HTTP Request and ServiceNow integration

Who’s it for This template is ideal for IT support teams, internal helpdesk automation engineers, and developers building intelligent ticketing systems. It helps streamline ITSM workflows by automatically classifying user queries, retrieving relevant knowledge base entries, and triggering incident creation in ServiceNow. How it works / What it does This workflow uses Google Gemini and Qdrant to power an intelligent ITSM assistant. When a user submits a query via chat: The Text Classifier categorizes the input as an Incident, Request, or Other. Based on the category: Incidents are automatically logged in ServiceNow. Requests trigger an HTTP call (e.g., for provisioning or access). Other queries are routed to an AI Agent that searches the FAQBase in Qdrant and responds contextually. The Gemini LLM enriches responses and summaries. The Qdrant Vector Store retrieves semantically similar answers from a pre-embedded FAQ knowledge base. The Summarization Chain condenses incident details for better tracking. Sticky notes are used throughout the workflow to document each node’s purpose and improve maintainability. How to set up Connect your Google Gemini API, Qdrant, and ServiceNow credentials. Populate the FAQBase collection in Qdrant with your ITSM knowledge base. Deploy the webhook to receive chat inputs. Test the flow using the Manual Trigger node. Customize the classifier categories and Gemini prompts as needed. Requirements Google Gemini API access Qdrant vector database with embedded FAQ data ServiceNow account with API access n8n instance with LangChain nodes installed How to customize the workflow Modify the Text Classifier categories to suit your organization’s ticket types. Add more FAQ entries to Qdrant for broader coverage. Replace the HTTP Request node with integrations relevant to your ITSM tools. Adjust the Gemini prompts to reflect your tone and support style. Extend the workflow with Slack, Teams, or email notifications for ticket updates.

Automated Incident and Request Management in ServiceNow Who’s it for This workflow is designed for IT teams, service desk agents, and operations managers who use ServiceNow. It reduces manual effort by automatically classifying chat messages as Incidents or Requests, creating/updating them in ServiceNow, and summarizing ticket updates. What it does Receives incoming chat messages. Classifies the message as one of: Incident (something broken, unavailable, or a complaint) Request (access, provisioning, product/order related) Follow-ups (incident or request update checks) Update action (user wants to add info to an existing ticket) Everything else (knowledge search / general query). Creates Incidents in ServiceNow via the ServiceNow node. Creates Requests in ServiceNow using the Service Catalog API. Updates existing Incidents with new work notes when the user provides an update. Pulls existing incident/request work notes for summaries. Optionally uses SerpAPI for general queries (if enabled). Returns a concise summary back to the user through the webhook. Requirements ServiceNow account** with API access (Basic Auth) OpenAI API key** (used by the classifier and summarizer) SerpAPI key* *(optional – for general web lookups) Credentials needed You will need to set up the following credentials in n8n: ServiceNow Basic Auth (username, password, instance URL). OpenAI API (API key). SerpAPI (optional – only if you want web search enabled). How to set up Import the workflow JSON into your n8n instance. Create the credentials mentioned above and assign them to the corresponding nodes: Create an incident → ServiceNow Basic Auth HTTP Request1 (for Service Catalog requests) → ServiceNow Basic Auth OpenAI Chat Model / OpenAI Chat Model1 / OpenAI Chat Model2 / OpenAI Chat Model3 → OpenAI API SerpAPI node (optional) → SerpAPI key Adjust the ServiceNow instance URL in the HTTP Request node to match your environment. Deploy the workflow. Send a test chat message to trigger the workflow. How to customize Update the classification rules in the Text Classifier node if your organization uses different definitions for incidents vs. requests. Edit the summary prompt in the Summarization Chain to include or exclude specific fields. Add additional notification nodes (Slack, Teams, or Email) if you want updates pushed to other channels. Notes & Limitations This workflow creates general requests in ServiceNow using the catalog API. For production, update the Service Catalog item ID to match your environment. “Everything else” category uses SerpAPI. If not configured, those queries will not return results. This workflow requires OpenAI GPT-4.1 mini (or another supported model) for classification and summarization.

Short description Automatically triage incoming chat messages into Incidents, Service Requests, or Other using an LLM-powered classifier; create Incidents in ServiceNow, submit Service Catalog requests (HTTP), and route everything else to an AI Agent with web search + memory. Includes an optional summarization step for ticket context. Full description This n8n template wires a chat trigger to an LLM-based Text Classifier and then routes messages to the appropriate downstream action: Trigger: When chat message received — incoming messages from your chat channel. Text Classifier: small LLM prompt/classifier that returns one of three labels: Incident, Request, or Everything Else. Create Incident (ServiceNow connector): when labeled Incident, the workflow creates a Servicenow Incident record (short fields: short\_description, description, priority, caller). Submit General Request (HTTP Request): when labeled Request, the workflow calls your Service Catalog API (POST) to place a catalog item / submit a request. AI Agent: when labeled Everything Else, route to an AI Agent node that: uses an OpenAI chat model for contextual replies, can consult SerpAPI (web search) as a tool, saves relevant context to Simple Memory for future conversations. Summarization Chain: optional chain to summarize long chat threads into concise ticket descriptions before creating incidents/requests. This template is ideal for support desks that want automated triage with human-quality context and searchable memory. Key highlights (what to call out) Three-way LLM triage**: ensures messages are routed automatically to the correct backend action (Incident vs Service Request vs AI handling). ServiceNow native connector**: uses the ServiceNow node to create Incidents (safer than raw HTTP for incidents). Service Catalog via HTTP**: flexible — supports organizations using RESTful catalog endpoints. Summarization before ticket creation**: produces concise, high-quality short_description and description fields. AI Agent + Memory + Web Search**: handles non-ticket queries with web-augmented answers and stores context for follow-ups. Failover & logging**: include a catch node (optional) that logs failures and notifies admins. Required credentials & inputs (must configure) ServiceNow**: Instance URL + API user (must have rights to create incidents). Service Catalog HTTP endpoint**: URL + API key / auth header (for POST). OpenAI API key** (or other LLM provider): for Text Classifier, Summarization Chain, and AI Agent. SerpAPI key** (optional): for web search tools inside the AI Agent. Memory store**: Simple Memory node (or external DB) for conversation history. Nodes included (quick map) Trigger: When chat message received Processor: Text Classifier (OpenAI/LLM) Branch A: ServiceNow (Create Incident) Branch B: HTTP Request (Service Catalog POST) Branch C: AI Agent (OpenAI + SerpAPI + Simple Memory) Shared: Summarization Chain (used before A or B where enabled) Optional: Error / Audit logging node, Slack/email notifications Recommended n8n settings & tips Use structured outputs** from classifier ({ label: "Incident", confidence: 0.92 }) so you can implement confidence thresholds. If confidence < 0.7**, route to a human review queue instead of auto-creating a ticket. Sanitize user PII** before storing in memory or sending to external APIs. Rate-limit** OpenAI/SerpAPI calls to avoid unexpected bills. Test the Service Catalog POST body** in Postman first — include sample variables JSON. Short sample variables JSON (Service Catalog POST) { "sysparm_quantity": 1, "variables": { "description": "User reports VPN timeout on Windows machine; error code 1234" } }

This n8n workflow automatically fetches the latest CVE data at scheduled intervals, extracts relevant security details, and creates a corresponding Security Incident in ServiceNow for each new vulnerability. Schedule Trigger – Runs at predefined intervals. Jina Fetch – Retrieves the latest CVE feed. Information Extractor (OpenAI Chat Model) – Processes and extracts key details from the CVE data. Split Out – Separates each CVE entry for individual processing. Create Incident – Generates a ServiceNow Security Incident with the extracted CVE details. Ideal for security teams to ensure timely tracking and remediation of new vulnerabilities without manual monitoring.

IP Reputation Check & Threat Summary using Splunk + VirusTotal + AlienVault + n8n This workflow automates IP reputation analysis using Splunk alerts, enriches data via VirusTotal and AlienVault OTX, and generates actionable threat summaries for SOC teams — all without any coding. What It Does When a Splunk alert contains a suspicious IP: Ingests the IP** from the Splunk alert via webhook. Performs dual threat enrichment** using: VirusTotal IP reputation & tags. AlienVault OTX pulses, reputation & WHOIS. Merges & processes** threat intel data. Generates a rich HTML summary** for analyst review. Routes action based on severity**: Sends Slack alert for suspicious IPs. Creates an incident in ServiceNow. Emails a formatted HTML report to the SOC inbox. Tech Stack Used Splunk** – SIEM alert source VirusTotal API** – Reputation check & analysis stats AlienVault OTX API** – Community threat intel & pulse info n8n** – For orchestration, merging, summary generation Slack, Gmail, ServiceNow** – For SOC notifications and ticketing Ideal Use Case Perfect for security teams wanting to: Automatically validate IP reputation from SIEM logs Get quick context from multiple threat feeds Generate email-ready reports and escalate high-risk IPs Included Nodes Webhook (Splunk) Function nodes for IOC extraction and intel processing HTTP Request (VirusTotal & AlienVault) Merge + Switch nodes for conditional logic Gmail, Slack, ServiceNow integration Tips Add your VirusTotal and AlienVault credentials in n8n's credential manager. Use the Switch node to route based on your internal threat score logic. Easily extend this to include AbuseIPDB or GreyNoise for deeper enrichment.

Malicious File Detection & Threat Summary Automation using Wazuh + VirusTotal + n8n This workflow helps SOC teams automate the detection and reporting of potentially malicious files using Wazuh alerts, VirusTotal hash validation, and integrated summary/report generation. It's ideal for analysts who want instant context and communication for file-based threats — without writing a single line of code. What It Does When Wazuh detects a suspicious file: Ingests Wazuh Alert** A webhook node captures incoming alerts containing file hashes (SHA256/MD5). Parses IOCs** Extracts relevant indicators (file hash, filename, etc.). Validates with VirusTotal** Automatically checks the file hash reputation using VirusTotal's threat intelligence API. Generates Human-Readable Summary** Outputs a structured file report. Routes Alerts Based on Threat Level** Sends a formatted email with the file summary using Gmail. If the file is deemed malicious/suspicious: Creates a file-related incident ticket. Sends an instant Slack alert to notify the team. Tech Stack Used Wazuh** – For endpoint alerting VirusTotal API** – For real-time hash validation n8n** – To orchestrate, parse, enrich, and communicate Slack, Gmail, Incident Tool** – To notify and take action Ideal Use Case This template is designed for security teams looking to automate file threat triage, IOC validation, and alert-to-ticket escalation, with zero human delay. Included Nodes Webhook** (Wazuh) Function** (IOC extraction and summary) HTTP Request** (VirusTotal) If / Switch** (threat level check) Gmail, **Slack, Incident Creation Tips Make sure to add your VirusTotal API key in the HTTP node. Customize the incident creation node to fit your ticketing platform (Jira, ServiceNow, etc.). Add logic to enrich the file alert further using WHOIS or sandbox reports if needed.