Skip to content

RHACS → ServiceNow Webhook

ACS → ServiceNow

Generic Webhook integration from Red Hat Advanced Cluster Security for Kubernetes to ServiceNow Scripted REST, creating Incident records from policy violations.

Documentation Map

Pick by problem. Each route lands on the page that actually answers the question, not a landing page that defers again.

Route By Intent

I need to… Start here Then
decide if this integration is the right fit Capabilities Use cases
stand up the ServiceNow side ServiceNow Setup Handler Script
stand up the RHACS side RHACS Setup Webhook Payload
understand what the handler actually does with a payload Handler Script Incident Fields
confirm which RHACS JSON fields the integration reads Webhook Payload Handler Script
map RHACS severity to ServiceNow urgency + impact Severity Mapping Incident Fields
triage an exec-into-pod violation end-to-end Exec-into-Pod Triage Handler Script
stop alert storms from overwhelming Incident Dedup + Storm Control Capabilities
troubleshoot “Description field not showing” in the Incident form Incident Fields

Page Types

Type Reads like Examples
Setup one-time install steps, ordered ServiceNow, RHACS
Reference field/line-level facts, scannable Handler Script, Payload, Incident Fields
Capabilities what integration does + refuses Capabilities
Practical use case operator workflow with problem + pattern Exec-into-Pod, Severity mapping, Dedup

Practical Use Cases

Read Order For First-Time Setup

  1. Capabilities — confirm this integration matches what you actually need
  2. ServiceNow Setup — endpoint exists before RHACS can POST
  3. RHACS Setup — notifier + policy attachment
  4. Exec-into-Pod Use Case — smoke-test with a known trigger
  5. Severity Mapping — tune priority before real rollout