ServiceNow supports custom fields on tickets. This guide applies to both **ServiceNow ITSM** and **ServiceNow Security Incident Response (SIR)** integrations.

Custom fields in ServiceNow are per-ticket fields — they are not scoped to a project. Set **Project ID** to `*` for all mappings.

> **Note:** Only fields whose column name begins with `u_` are supported. This is the standard ServiceNow convention for user-defined custom fields. Fields without the `u_` prefix will be rejected at integration initialization.


## 1. Find Custom Field Column Names

The **Field Path (Provider)** in each mapping must be the **ServiceNow column name** of the field, e.g. `u_affected_system`.

To find column names:

1. Log in to ServiceNow as an Admin.
2. Navigate to **System Definition** -> **Dictionary**.
3. Filter by **Table** (e.g., `incident`) and look for entries where the **Column name** starts with `u_`. These are your custom fields.


## 2. Configure Custom Field Mappings

When creating or editing your integration, enable the **Custom Field Mappings** toggle. Click **+ Add CustomFieldMapping** to add an entry for each field you want to map. Fill in the following for each entry:

**Project ID**
Must be `*`. ServiceNow custom fields are not project-scoped.

**Field Path (Provider)**
The ServiceNow column name found in Step 1 (e.g., `u_affected_system`). Must start with `u_`.

**Name**
A unique key used to reference this field in the `custom_fields` object when creating or patching tickets (e.g., `affected_system`).

Click **+ Add CustomFieldMapping** to add additional mappings.