Instance Observer integration with Incident Response

ServiceNow Instance Observer is a tool offered to ServiceNow customers to manage all the instances that they have. Lightstep Incident Response is the incident response solution for alerting the customer if there are any issues with their ServiceNow instance.

Before you begin

Role required: Administrator

You will also nee:
  • ServiceNow Instance Observer version 10.0
  • ServiceNow single sign on (SSO)
Note: If you already have an LIR instance that you would like to use with Instance Observer, you must create a customer service case.

You can also refer to the quick reference guide ServiceNow Instance Observer – Lightstep Incident Response integration QuickStart Guide


  1. Log in to ServiceNow Instance Observer.
  2. Navigate to the Alerts tab.
  3. Click Configure Lightstep Incident Response.
    Configure LIR.
  4. In the Configure Lightstep Incident Response page, create the subdomain for your LIR application.
    1. In the Subdomain Name field, enter the name you want for your LIR subdomain.
    2. Accept the terms and conditions.
    3. Click Configure.
    Create the subdomain.


Instance Observer creates the integration with LIR. You can view the integration in the Integrations page under Installed integrations.
  • A webhook URL is created for Instance Observer and the integration is configured in LIR. Instance Observer uses this webhook URL to send alerts to LIR.

    Instance Observed integration created.

  • The user configuring LIR in Instance Observer is automatically added as a user in LIR.

    If a new user logs in to Instance Observer for the same customer account, the user gets an invitation to join the LIR instance as well.

  • A default team is created with the team name <subdomain> default team. The user is added to this team, and an on-call schedule is created.
  • Each instance in Instance Observer is represented by a different service in LIR. These services are assigned to the default team created. If new instances are added, new services will be created for them.
    Note: The services created in LIR for Instance Observer are not billed. However, if you use the LIR instance for other incident response activities, then you will fall under the licensing agreement of LIR, and will be billed based on the usage.
  • Single Sign-on is enabled for the user.

    SSO is enabled.

What to do next