> ## Documentation Index
> Fetch the complete documentation index at: https://docs.incident.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Syncing incidents and follow-ups to ServiceNow
Once you've [set up your integration](/integrations/servicenow) with ServiceNow, you can start to automatically create incidents in ServiceNow from incident.io. That way, you can ensure that all relevant information happening in our platform is also tracked in ServiceNow for any auditing, regulatory or internal process requirements you may have. We will also sync any work notes/comments and image attachments added to your ServiceNow incident back to incident.io.
## Creating (and editing) incident tickets
Once [incident.io](http://incident.io/) is connected to ServiceNow, you'll want to head over to [Settings → Incident tickets](https://app.incident.io/~/settings/incident-tickets).
You'll first need to create an incident ticket template. When we sync information about an incident back to ServiceNow, we will need to know how to populate your required fields (i.e. description, caller), as well as any optional ones.
You can create multiple templates (depending on your billing plan) and use conditions to select which one to use in certain circumstances. For example:
* You could route any engineering-related incidents to Jira
* Then, route any security-related incidents to ServiceNow
Once you have a ServiceNow incident ticket template, you can enable '**Create tickets**.' This is a toggle under the template(s) you just created.
If there are no conditions specified we will use the first template in the list and create a ticket for all incidents. If you only wish to create a ticket for certain incidents (ie. only Security incidents or only those with 'Critical' severity) then you'll need to set up some conditions.
By default if you have created at least one condition we will **not** create a ticket if there is no match.
You can edit this 'no match' fallback behavior to enable always creating a ticket. For example:
* You could export any engineering-related incidents to Jira
* Then, export any security-related incidents to ServiceNow
* If no match, default export to the ServiceNow incident ticket template
## Reusing a ServiceNow ticket from an alert
If you use ServiceNow as an [alert source](/on-call/alert-sources) *and* have incident tickets configured for ServiceNow, an incident created from a ServiceNow alert will **reuse the ServiceNow incident behind that alert as its incident ticket**, rather than opening a second, duplicate one. We then keep that existing ServiceNow incident in sync just like any other incident ticket.
This happens automatically when all of the following are true:
* The incident was created from a **single** ServiceNow alert. If several ServiceNow alerts are grouped into one incident we can't tell which ServiceNow incident to use, so we create a new ticket instead.
* The ServiceNow incident isn't already linked to another incident or follow-up, and still exists.
If any of these aren't true, we fall back to creating a new incident ticket from your template as usual.
## Private incidents
If you do wish to create incidents for private incidents created in [incident.io](http://incident.io/) you can enable this with the checkbox.
## Field mappings between incident.io and ServiceNow
For some additional context when building your incident ticket templates, please view our mappings for fields in [incident.io](http://incident.io/) to ServiceNow.
## Incidents
* Incident name: `short_description`
* Description is as set in your template
* `Incident state`: fixed value 1 (New)
* `urgency`: fixed value 2 (Medium)
* `impact`: fixed value 2 (Medium)
* `opened_by`: fixed value integration\_user
## Follow-ups
* Follow-up title: `short_description`
* Follow-up description: `description`
* Linked incident's `external_issue_reference`: `parent`
* `state`: fixed value 1 (Open)
## State mappings
* 1 (New), 2 (InProgress), 3 (OnHold), 4 (Pending), 5 (AwaitingProblem), all become "Open" in incident.io.
* 6 (Resolved), 7 (Closed) become "Completed"