workflow:
  id: servicenow-ticket-sync
  name: ServiceNow Ticket Sync
  description: Synchronizes ServiceNow ticket statuses with Keep alerts and maintains bidirectional state tracking.
  triggers:
    - type: manual
  steps:
    # get the alerts from keep
    - name: get-alerts
      provider:
        type: keep
        # get all the alerts with sys_id (means that ticket exists for them)
        with:
          filters:
            - key: ticket_type
              value: servicenow
  actions:
    # update the tickets
    - name: update-ticket
      foreach: " {{ steps.get-alerts.results }} "
      provider:
        type: servicenow
        config: " {{ providers.servicenow }} "
        with:
          ticket_id: "{{ foreach.value.alert_enrichment.enrichments.ticket_id }}"
          table_name: "{{ foreach.value.alert_enrichment.enrichments.table_name }}"
          fingerprint: "{{ foreach.value.alert_fingerprint }}"
          enrich_alert:
            - key: ticket_status
              value: results.state
