ServiceNowGenericFeed by 4nshumaan · Pull Request #43756 · demisto/content

4nshumaan · 2026-04-01T20:33:04Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

content-bot · 2026-04-01T20:35:51Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

content-bot · 2026-04-01T20:35:52Z

Hi @4nshumaan, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

content-bot · 2026-04-01T20:35:54Z

🤖 AI-Powered Code Review Available

Hi @kamalq97, you can leverage AI-powered code review to assist with this PR!

Available Commands:

@marketplace-ai-reviewer start review - Initiate a full AI code review
@marketplace-ai-reviewer re-review - Incremental review for new commits

Copilot

Pull request overview

Adds a new Cortex XSOAR content pack, ServiceNowGenericFeed, intended to fetch records from ServiceNow CMDB endpoints and ingest them into TIM as indicators with user-defined tags.

Changes:

Introduces new pack metadata and contributor metadata for ServiceNowGenericFeed.
Adds a new feed integration (YML + Python) to fetch ServiceNow CMDB records and create indicators in TIM.
Adds integration documentation and basic unit tests.

Reviewed changes

Copilot reviewed 8 out of 14 changed files in this pull request and generated 20 comments.

Show a summary per file

File	Description
Packs/ServiceNowGenericFeed/pack_metadata.json	Defines pack metadata for marketplace publishing.
Packs/ServiceNowGenericFeed/CONTRIBUTORS.json	Adds contributor attribution for the pack.
Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.yml	Defines integration UI/configuration for the ServiceNow feed.
Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.py	Implements the integration client, fetch flow, and indicator creation.
Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed_test.py	Adds unit tests for indicator object creation and URL fetch behavior.
Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/README.md	Documents integration configuration and fetch behavior.
Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed_description.md	Adds Marketplace description content for the integration.
Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/test_data/baseintegration-dummy.json	Adds placeholder test data.
Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed_image.png	Adds integration image asset.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-01T20:47:35Z

Packs/ServiceNowGenericFeed/pack_metadata.json

@@ -0,0 +1,27 @@
+{
+    "name": "ServcieNowGenericFeed",


The pack "name" is misspelled ("ServcieNowGenericFeed") and should match the pack directory/integration naming ("ServiceNowGenericFeed"). This will also affect pack identification in tooling and Marketplace publishing.

Suggested change

"name": "ServcieNowGenericFeed",

"name": "ServiceNowGenericFeed",

Copilot · 2026-04-01T20:47:36Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.py

+API_VERSION = "/api/now/cmdb/instance/"
+ROOT_URL = "https://company-domain.service-now.com"
+
+


API_VERSION and ROOT_URL are defined but never used. This will trigger lint failures (unused variables) and should be removed or used.

Suggested change

API_VERSION = "/api/now/cmdb/instance/"

ROOT_URL = "https://company-domain.service-now.com"

Copilot · 2026-04-01T20:47:36Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.py

+            human_readable, response = list_records_from_url(client, server_url)
+            if response.get("result", {}):
+                indicators = response.get("result", {})
+                objs = create_indicator_object(indicators, feedtags, indicator_field)
+                add_indicators_to_tim(objs)


In the fetch-indicators flow, human_readable is assigned but never used. This is dead code and will trigger a lint error for an unused variable.

Copilot · 2026-04-01T20:47:36Z

...erviceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed_description.md

+ ServiceNowGenericFeed fetches records from a ServiceNow CMDB API endpoint and ingests them as indicators into Cortex XSOAR TIM with user desired tags.
+***
+## ServiceNowGenericFeed
+- This integration can be used to pull indicators form Service Now with a given user query and add them to the Threat Intelligence Module.  


Spelling/branding: "pull indicators form Service Now" should be "pull indicators from ServiceNow".

Suggested change

- This integration can be used to pull indicators form Service Now with a given user query and add them to the Threat Intelligence Module.

- This integration can be used to pull indicators from ServiceNow with a given user query and add them to the Threat Intelligence Module.

Copilot · 2026-04-01T20:47:36Z

Packs/ServiceNowGenericFeed/pack_metadata.json

@@ -0,0 +1,27 @@
+{
+    "name": "ServcieNowGenericFeed",
+    "description": "This pack contains an integration that can be used to pull indicators form ServiceNow CMDB and put them inside the XSIAM TIM with the option to provide tagging.",


Spelling: pack description says "pull indicators form ServiceNow"; should be "from ServiceNow".

Suggested change

"description": "This pack contains an integration that can be used to pull indicators form ServiceNow CMDB and put them inside the XSIAM TIM with the option to provide tagging.",

"description": "This pack contains an integration that can be used to pull indicators from ServiceNow CMDB and put them inside the XSIAM TIM with the option to provide tagging.",

Copilot · 2026-04-01T20:47:39Z

Packs/ServiceNowGenericFeed/pack_metadata.json

+    "firstCreated": "2026-04-01T11:49:45Z",
+    "devEmail": [
+        "anmishra@nd.gov"
+    ],
+    "githubUser": []


pack_metadata.json uses a non-standard firstCreated field. Content repo packs typically use created (and include supportedModules for marketplace publishing). Using an unexpected key is likely to fail pack metadata validation.

Copilot · 2026-04-01T20:47:39Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.yml

+  dockerimage: demisto/auth-utils:1.0.0.5427065
+  feed: true
+  isFetchSamples: true
+  runonce: false
+  script: ''


The integration YML is missing standard fields like tests and fromversion, which are commonly required by content validation/CI.

Copilot · 2026-04-01T20:47:39Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/README.md

+| query_url | The API route of the requested information in ServiceNow. | False |
+| indicator_field | Field used to build indicator values. | False |


Copilot · 2026-04-01T20:47:40Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.py

+        indicator_type = auto_detect_indicator_type(ind.get(indicator_field))
+        indicator_obj = {
+            "value": ind.get(indicator_field),


create_indicator_object does not validate that the extracted indicator value exists or that auto_detect_indicator_type returned a valid type. If the field is missing/empty or the type can’t be detected, this will create indicator objects with value=None or type=None, which can cause indicator creation failures downstream.

Suggested change

indicator_type = auto_detect_indicator_type(ind.get(indicator_field))

indicator_obj = {

"value": ind.get(indicator_field),

value = ind.get(indicator_field)

if not value:

# Skip records without the requested indicator field or with an empty value

continue

indicator_type = auto_detect_indicator_type(value)

if not indicator_type:

# Skip records for which the indicator type cannot be detected

continue

indicator_obj = {

"value": value,

Copilot · 2026-04-01T20:47:40Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.yml

+- additionalinfo: The format should be https://company.service-now.com/
+  display: Server URL 
+  name: url
+  required: true
+  section: Connect


The integration code supports OAuth/JWT, but the YML configuration does not expose any OAuth/JWT-related parameters for users to configure. Either add the missing configuration fields or remove the unused OAuth/JWT code to avoid unreachable/misleading logic.

marketplace-ai-reviewer · 2026-04-06T12:10:56Z

🤖 Analysis started. Please wait for results...

content-bot · 2026-04-06T12:14:24Z

For the Reviewer: Trigger build request has been accepted for this contribution PR.

content-bot · 2026-04-06T12:14:32Z

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/8115382

content-bot · 2026-04-06T12:22:29Z

Validate summary
The following errors were thrown as a part of this pr: BA103, IN163, IM108, IN117, IN122, BA106, ST111, DO106, ST110, DS108.
The following errors can be ignored: IN163, IN122, BA106, DS108.
The following errors cannot be ignored: BA103, IM108, IN117, ST111, DO106, ST110.
If the AG100 validation in the pre-commit GitHub Action fails, the pull request cannot be force-merged.
The following errors don't run as part of the nightly flow and therefore can be force merged: BA103, IN117, ST111, DO106, DS108.

Verdict: PR can be force merged from validate perspective? ❌

marketplace-ai-reviewer · 2026-04-06T12:52:14Z

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

marketplace-ai-reviewer

Hi there, thanks for contributing this ServiceNow feed integration! I've reviewed your submission and found a few areas for improvement, primarily around code reuse, authentication, and documentation. Please update the code to utilize ServiceNowClient from the ServiceNowApiModule, ensure OAuth/JWT authentication parameters are fully implemented, and auto-generate the README using the demisto-sdk. Thanks again for your hard work, and let me know if you have any questions!

Additionally, please address the following file-level notes:

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed_description.md: The description file is missing mandatory sections such as 'Permissions', 'Credentials', and 'Troubleshooting'. Please refer to the official guidelines for the required structure.

Also, the corresponding integration YML file (ServiceNowGenericFeed.yml) is missing the supportlevelheader key. Please add it with one of the xsoar/partner/community values to ensure the correct banner appears in the description.

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/README.md: The README appears to be manually written. According to Cortex XSOAR guidelines, integration READMEs must be generated using the demisto-sdk generate-docs command.
Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/command_examples.txt: The command_examples.txt file is empty. The review cannot proceed.
Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed_image.png: Please replace this placeholder image with the official ServiceNow logo.
Packs/ServiceNowGenericFeed/pack_metadata.json: The mandatory key created is missing from the metadata.
Packs/ServiceNowGenericFeed/README.md: Consider adding a "What does this pack do?" section to provide a clear overview of the integration's capabilities.

@kamalq97, @4nshumaan, @copilot-pull-request-reviewer[bot] please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

marketplace-ai-reviewer · 2026-04-06T12:52:07Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.py

+ROOT_URL = "https://company-domain.service-now.com"
+
+
+class Client(BaseClient):


Remove the duplicated Client class and use ServiceNowClient from ServiceNowApiModule.

marketplace-ai-reviewer · 2026-04-06T12:52:07Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.py

+"""COMMAND FUNCTIONS"""
+
+
+def test_module(client: Client) -> str:


Update type hint to ServiceNowClient and accept server_url.

marketplace-ai-reviewer · 2026-04-06T12:52:07Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.py

+
+    if client.use_oauth and not client.use_jwt:
+        return_error(
+            "Test button cannot be used when using OAuth 2.0. Please use the !servicenow-cmdb-oauth-login "


The OAuth login commands are missing from this integration.

marketplace-ai-reviewer · 2026-04-06T12:52:07Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.py

+            "command followed by the !servicenow-cmdb-oauth-test command to test the instance."
+        )
+
+    response = client.http_request(method="GET", url_suffix="/api/now/cmdb/instance/cmdb_ci_linux_server")


Test the user-provided query_url and correctly handle empty results.

Hardcoded table in test module

marketplace-ai-reviewer · 2026-04-06T12:52:07Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/ServiceNowGenericFeed.py

+        return "Test failed. Please check your instance URL and credentials."
+
+
+def list_records_from_url(client: Client, server_url: str) -> tuple:


Update type hint to ServiceNowClient.

marketplace-ai-reviewer · 2026-04-06T12:52:08Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/README.md

+| url | Server URL (e.g., https://api.xsoar-example.com). Default: https://company.service-now.com/ | True |
+| credentials | API Key (username/password). | True |
+| feedTags | Tags applied to fetched indicators. | False |
+| query_url | The API route of the requested information in ServiceNow. | False |


The query_url parameter is incorrectly marked as not required.

marketplace-ai-reviewer · 2026-04-06T12:52:08Z

Packs/ServiceNowGenericFeed/Integrations/ServiceNowGenericFeed/README.md

+| credentials | API Key (username/password). | True |
+| feedTags | Tags applied to fetched indicators. | False |
+| query_url | The API route of the requested information in ServiceNow. | False |
+| indicator_field | Field used to build indicator values. | False |


The indicator_field parameter is incorrectly marked as not required.

marketplace-ai-reviewer · 2026-04-06T12:52:08Z

Packs/ServiceNowGenericFeed/pack_metadata.json

@@ -0,0 +1,27 @@
+{
+    "name": "ServcieNowGenericFeed",
+    "description": "This pack contains an integration that can be used to pull indicators form ServiceNow CMDB and put them inside the XSIAM TIM with the option to provide tagging.",


Suggested change

"description": "This pack contains an integration that can be used to pull indicators form ServiceNow CMDB and put them inside the XSIAM TIM with the option to provide tagging.",

"description": "Integrate with ServiceNow CMDB to pull indicators into XSIAM TIM with tagging options.",

marketplace-ai-reviewer · 2026-04-06T12:52:08Z

Packs/ServiceNowGenericFeed/pack_metadata.json

+        "TIM"
+    ],
+    "useCases": [],
+    "keywords": [],


Suggested change

"keywords": [],

"keywords": [

"ServiceNow"

],

marketplace-ai-reviewer · 2026-04-06T12:52:08Z

Packs/ServiceNowGenericFeed/pack_metadata.json

+    "devEmail": [
+        "anmishra@nd.gov"
+    ],
+    "githubUser": []


Please provide valid GitHub usernames in the githubUser list.

ServiceNowGenericFeed

7572df6

Copilot AI review requested due to automatic review settings April 1, 2026 20:33

Copilot started reviewing on behalf of 4nshumaan April 1, 2026 20:34 View session

content-bot added Contribution Thank you! Contributions are always welcome! External PR Community Support Level Indicates that the contribution is for Community supported pack labels Apr 1, 2026

content-bot changed the base branch from master to contrib/4nshumaan_ServiceNowGenericFeed-Pack April 1, 2026 20:35

content-bot assigned kamalq97 Apr 1, 2026

content-bot requested a review from kamalq97 April 1, 2026 20:35

content-bot added Community Contribution Form Filled Whether contribution form filled or not. labels Apr 1, 2026

Copilot AI reviewed Apr 1, 2026

View reviewed changes

marketplace-ai-reviewer removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Apr 6, 2026

content-bot removed the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Apr 6, 2026

marketplace-ai-reviewer reviewed Apr 6, 2026

View reviewed changes

	"name": "ServcieNowGenericFeed",
	"name": "ServiceNowGenericFeed",

		API_VERSION = "/api/now/cmdb/instance/"
		ROOT_URL = "https://company-domain.service-now.com"

	- This integration can be used to pull indicators form Service Now with a given user query and add them to the Threat Intelligence Module.
	- This integration can be used to pull indicators from ServiceNow with a given user query and add them to the Threat Intelligence Module.

	"description": "This pack contains an integration that can be used to pull indicators form ServiceNow CMDB and put them inside the XSIAM TIM with the option to provide tagging.",
	"description": "This pack contains an integration that can be used to pull indicators from ServiceNow CMDB and put them inside the XSIAM TIM with the option to provide tagging.",

		\| query_url \| The API route of the requested information in ServiceNow. \| False \|
		\| indicator_field \| Field used to build indicator values. \| False \|

-        indicator_type = auto_detect_indicator_type(ind.get(indicator_field))
-        indicator_obj = {
-            "value": ind.get(indicator_field),
+        value = ind.get(indicator_field)
+        if not value:
+            # Skip records without the requested indicator field or with an empty value
+            continue
+        indicator_type = auto_detect_indicator_type(value)
+        if not indicator_type:
+            # Skip records for which the indicator type cannot be detected
+            continue
+        indicator_obj = {
+            "value": value,

		ROOT_URL = "https://company-domain.service-now.com"


		class Client(BaseClient):

		"""COMMAND FUNCTIONS"""


		def test_module(client: Client) -> str:

		return "Test failed. Please check your instance URL and credentials."


		def list_records_from_url(client: Client, server_url: str) -> tuple:

	"description": "This pack contains an integration that can be used to pull indicators form ServiceNow CMDB and put them inside the XSIAM TIM with the option to provide tagging.",
	"description": "Integrate with ServiceNow CMDB to pull indicators into XSIAM TIM with tagging options.",

Conversation

4nshumaan commented Apr 1, 2026 • edited by marketplace-content-sync Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contributing to Cortex XSOAR Content

Status

Related Issues

Uh oh!

content-bot commented Apr 1, 2026

Uh oh!

content-bot commented Apr 1, 2026

Uh oh!

content-bot commented Apr 1, 2026

🤖 AI-Powered Code Review Available

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer commented Apr 6, 2026

Uh oh!

content-bot commented Apr 6, 2026

Uh oh!

content-bot commented Apr 6, 2026

Uh oh!

content-bot commented Apr 6, 2026

Uh oh!

marketplace-ai-reviewer commented Apr 6, 2026

Uh oh!

marketplace-ai-reviewer left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

4nshumaan commented Apr 1, 2026 •

edited by marketplace-content-sync

Loading