AustraliaREFERENCE GUIDE

Configure observability agents for ServiceNow Otto

ServiceNow documentation·9 min readView source ↗

On this page

Configure observability agents for ServiceNow Otto

Configure observability agents for third-party application performance monitoring (APM) or network performance monitoring (NPM) vendors. These agents are invoked by the analyze alert impact agentic workflow. You must configure connections to those vendors before they can be invoked.

Important: This AI agent is turned on by default. For more information, see AI agents, skills, and agentic workflows on by default.

After you configure the agent(s), they can surface information from alerts generated by third-party systems to help you investigate alerts and incidents in the Service Operations Workspace.

Connections to vendors use MCP when possible, otherwise they use an API connection. You need connection and credential information to complete the connection process as shown in the following tables.

Note: These agents are different from the data sources used in the Service Observability dashboards.

Before you begin

Before configuring the integration agents, you must do the following:

Install ServiceNow Otto for IT Operations Management (ITOM).
Integrate third-party alerts with Event Management.
Copy the connection requirements for the vendor as noted in the following tables. You will need these to create credentials and connections to the third-party vendor.

Role required: connection_admin and credential_admin

AWS CloudWatch MCP

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

AWS CloudWatch MCP Server Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Alarm details, metric trend analysis, CloudWatch logs (anomalies, error patterns, log insights queries), CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

AWS CloudWatch MCP server

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

https://your-mcp-server-host/mcp

This assumes you have deployed the CloudWatch MCP server using a MID Server instead of a publicly exposed EC2 instance. For more information about deploying the MCP server, see the AWS CloudWatch MCP Server — MID Server Deployment Guide [KB3030674] article in the Now Support Knowledge Base.

</td></tr><tr><td>

Required credentials

</td><td>

AWS access key ID
AWS secret access key

</td></tr><tr><td>

Required scope

</td><td>

AWS IAM permissions:

cloudwatch:Describe*
cloudwatch:Get*
cloudwatch:List*
logs:Describe*
logs:Get*
logs:StartQuery
logs:StopQuery
logs:GetQueryResults

</td></tr></tbody> </table>## AWS CloudWatch API

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

AWS CloudWatch API Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

AWS CloudWatch API Credentials

</td></tr><tr><td>

Connection type

</td><td>

API (MCP fallback mechanism)

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

N/A

</td></tr><tr><td>

Credential type

</td><td>

AWS Credentials

</td></tr><tr><td>

Authentication algorithm

</td><td>

AWS CloudWatch Algorithm

</td></tr><tr><td>

Required credentials

</td><td>

AWS access key ID
AWS secret access key

</td></tr><tr><td>

Required scope

</td><td>

AWS IAM permissions:

cloudwatch:Describe*
cloudwatch:Get*
cloudwatch:List*
logs:Describe*
logs:Get*
logs:StartQuery
logs:StopQuery
logs:GetQueryResults

</td></tr></tbody> </table>## Datadog

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Datadog APM MCP Server Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Service health, distributed traces, triggered monitors, log analysis, incidents, SLO compliance, deployment events, and service dependencies

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

Datadog APM MCP Connection

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core,alerting,apm,error-tracking

</td></tr><tr><td>

Required credentials

</td><td>

Datadog API key
Datadog application key

</td></tr><tr><td>

Required scope

</td><td>

mcp_read
apm_read
timeseries_query
dashboards_read
logs_read_data
logs_read_index_data
user_access_read
apm_service_catalog_read
teams_read
slos_read
metrics_read
cloud_cost_management_read
incident_read
monitors_read

</td></tr></tbody> </table>## Dynatrace

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Dynatrace MCP Server Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Insights about logs, topology, recent changes, root causes, impacted entities, and environments.

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

Dynatrace MCP server

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

URL of your Dynatrace instance. Dynatrace URLs follow this format:

https://<your-resource-name>.apps.dynatrace.com/platform-reserved/mcp-gateway/v0.1/servers/dynatrace-mcp/mcp

</td></tr><tr><td>

Required credentials

</td><td>

Platform token (must be prefixed with Bearer). For example, Bearer dt0s01.STABCDEF12345.G3HIJKLMNOP.

</td></tr><tr><td>

Required scope

</td><td>

IAM policy and group assignment that allows the following scopes:

davis-copilot:nl2dql:execute
davis-copilot:dql2nl:execute
davis-copilot:conversations:execute
davis:analyzers:read
davis:analyzers:execute
mcp-gateway:servers:invoke
mcp-gateway:servers:read
storage:buckets:read
storage:logs:read
storage:events:read
storage:security.events:read
storage:metrics:read
storage:bizevents:read
storage:spans:read
storage:entities:read
storage:smartscape:read
storage:system:read

</td></tr><tr><td>

Required Dynatrace Intelligence settings

</td><td>

Enable generative AI
Enable document suggestions
Enable environment-aware queries

</td></tr></tbody> </table>## Google Cloud

Note: Before configuring this connection, create a keystore file by following the steps in Create a Java KeyStore certificate.

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Gemini Cloud Assist A2A Investigation Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Summary, findings, root-cause hypotheses, next steps, impact on affected Google Cloud resources, ownership, recommended actions, supporting evidence, and sources

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

Google Gemini Cloud Assist Agent

</td></tr><tr><td>

Connection type

</td><td>

Agent-to-agent

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Required credentials

</td><td>

Google Project ID
Service Account Email
Private Key ID
Keystore Password
Keystore file (.jks)

</td></tr><tr><td>

Required scope

</td><td>

Google Cloud IAM permissions:- Assign the Investigation Creator role to the service account - Give the service account read-access to the resources that you want it to investigate

</td></tr><tr><td>

Required Google Cloud settings

</td><td>

Enable the required APIs for your Google Cloud project: logging.googleapis.com, monitoring.googleapis.com, cloudresourcemanager.googleapis.com, and geminicloudassist
Gemini Cloud Assist must be set up in the Google Cloud project

</td></tr></tbody> </table>## Kentik

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Kentik analysis AI agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Service network performance, connectivity, DDOS attacks, and anomalies

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

Kentik analysis AI agent

</td></tr><tr><td>

Connection type

</td><td>

API

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

URL of your Kentik instance. Kentik URLs follow this format:

https://<your-resource-name>.api.kentik.com

</td></tr><tr><td>

Required credentials

</td><td>

User email
API token

</td></tr><tr><td>

Required scope

</td><td>

Can view devices

</td></tr></tbody> </table>## LogicMonitor

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

LogicMonitor API Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Alert details, metric trend analysis, device properties and classification, collector health, SDT/maintenance windows, related entity topology, CMDB service associations, recent ServiceNow Change records, top processes, and root cause analysis with verdict (degraded / healthy / cleared-and-sustained / likely-false-positive / inconclusive) and recommended next steps.

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

LogicMonitor API connection

</td></tr><tr><td>

Connection type

</td><td>

API

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

https://<account>.logicmonitor.com/santaba/rest

Replace <account> with your LogicMonitor portal subdomain.

</td></tr><tr><td>

Required credentials

</td><td>

API bearer token: An LMv2 personal access token

</td></tr><tr><td>

Required scope

</td><td>

LogicMonitor API v3 read-only access: Devices (view), Alerts (view), Dashboards/Metrics (view), Collectors (view), SDTs (view), Device Groups (view). The API token inherits the creating user’s role. Any user with the default read only or administrator role has sufficient access.

</td></tr></tbody> </table>## Microsoft Azure

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Azure Monitor MCP Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Alert details, resource health status, activity logs, Log Analytics query results, metric trend analysis, CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

Azure Monitor MCP Connection

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

http://<your-azure-mcp-server>

</td></tr><tr><td>

Required credentials

</td><td>

Azure connection URL
Azure username
Azure password

</td></tr><tr><td>

Required scope

</td><td>

Reader role on target Azure subscriptions
Log Analytics Reader role on target Log Analytics workspaces

</td></tr><tr><td>

Required Microsoft Azure settings

</td><td>

Microsoft Azure MCP Server must be deployed and reachable
Log Analytics workspaces must exist in the target subscription
Azure Monitor must be enabled for target resources

</td></tr></tbody> </table>## New Relic

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

New Relic MCP Server Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Service and user impact, root cause theories, and responsible teams.

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

New Relic MCP Connection

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

https://mcp.newrelic.com/mcp/

</td></tr><tr><td>

Required credentials

</td><td>

API key (also known as “User Key”)

Header name: api-key

</td></tr><tr><td>

Required scope

</td><td>

N/A

</td></tr></tbody> </table>## Prometheus

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Prometheus API Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

PromQL metric queries (CPU, memory, disk, network), active alerts, alert rule definitions, and scrape target health

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

Prometheus connection

</td></tr><tr><td>

Connection type

</td><td>

API

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

https://<your-onprem-prometheus-server>

</td></tr><tr><td>

Required credentials

</td><td>

MID Server Prometheus is installed on
User name (for outbound connection)
Password (for outbound connection)

</td></tr><tr><td>

Required scope

</td><td>

N/A

</td></tr></tbody> </table>## SolarWinds

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

SolarWinds analysis AI agent

</td></tr><tr><td>

Overview of data returned

</td><td>

On-premises data from SolarWinds Orion: node health/status, CPU/memory, packet loss/latency, interface utilization/errors/discards, active alerts/history, affected entities/services, and trend/baseline metrics used for root-cause investigation

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

SolarWinds AI Agent

</td></tr><tr><td>

Connection type

</td><td>

API

</td></tr><tr><td>

Returned data type

</td><td>

NPM

</td></tr><tr><td>

Connection URL

</td><td>

https://<your-onprem-solarwinds-server>

</td></tr><tr><td>

Required credentials

</td><td>

MID Server SolarWinds is installed on
User name
Password

</td></tr><tr><td>

Required scope

</td><td>

SolarWinds Orion API/SWQL read access (NPM/APM) via MID Server

</td></tr></tbody> </table>## Splunk

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Splunk MCP Server Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

SPL query results from Splunk indexes, index/sourcetype metadata, and structured investigation findings including affected entities, root cause analysis, and recommended actions

</td></tr><tr><td>

Credential & Connection Alias name

</td><td>

Splunk MCP Connection

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

https://<your-splunk-instance>.splunkcloud.com

</td></tr><tr><td>

Required credentials

</td><td>

Splunk MCP token

</td></tr><tr><td>

Required scope

</td><td>

For Splunk token generation:

mcp_user role (or any role with mcp_tool_execute) required for all MCP tool calls
Search capability and read access to the relevant indexes for running queries
Knowledge object read permissions for Get Knowledge Objects
Token must be generated using the Splunk MCP Server app with audience = mcp (not a standard Splunk API token)

</td></tr></tbody> </table>## ThousandEyes

Connection information Value Agent name ThousandEyes MCP Server Agent Overview of data returned Test configuration and status, aggregated metrics (response time, packet loss, latency, jitter, throughput, availability), metric anomalies with deviation analysis, network events and routing changes, ISP/network outages with provider and ASN details, hop-by-hop path visualization, and root cause analysis with ranked probable causes and recommended next steps Credential & Connection Alias name ThousandEyes MCP Connection Connection type MCP Returned data type NPM Connection URL https://api.thousandeyes.com/mcp Required credentials API key prefixed with Bearer. For example, Bearer <api-key>. Required scope ThousandEyes API access with permissions to read tests, metrics, anomalies, events, outages, and path visualization data

Procedure

Navigate to All > sys_alias.LIST.
Search for and select the vendor's connection name as shown in the preceding tables.
Select Create New Connection & Credential.
Fill in the form, using the information in the preceding tables.
Select Create.

Your connection appears in the Connections tab.

The agents are now ready to be used by the analyze alert impact agentic workflow

Parent Topic:Configuring Service Operations Workspace for ITOM

Keep exploring.

Find another answer, or bring this documentation into your own tools.

Search the library →Read via the REST API ↗