ServiceNow Business Rule
In ServiceNow, add a Business Rule on the incident table (after insert/update) that POSTs the incident record to the Streamwake inbound webhook URL — no scheduled job, no polling, the push happens the moment the incident record changes.
- 3
Sign the outbound request
The Business Rule computes an HMAC-SHA256 signature of the request body using the secret from step 1 and sets it on the X-Streamwake-Signature header. Streamwake recomputes the signature on receipt and rejects the request if it doesn’t match.
- 4
Send a test incident
Create a test incident in ServiceNow (or replay the Business Rule against an existing one) and confirm it lands in the Streamwake audit trail below within a few seconds — classified against the streaming failure-mode taxonomy, with a confidence score and any remediation the agent applied.
| Field | Owned by | Notes |
|---|---|---|
| Webhook URL | Streamwake | The inbound endpoint your ServiceNow Business Rule POSTs to. One URL per tenant. |
| HMAC signing secret | Streamwake | Generated once per tenant from /app/integrations. Never leaves your ServiceNow instance in plaintext — it signs the request body, it is not sent as a bearer token. |
| X-Streamwake-Signature header | ServiceNow | HMAC-SHA256 of the raw request body, hex-encoded, computed by the Business Rule before it sends the POST. |
| sys_id / incident number | ServiceNow | Carried through untouched so the Streamwake audit-trail entry links back to the source ServiceNow record. |
A real incident,
landed in the Streamwake audit trail.
The shape of what to expect once the webhook is wired — a ServiceNow incident, classified, and recorded with the remediation Streamwake applied.
Run the Free Stream Check,
see the same audit trail ServiceNow feeds.
Paste a playback URL into /stream-check — five checks in under a minute, no login. Pair it with the Book-a-demo block below for a guided walkthrough of the webhook signing and HMAC verification on your ServiceNow instance.
Book a 20-minute walkthrough on your ServiceNow instance.
We're happy to walk through the Business Rule setup, the HMAC signing convention, and the incident classification taxonomy on a real ServiceNow instance. Drop your details below and we'll follow up within 1 business day.