Explore the latest product updates and best practices at our hybrid Checkmk Conference #12 from June 16-18, 2026 – Register here

Werk #19992: ServiceNow notification plugin: custom fields on recovery, acknowledgement and downtime

Component Notifications
Title ServiceNow notification plugin: custom fields on recovery, acknowledgement and downtime
Date May 15, 2026
Level Trivial Change
Class New Feature
Compatibility Compatible - no manual interaction needed
Checkmk versions & editions
2.6.0b1
Not yet released
Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0p4 Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.4.0p30 Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT

When the ServiceNow notification plug-in updates an existing incident or case (recovery, acknowledgement, downtime start/end/cancel) it sends a PUT with a fixed payload. The fields it sends are hardcoded: on recovery it sets close_code = "Closed/Resolved by Check_MK" plus state, caller_id and close_notes; on acknowledgement and downtime it sets work_notes, caller_id and optionally state.

On ServiceNow instances with mandatory closure fields or non-default close/resolution codes, this fixed payload may not be accepted or may leave the issue in an unwanted state. Until now there was no way to extend or override individual fields from the notification rule.

Three new optional parameters have been added next to the existing Settings for state in case of … blocks in the Incident branch of the rule:

  • Custom fields on recovery
  • Custom fields on acknowledgement
  • Custom fields on downtime

The Case branch gains Custom fields on recovery (cases do not support acknowledgement or downtime notifications in this plug-in).

Each parameter accepts a list of name/value pairs that are merged into the corresponding PUT body, using the same FormSpec layout as the existing Custom fields for issue creation. Values support the usual notification macros.

Names entered here win over the plug-in's hardcoded defaults, so a typical configuration for an instance that requires a closure root cause and a specific close code looks like:

u_root_cause        = software_failure
close_code          = Solved (Permanently)

Fields not listed in the new parameters keep their previous default values (e.g. close_notes from the notification description, state from the Settings for state in case of recovery block, caller_id from the Incident Caller ID).

Leaving the parameters empty preserves the previous behaviour exactly.

To the list of all Werks