SWQL query to display Alert Action and contents of CreateSniTicket field

jm-es

Has anyone any ideas on how to join information from the ServiceNow integration tooling into queries about alert actions?
What I need to do is to find Alert Actions that contain the CreateSniTicket action type - and then pull out the fields that are within that integration tool.
The purpose is to update a pile of URLs that are dropped into incidents created to point to a new URL.


I used a SWQL query that a kind user posted to see all the Alert Actions that call on the ServiceNow Integration plugin, but I am lost on how to then join data from the fields configured within that plugin.

SELECT ac.Name, ac.Description, ac.CreatedBy, ac.AlertMessage, aa.CategoryType, a.ActionTypeID, a.Description

FROM Orion.AlertConfigurations ac

join Orion.ActionsAssignments aa on aa.parentid=ac.alertid and aa.EnvironmentType='Alerting'

join Orion.Actions a on a.actionid=aa.ActionID

where ac.enabled=1 and a.ActionTypeID='CreateSniTicket'

order by name, categorytype desc, sortorder

KMSigma.SWI

I don't have ServiceNow integrated with my lab, but I'm taking my best guess on this.

SELECT [AlertConfigs].AlertID
     , [AlertConfigs].AlertMessage
     , [AlertConfigs].Name
     , [AlertConfigs].Description
     , [AlertConfigs].AlertObject.AlertIncident.IncidentID AS [Incident]
     , [AlertConfigs].AlertObject.AlertIncident.Actions.ActionTypeID AS [ActionType]
     , [AlertConfigs].AlertObject.AlertIncident.Actions.Properties.PropertyName
     , [AlertConfigs].AlertObject.AlertIncident.Actions.Properties.PropertyValue
FROM Orion.AlertConfigurations AS [AlertConfigs]
WHERE [AlertConfigs].AlertObject.AlertIncident.Actions.ActionTypeID = 'CreateSniTicket'