---
title: Configure observability agents for ServiceNow Otto
description: Configure observability agents for third-party application performance monitoring \(APM\) or network performance monitoring \(NPM\) vendors. These agents are invoked by the analyze alert impact agentic workflow. You must configure connections to those vendors before they can be invoked.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/configure-integration-agents-for-now-assist.html
release: australia
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 8
keywords: [ServiceNow Otto, AI Agents, generative AI, agentic AI, AWS CloudWatch MCP, AWS CloudWatch API, Datadog, Dynatrace, Google Cloud, Google Gemini Cloud Assist agent, Google Gemini Cloud Assist skill, Kentik, LogicMonitor, Microsoft Azure, New Relic, Prometheus, SolarWinds, Splunk, ThousandEyes]
breadcrumb: [Configure, ITOM AIOps, IT Operations Management]
---

# Configure observability agents for ServiceNow Otto

Configure observability agents for third-party application performance monitoring \(APM\) or network performance monitoring \(NPM\) vendors. These agents are invoked by the analyze alert impact agentic workflow. You must configure connections to those vendors before they can be invoked.

**Important:** This AI agent is turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/now-assist-skills-on-by-default.md).

After you configure the agent\(s\), they can surface information from alerts generated by third-party systems to help you investigate alerts and incidents in the Service Operations Workspace.

Connections to vendors use MCP when possible, otherwise they use an API connection. You need connection and credential information to complete the connection process as shown in the following tables.

**Note:** These agents are different from the data sources used in the Service Observability dashboards.

## Before you begin

Before configuring the integration agents, you must do the following:

-   [Install ServiceNow Otto for IT Operations Management \(ITOM\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/install-now-assist-feature-plugins.md).
-   [Integrate third-party alerts with Event Management](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2113973).
-   Copy the connection requirements for the vendor as noted in the following tables. You will need these to create credentials and connections to the third-party vendor.

Role required: connection\_admin and credential\_admin

## AWS CloudWatch MCP

<table id="table_i2t_5th_gjc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

AWS CloudWatch MCP Server Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Alarm details, metric trend analysis, CloudWatch logs \(anomalies, error patterns, log insights queries\), CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

AWS CloudWatch MCP server

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

`https://your-mcp-server-host/mcp`

 This assumes you have deployed the CloudWatch MCP server using a MID Server instead of a publicly exposed EC2 instance. For more information about deploying the MCP server, see the [AWS CloudWatch MCP Server — MID Server Deployment Guide \[KB3030674\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3030674) article in the Now Support Knowledge Base.

</td></tr><tr><td>

Required credentials

</td><td>

-   AWS access key ID
-   AWS secret access key

</td></tr><tr><td>

Required scope

</td><td>

AWS IAM permissions:

 -   `cloudwatch:Describe*`
-   `cloudwatch:Get*`
-   `cloudwatch:List*`
-   `logs:Describe*`
-   `logs:Get*`
-   `logs:StartQuery`
-   `logs:StopQuery`
-   `logs:GetQueryResults`

</td></tr></tbody>
</table>## AWS CloudWatch API

<table id="table_aws_api_gjc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

AWS CloudWatch API Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Alarm details, metric trend analysis, CloudWatch logs \(anomalies, error patterns, log insights queries\), CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

AWS CloudWatch API Credentials

</td></tr><tr><td>

Connection type

</td><td>

API \(MCP fallback mechanism\)

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

N/A

</td></tr><tr><td>

Credential type

</td><td>

AWS Credentials

</td></tr><tr><td>

Authentication algorithm

</td><td>

AWS CloudWatch Algorithm

</td></tr><tr><td>

Required credentials

</td><td>

-   AWS access key ID
-   AWS secret access key

</td></tr><tr><td>

Required scope

</td><td>

AWS IAM permissions:

 -   `cloudwatch:Describe*`
-   `cloudwatch:Get*`
-   `cloudwatch:List*`
-   `logs:Describe*`
-   `logs:Get*`
-   `logs:StartQuery`
-   `logs:StopQuery`
-   `logs:GetQueryResults`

</td></tr></tbody>
</table>## Datadog

<table id="table_usq_mvh_gjc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Datadog APM MCP Server Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Service health, distributed traces, triggered monitors, log analysis, incidents, SLO compliance, deployment events, and service dependencies

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

Datadog APM MCP Connection

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

`https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core,alerting,apm,error-tracking`

</td></tr><tr><td>

Required credentials

</td><td>

-   Datadog API key
-   Datadog application key

</td></tr><tr><td>

Required scope

</td><td>

-   `mcp_read`
-   `apm_read`
-   `timeseries_query`
-   `dashboards_read`
-   `logs_read_data`
-   `logs_read_index_data`
-   `user_access_read`
-   `apm_service_catalog_read`
-   `teams_read`
-   `slos_read`
-   `metrics_read`
-   `cloud_cost_management_read`
-   `incident_read`
-   `monitors_read`

</td></tr></tbody>
</table>## Dynatrace

<table id="table_hvw_mvh_gjc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Dynatrace MCP Server Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Insights about logs, topology, recent changes, root causes, impacted entities, and environments.

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

Dynatrace MCP server

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

URL of your Dynatrace instance. Dynatrace URLs follow this format:

 `https://<your-resource-name>.apps.dynatrace.com/platform-reserved/mcp-gateway/v0.1/servers/dynatrace-mcp/mcp`

</td></tr><tr><td>

Required credentials

</td><td>

Platform token \(must be prefixed with `Bearer`\). For example, `Bearer dt0s01.STABCDEF12345.G3HIJKLMNOP`.

</td></tr><tr><td>

Required scope

</td><td>

IAM policy and group assignment that allows the following scopes:

 -   `davis-copilot:nl2dql:execute`
-   `davis-copilot:dql2nl:execute`
-   `davis-copilot:conversations:execute`
-   `davis:analyzers:read`
-   `davis:analyzers:execute`
-   `mcp-gateway:servers:invoke`
-   `mcp-gateway:servers:read`
-   `storage:buckets:read`
-   `storage:logs:read`
-   `storage:events:read`
-   `storage:security.events:read`
-   `storage:metrics:read`
-   `storage:bizevents:read`
-   `storage:spans:read`
-   `storage:entities:read`
-   `storage:smartscape:read`
-   `storage:system:read`

</td></tr><tr><td>

Required Dynatrace Intelligence settings

</td><td>

-   Enable generative AI
-   Enable document suggestions
-   Enable environment-aware queries

</td></tr></tbody>
</table>## Google Cloud

**Note:** Before configuring this connection, create a keystore file by following the steps in [Create a Java KeyStore certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/setup-google-translator.md).

<table id="table_iqq_xqz_1kc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Gemini Cloud Assist A2A Investigation Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Summary, findings, root-cause hypotheses, next steps, impact on affected Google Cloud resources, ownership, recommended actions, supporting evidence, and sources

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

Google Gemini Cloud Assist Agent

</td></tr><tr><td>

Connection type

</td><td>

Agent-to-agent

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Required credentials

</td><td>

-   Google Project ID
-   Service Account Email
-   Private Key ID
-   Keystore Password
-   Keystore file \(`.jks`\)

</td></tr><tr><td>

Required scope

</td><td>

Google Cloud IAM permissions:-   Assign the Investigation Creator role to the service account
-   Give the service account read-access to the resources that you want it to investigate

</td></tr><tr><td>

Required Google Cloud settings

</td><td>

-   Enable the required APIs for your Google Cloud project: `logging.googleapis.com`, `monitoring.googleapis.com`, `cloudresourcemanager.googleapis.com`, and `geminicloudassist`
-   Gemini Cloud Assist must be set up in the Google Cloud project

</td></tr></tbody>
</table>## Kentik

<table id="table_y2j_nvh_gjc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Kentik analysis AI agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Service network performance, connectivity, DDOS attacks, and anomalies

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

Kentik analysis AI agent

</td></tr><tr><td>

Connection type

</td><td>

API

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

URL of your Kentik instance. Kentik URLs follow this format:

 `https://<your-resource-name>.api.kentik.com`

</td></tr><tr><td>

Required credentials

</td><td>

-   User email
-   API token

</td></tr><tr><td>

Required scope

</td><td>

Can view devices

</td></tr></tbody>
</table>## LogicMonitor

<table id="table_vbw_mql_rjc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

LogicMonitor API Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Alert details, metric trend analysis, device properties and classification, collector health, SDT/maintenance windows, related entity topology, CMDB service associations, recent ServiceNow Change records, top processes, and root cause analysis with verdict \(degraded / healthy / cleared-and-sustained / likely-false-positive / inconclusive\) and recommended next steps.

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

LogicMonitor API connection

</td></tr><tr><td>

Connection type

</td><td>

API

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

`https://<account>.logicmonitor.com/santaba/rest`

 Replace `<account>` with your LogicMonitor portal subdomain.

</td></tr><tr><td>

Required credentials

</td><td>

API bearer token: An LMv2 personal access token

</td></tr><tr><td>

Required scope

</td><td>

LogicMonitor API v3 read-only access: Devices \(view\), Alerts \(view\), Dashboards/Metrics \(view\), Collectors \(view\), SDTs \(view\), Device Groups \(view\). The API token inherits the creating user's role. Any user with the default read only or administrator role has sufficient access.

</td></tr></tbody>
</table>## Microsoft Azure

<table id="table_pry_z4z_1kc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Azure Monitor MCP Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Alert details, resource health status, activity logs, Log Analytics query results, metric trend analysis, CMDB resource context, correlated service metrics, and root cause analysis with recommended next steps

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

Azure Monitor MCP Connection

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

`http://<your-azure-mcp-server>`

</td></tr><tr><td>

Required credentials

</td><td>

-   Azure connection URL
-   Azure username
-   Azure password

</td></tr><tr><td>

Required scope

</td><td>

-   Reader role on target Azure subscriptions
-   Log Analytics Reader role on target Log Analytics workspaces

</td></tr><tr><td>

Required Microsoft Azure settings

</td><td>

-   Microsoft Azure MCP Server must be deployed and reachable
-   Log Analytics workspaces must exist in the target subscription
-   Azure Monitor must be enabled for target resources

</td></tr></tbody>
</table>## New Relic

<table id="table_a14_nvh_gjc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

New Relic MCP Server Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

Service and user impact, root cause theories, and responsible teams.

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

New Relic MCP Connection

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

`https://mcp.newrelic.com/mcp/`

</td></tr><tr><td>

Required credentials

</td><td>

API key \(also known as "User Key"\)

 Header name: `api-key`

</td></tr><tr><td>

Required scope

</td><td>

N/A

</td></tr></tbody>
</table>## Prometheus

<table id="table_e4t_nvh_gjc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Prometheus API Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

PromQL metric queries \(CPU, memory, disk, network\), active alerts, alert rule definitions, and scrape target health

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

Prometheus connection

</td></tr><tr><td>

Connection type

</td><td>

API

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

`https://<your-onprem-prometheus-server>`

</td></tr><tr><td>

Required credentials

</td><td>

-   MID Server Prometheus is installed on
-   User name \(for outbound connection\)
-   Password \(for outbound connection\)

</td></tr><tr><td>

Required scope

</td><td>

N/A

</td></tr></tbody>
</table>## SolarWinds

<table id="table_fhy_nvh_gjc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

SolarWinds analysis AI agent

</td></tr><tr><td>

Overview of data returned

</td><td>

On-premises data from SolarWinds Orion: node health/status, CPU/memory, packet loss/latency, interface utilization/errors/discards, active alerts/history, affected entities/services, and trend/baseline metrics used for root-cause investigation

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

SolarWinds AI Agent

</td></tr><tr><td>

Connection type

</td><td>

API

</td></tr><tr><td>

Returned data type

</td><td>

NPM

</td></tr><tr><td>

Connection URL

</td><td>

`https://<your-onprem-solarwinds-server>`

</td></tr><tr><td>

Required credentials

</td><td>

-   MID Server SolarWinds is installed on
-   User name
-   Password

</td></tr><tr><td>

Required scope

</td><td>

SolarWinds Orion API/SWQL read access \(NPM/APM\) via MID Server

</td></tr></tbody>
</table>## Splunk

<table id="table_ghd_4vh_gjc"><thead><tr><th>

Connection information

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Agent name

</td><td>

Splunk MCP Server Agent

</td></tr><tr><td>

Overview of data returned

</td><td>

SPL query results from Splunk indexes, index/sourcetype metadata, and structured investigation findings including affected entities, root cause analysis, and recommended actions

</td></tr><tr><td>

Credential &amp; Connection Alias name

</td><td>

Splunk MCP Connection

</td></tr><tr><td>

Connection type

</td><td>

MCP

</td></tr><tr><td>

Returned data type

</td><td>

APM

</td></tr><tr><td>

Connection URL

</td><td>

`https://<your-splunk-instance>.splunkcloud.com`

</td></tr><tr><td>

Required credentials

</td><td>

Splunk MCP token

</td></tr><tr><td>

Required scope

</td><td>

For Splunk token generation:

 -   `mcp_user` role \(or any role with `mcp_tool_execute`\) required for all MCP tool calls
-   Search capability and read access to the relevant indexes for running queries
-   Knowledge object read permissions for Get Knowledge Objects
-   Token must be generated using the Splunk MCP Server app with `audience = mcp` \(not a standard Splunk API token\)

</td></tr></tbody>
</table>## ThousandEyes

|Connection information|Value|
|----------------------|-----|
|Agent name|ThousandEyes MCP Server Agent|
|Overview of data returned|Test configuration and status, aggregated metrics \(response time, packet loss, latency, jitter, throughput, availability\), metric anomalies with deviation analysis, network events and routing changes, ISP/network outages with provider and ASN details, hop-by-hop path visualization, and root cause analysis with ranked probable causes and recommended next steps|
|Credential &amp; Connection Alias name|ThousandEyes MCP Connection|
|Connection type|MCP|
|Returned data type|NPM|
|Connection URL|`https://api.thousandeyes.com/mcp`|
|Required credentials|API key prefixed with `Bearer`. For example, `Bearer <api-key>`.|
|Required scope|ThousandEyes API access with permissions to read tests, metrics, anomalies, events, outages, and path visualization data|

## Procedure

1.  Navigate to **All** &gt; **sys\_alias.LIST**.
2.  Search for and select the vendor's connection name as shown in the preceding tables.
3.  Select **Create New Connection &amp; Credential**.
4.  Fill in the form, using the information in the preceding tables.
5.  Select **Create**.

    Your connection appears in the **Connections** tab.


The agents are now ready to be used by the [analyze alert impact agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/now-assist-itom-agentic-aia.md)

**Parent Topic:**[Configuring Service Operations Workspace for ITOM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/configure-sow-itom.md)