{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":29378,"path":"it-operations-management/configure-integration-agents-for-now-assist.md","title":"Configure observability agents for ServiceNow Otto","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure observability agents for ServiceNow Otto\n\nConfigure observability agents for third-party application performance monitoring \\(APM\\) or network performance monitoring \\(NPM\\) vendors. These agents are invoked by the analyze alert impact agentic workflow. You must configure connections to those vendors before they can be invoked.\n\n**Important:** This AI agent is turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/now-assist-skills-on-by-default.md).\n\nAfter you configure the agent\\(s\\), they can surface information from alerts generated by third-party systems to help you investigate alerts and incidents in the Service Operations Workspace.\n\nConnections to vendors use MCP when possible, otherwise they use an API connection. You need connection and credential information to complete the connection process as shown in the following tables.\n\n**Note:** These agents are different from the data sources used in the Service Observability dashboards.\n\n## Before you begin\n\nBefore configuring the integration agents, you must do the following:\n\n- [Install ServiceNow Otto for IT Operations Management \\(ITOM\\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/install-now-assist-feature-plugins.md).\n- [Integrate third-party alerts with Event Management](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2113973).\n- Copy the connection requirements for the vendor as noted in the following tables. You will need these to create credentials and connections to the third-party vendor.\n\nRole required: connection\\_admin and credential\\_admin\n\n## AWS CloudWatch MCP\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nAWS CloudWatch MCP Server Agent\n\n
\n\nOverview of data returned\n\n\n\nAlarm details, metric trend analysis, CloudWatch logs \\(anomalies, error patterns, log insights queries\\), CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps\n\n
\n\nCredential & Connection Alias name\n\n\n\nAWS CloudWatch MCP server\n\n
\n\nConnection type\n\n\n\nMCP\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nConnection URL\n\n\n\n`https://your-mcp-server-host/mcp`\n\n This assumes you have deployed the CloudWatch MCP server using a MID Server instead of a publicly exposed EC2 instance. For more information about deploying the MCP server, see the [AWS CloudWatch MCP Server — MID Server Deployment Guide \\[KB3030674\\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3030674) article in the Now Support Knowledge Base.\n\n
\n\nRequired credentials\n\n\n\n- AWS access key ID\n- AWS secret access key\n\n
\n\nRequired scope\n\n\n\nAWS IAM permissions:\n\n - `cloudwatch:Describe*`\n- `cloudwatch:Get*`\n- `cloudwatch:List*`\n- `logs:Describe*`\n- `logs:Get*`\n- `logs:StartQuery`\n- `logs:StopQuery`\n- `logs:GetQueryResults`\n\n
## AWS CloudWatch API\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nAWS CloudWatch API Agent\n\n
\n\nOverview of data returned\n\n\n\nAlarm details, metric trend analysis, CloudWatch logs \\(anomalies, error patterns, log insights queries\\), CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps\n\n
\n\nCredential & Connection Alias name\n\n\n\nAWS CloudWatch API Credentials\n\n
\n\nConnection type\n\n\n\nAPI \\(MCP fallback mechanism\\)\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nConnection URL\n\n\n\nN/A\n\n
\n\nCredential type\n\n\n\nAWS Credentials\n\n
\n\nAuthentication algorithm\n\n\n\nAWS CloudWatch Algorithm\n\n
\n\nRequired credentials\n\n\n\n- AWS access key ID\n- AWS secret access key\n\n
\n\nRequired scope\n\n\n\nAWS IAM permissions:\n\n - `cloudwatch:Describe*`\n- `cloudwatch:Get*`\n- `cloudwatch:List*`\n- `logs:Describe*`\n- `logs:Get*`\n- `logs:StartQuery`\n- `logs:StopQuery`\n- `logs:GetQueryResults`\n\n
## Datadog\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nDatadog APM MCP Server Agent\n\n
\n\nOverview of data returned\n\n\n\nService health, distributed traces, triggered monitors, log analysis, incidents, SLO compliance, deployment events, and service dependencies\n\n
\n\nCredential & Connection Alias name\n\n\n\nDatadog APM MCP Connection\n\n
\n\nConnection type\n\n\n\nMCP\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nConnection URL\n\n\n\n`https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core,alerting,apm,error-tracking`\n\n
\n\nRequired credentials\n\n\n\n- Datadog API key\n- Datadog application key\n\n
\n\nRequired scope\n\n\n\n- `mcp_read`\n- `apm_read`\n- `timeseries_query`\n- `dashboards_read`\n- `logs_read_data`\n- `logs_read_index_data`\n- `user_access_read`\n- `apm_service_catalog_read`\n- `teams_read`\n- `slos_read`\n- `metrics_read`\n- `cloud_cost_management_read`\n- `incident_read`\n- `monitors_read`\n\n
## Dynatrace\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nDynatrace MCP Server Agent\n\n
\n\nOverview of data returned\n\n\n\nInsights about logs, topology, recent changes, root causes, impacted entities, and environments.\n\n
\n\nCredential & Connection Alias name\n\n\n\nDynatrace MCP server\n\n
\n\nConnection type\n\n\n\nMCP\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nConnection URL\n\n\n\nURL of your Dynatrace instance. Dynatrace URLs follow this format:\n\n `https://.apps.dynatrace.com/platform-reserved/mcp-gateway/v0.1/servers/dynatrace-mcp/mcp`\n\n
\n\nRequired credentials\n\n\n\nPlatform token \\(must be prefixed with `Bearer`\\). For example, `Bearer dt0s01.STABCDEF12345.G3HIJKLMNOP`.\n\n
\n\nRequired scope\n\n\n\nIAM policy and group assignment that allows the following scopes:\n\n - `davis-copilot:nl2dql:execute`\n- `davis-copilot:dql2nl:execute`\n- `davis-copilot:conversations:execute`\n- `davis:analyzers:read`\n- `davis:analyzers:execute`\n- `mcp-gateway:servers:invoke`\n- `mcp-gateway:servers:read`\n- `storage:buckets:read`\n- `storage:logs:read`\n- `storage:events:read`\n- `storage:security.events:read`\n- `storage:metrics:read`\n- `storage:bizevents:read`\n- `storage:spans:read`\n- `storage:entities:read`\n- `storage:smartscape:read`\n- `storage:system:read`\n\n
\n\nRequired Dynatrace Intelligence settings\n\n\n\n- Enable generative AI\n- Enable document suggestions\n- Enable environment-aware queries\n\n
## Google Cloud\n\n**Note:** Before configuring this connection, create a keystore file by following the steps in [Create a Java KeyStore certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/setup-google-translator.md).\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nGemini Cloud Assist A2A Investigation Agent\n\n
\n\nOverview of data returned\n\n\n\nSummary, findings, root-cause hypotheses, next steps, impact on affected Google Cloud resources, ownership, recommended actions, supporting evidence, and sources\n\n
\n\nCredential & Connection Alias name\n\n\n\nGoogle Gemini Cloud Assist Agent\n\n
\n\nConnection type\n\n\n\nAgent-to-agent\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nRequired credentials\n\n\n\n- Google Project ID\n- Service Account Email\n- Private Key ID\n- Keystore Password\n- Keystore file \\(`.jks`\\)\n\n
\n\nRequired scope\n\n\n\nGoogle Cloud IAM permissions:- Assign the Investigation Creator role to the service account\n- Give the service account read-access to the resources that you want it to investigate\n\n
\n\nRequired Google Cloud settings\n\n\n\n- Enable the required APIs for your Google Cloud project: `logging.googleapis.com`, `monitoring.googleapis.com`, `cloudresourcemanager.googleapis.com`, and `geminicloudassist`\n- Gemini Cloud Assist must be set up in the Google Cloud project\n\n
## Kentik\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nKentik analysis AI agent\n\n
\n\nOverview of data returned\n\n\n\nService network performance, connectivity, DDOS attacks, and anomalies\n\n
\n\nCredential & Connection Alias name\n\n\n\nKentik analysis AI agent\n\n
\n\nConnection type\n\n\n\nAPI\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nConnection URL\n\n\n\nURL of your Kentik instance. Kentik URLs follow this format:\n\n `https://.api.kentik.com`\n\n
\n\nRequired credentials\n\n\n\n- User email\n- API token\n\n
\n\nRequired scope\n\n\n\nCan view devices\n\n
## LogicMonitor\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nLogicMonitor API Agent\n\n
\n\nOverview of data returned\n\n\n\nAlert details, metric trend analysis, device properties and classification, collector health, SDT/maintenance windows, related entity topology, CMDB service associations, recent ServiceNow Change records, top processes, and root cause analysis with verdict \\(degraded / healthy / cleared-and-sustained / likely-false-positive / inconclusive\\) and recommended next steps.\n\n
\n\nCredential & Connection Alias name\n\n\n\nLogicMonitor API connection\n\n
\n\nConnection type\n\n\n\nAPI\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nConnection URL\n\n\n\n`https://.logicmonitor.com/santaba/rest`\n\n Replace `` with your LogicMonitor portal subdomain.\n\n
\n\nRequired credentials\n\n\n\nAPI bearer token: An LMv2 personal access token\n\n
\n\nRequired scope\n\n\n\nLogicMonitor API v3 read-only access: Devices \\(view\\), Alerts \\(view\\), Dashboards/Metrics \\(view\\), Collectors \\(view\\), SDTs \\(view\\), Device Groups \\(view\\). The API token inherits the creating user's role. Any user with the default read only or administrator role has sufficient access.\n\n
## Microsoft Azure\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nAzure Monitor MCP Agent\n\n
\n\nOverview of data returned\n\n\n\nAlert details, resource health status, activity logs, Log Analytics query results, metric trend analysis, CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps\n\n
\n\nCredential & Connection Alias name\n\n\n\nAzure Monitor MCP Connection\n\n
\n\nConnection type\n\n\n\nMCP\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nConnection URL\n\n\n\n`http://`\n\n
\n\nRequired credentials\n\n\n\n- Azure connection URL\n- Azure username\n- Azure password\n\n
\n\nRequired scope\n\n\n\n- Reader role on target Azure subscriptions\n- Log Analytics Reader role on target Log Analytics workspaces\n\n
\n\nRequired Microsoft Azure settings\n\n\n\n- Microsoft Azure MCP Server must be deployed and reachable\n- Log Analytics workspaces must exist in the target subscription\n- Azure Monitor must be enabled for target resources\n\n
## New Relic\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nNew Relic MCP Server Agent\n\n
\n\nOverview of data returned\n\n\n\nService and user impact, root cause theories, and responsible teams.\n\n
\n\nCredential & Connection Alias name\n\n\n\nNew Relic MCP Connection\n\n
\n\nConnection type\n\n\n\nMCP\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nConnection URL\n\n\n\n`https://mcp.newrelic.com/mcp/`\n\n
\n\nRequired credentials\n\n\n\nAPI key \\(also known as \"User Key\"\\)\n\n Header name: `api-key`\n\n
\n\nRequired scope\n\n\n\nN/A\n\n
## Prometheus\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nPrometheus API Agent\n\n
\n\nOverview of data returned\n\n\n\nPromQL metric queries \\(CPU, memory, disk, network\\), active alerts, alert rule definitions, and scrape target health\n\n
\n\nCredential & Connection Alias name\n\n\n\nPrometheus connection\n\n
\n\nConnection type\n\n\n\nAPI\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nConnection URL\n\n\n\n`https://`\n\n
\n\nRequired credentials\n\n\n\n- MID Server Prometheus is installed on\n- User name \\(for outbound connection\\)\n- Password \\(for outbound connection\\)\n\n
\n\nRequired scope\n\n\n\nN/A\n\n
## SolarWinds\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nSolarWinds analysis AI agent\n\n
\n\nOverview of data returned\n\n\n\nOn-premises data from SolarWinds Orion: node health/status, CPU/memory, packet loss/latency, interface utilization/errors/discards, active alerts/history, affected entities/services, and trend/baseline metrics used for root-cause investigation\n\n
\n\nCredential & Connection Alias name\n\n\n\nSolarWinds AI Agent\n\n
\n\nConnection type\n\n\n\nAPI\n\n
\n\nReturned data type\n\n\n\nNPM\n\n
\n\nConnection URL\n\n\n\n`https://`\n\n
\n\nRequired credentials\n\n\n\n- MID Server SolarWinds is installed on\n- User name\n- Password\n\n
\n\nRequired scope\n\n\n\nSolarWinds Orion API/SWQL read access \\(NPM/APM\\) via MID Server\n\n
## Splunk\n\n\n
\n\nConnection information\n\n\n\nValue\n\n
\n\nAgent name\n\n\n\nSplunk MCP Server Agent\n\n
\n\nOverview of data returned\n\n\n\nSPL query results from Splunk indexes, index/sourcetype metadata, and structured investigation findings including affected entities, root cause analysis, and recommended actions\n\n
\n\nCredential & Connection Alias name\n\n\n\nSplunk MCP Connection\n\n
\n\nConnection type\n\n\n\nMCP\n\n
\n\nReturned data type\n\n\n\nAPM\n\n
\n\nConnection URL\n\n\n\n`https://.splunkcloud.com`\n\n
\n\nRequired credentials\n\n\n\nSplunk MCP token\n\n
\n\nRequired scope\n\n\n\nFor Splunk token generation:\n\n - `mcp_user` role \\(or any role with `mcp_tool_execute`\\) required for all MCP tool calls\n- Search capability and read access to the relevant indexes for running queries\n- Knowledge object read permissions for Get Knowledge Objects\n- Token must be generated using the Splunk MCP Server app with `audience = mcp` \\(not a standard Splunk API token\\)\n\n
## ThousandEyes\n\n|Connection information|Value|\n|----------------------|-----|\n|Agent name|ThousandEyes MCP Server Agent|\n|Overview of data returned|Test configuration and status, aggregated metrics \\(response time, packet loss, latency, jitter, throughput, availability\\), metric anomalies with deviation analysis, network events and routing changes, ISP/network outages with provider and ASN details, hop-by-hop path visualization, and root cause analysis with ranked probable causes and recommended next steps|\n|Credential & Connection Alias name|ThousandEyes MCP Connection|\n|Connection type|MCP|\n|Returned data type|NPM|\n|Connection URL|`https://api.thousandeyes.com/mcp`|\n|Required credentials|API key prefixed with `Bearer`. For example, `Bearer `.|\n|Required scope|ThousandEyes API access with permissions to read tests, metrics, anomalies, events, outages, and path visualization data|\n\n## Procedure\n\n1. Navigate to **All** > **sys\\_alias.LIST**.\n2. Search for and select the vendor's connection name as shown in the preceding tables.\n3. Select **Create New Connection & Credential**.\n4. Fill in the form, using the information in the preceding tables.\n5. Select **Create**.\n\n Your connection appears in the **Connections** tab.\n\n\nThe agents are now ready to be used by the [analyze alert impact agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/now-assist-itom-agentic-aia.md)\n\n**Parent Topic:**[Configuring Service Operations Workspace for ITOM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/configure-sow-itom.md)\n\n"}}