Constellation – Unifying IT Monitoring and Incident Management with ZigiOps

Constellation is a global enterprise with thousands of employees and a highly distributed IT environment. As a leading competitive energy supplier, Constellation and its affiliates serve more than 2 million homes and businesses, including 80% of the Fortune 100, with electricity, natural gas, and a broad range of customizable energy products and services. Its portfolio also extends into sustainability offerings such as hourly carbon-free energy matching and offsite renewables, helping customers meet their own energy and sustainability goals.

Running an operation of that scale, and one that touches part of North America's bulk electrical infrastructure, means Constellation's IT team manages critical infrastructure and business applications across hybrid on-premise and cloud environments, monitored by multiple systems:

• Nagios is used for infrastructure monitoring, providing visibility into servers, network devices, and core infrastructure.
• Microsoft System Center Operations Manager (SCOM) monitors applications and system health across Constellation’s IT estate.
• SolarWinds monitors network devices, servers, and other infrastructure components across Constellation's sites.
• Oracle Enterprise Manager (OEM) monitors Constellation's Oracle database and middleware layer.
• ServiceNow serves as the central IT Service Management (ITSM) platform, used by the company’s service desk and operations teams to handle incidents, requests, and problem management.

As the environment grew in scale and complexity, the company identified a serious gap: monitoring tools were generating large volumes of alerts, but these were not efficiently or securely making their way into ServiceNow.

• Nagios alerts were being handled manually: service desk agents copied alert details into ServiceNow tickets. This was slow, error-prone, and often caused delays in responding to infrastructure issues.
• SCOM alerts presented an even bigger challenge: they contained sensitive data such as internal system identifiers, configuration details, and potentially confidential information that could not be exposed in ServiceNow without sanitization. As a result, these alerts required manual review and redaction before tickets could be created, leading to long delays, inconsistencies, and compliance risks.
• SolarWinds data carried granular network identifiers, such as IP and MAC addresses, that could not be shared broadly given Constellation's role in critical energy infrastructure, without a way to control exactly who could see them.
• Oracle Enterprise Manager (OEM) alerts had no native path into ServiceNow at all, since the specific OEM version Constellation runs fell outside ServiceNow's native integration support.

Constellation’s IT leadership recognized that continuing with manual processes was unsustainable. They needed a solution that could:

• Automate the integration of alerts from Nagios and SCOM into ServiceNow.
• Transform and sanitize sensitive data from SCOM before it reached ServiceNow.
• Scale reliably to handle thousands of alerts without performance bottlenecks.
• Provide auditability for compliance teams, ensuring sensitive data was managed correctly.

To achieve this, Constellation selected ZigiOps, ZigiWave’s no-code integration platform.

Scenario 1: Streamlining Infrastructure Alerts with Nagios → ServiceNow

The Challenge

Nagios was producing hundreds of infrastructure alerts daily. Without an automated integration, Constellation’s service desk team had to:

• Manually re-enter alert details into ServiceNow to create incidents.
• Double-check data mappings like severity, affected service, and priority.
• Manually update incident status back into Nagios once issues were resolved.

This approach created:

• Delays in incident creation, meaning critical issues sometimes sat in queues for hours before being worked on.
• Errors and inconsistencies in ticket data, since manual input often introduced mistakes.
• Stress on IT staff, who spent significant time on administrative work instead of actual incident resolution.

The ZigiOps Solution

Constellation configured a two-way workflow in ZigiOps:

• Source: Nagios Alerts.
• Target: ServiceNow Incidents.

Each new alert in Nagios triggered the creation of a ServiceNow incident, mapped with the correct fields (severity, priority, affected service, team assignment). Status updates flowed both ways - when a ServiceNow ticket was updated or resolved, the corresponding Nagios alert was updated in real time.

The Results

• Incident creation was instant. As soon as Nagios detected an issue, ServiceNow had a ticket ready for the right team.
• Manual effort was eliminated. The service desk no longer wasted hours re-entering data.
• SLA compliance improved. By removing delays, incidents were acknowledged and resolved within SLA timelines.
• Visibility increased. Both monitoring and ITSM teams worked with the same synchronized data, reducing confusion.

Scenario 2: Securing Application Monitoring Data with SCOM → ServiceNow

The Challenge

Unlike Nagios, SCOM alerts carried sensitive information. These alerts often included:

• Internal server names.
• Configuration details.
• Fields containing confidential business or application data.

For compliance reasons, this data could not be directly injected into ServiceNow. Constellation had been relying on manual review: every alert had to be checked, redacted, and reformatted before creating a ServiceNow incident.

The consequences were severe:

• Delays of hours or even days in incident creation.
• Inconsistent sanitization, as different staff members applied different levels of scrutiny.
• Compliance risks, since a single oversight could expose sensitive information in ServiceNow.

The ZigiOps Solution

To solve this, Constellation leveraged ZigiOps’ advanced transformation and output capabilities:

File Output Connector

• A new connector was created: new-file-output-1.-remove
• Instead of pushing alerts directly to ServiceNow, SCOM alerts were first routed to this connector.

Workflow with Transformation

• A workflow was set up: SCOM Alerts → File Output Connector.
• Filters were applied to capture only relevant alert collections.

JavaScript expressions were configured to transform the data, removing or masking sensitive fields.

Export and Inspection

• The transformed alerts were exported into .jsonl files in the directory /zigiops/platform/connector-logs/. -remove
• Each alert was written in JSON line format, making it easy for compliance and IT staff to inspect.
• For large data sets, ZigiOps automatically split files into chunks of 10,000 records to avoid overload.
• connector-new-file-output-1-25-06-16-10:57:14-01.jsonl-remove
• connector-new-file-output-1-25-06-16-10:57:14-02.jsonl-remove

Validation and Production Rollout

• Compliance teams inspected the exported files to confirm sensitive fields were properly removed.
• Once validated, the workflow was updated to send alerts directly from SCOM → ServiceNow, applying the same transformation rules automatically.

The Results

• Sensitive data sanitized. ServiceNow only received clean, compliant alert data.
• Auditability provided. JSONL files created a complete audit trail for regulatory checks.
• Manual review eliminated. Staff no longer wasted time redacting alert details by hand.
• Scalable and reliable. ZigiOps processed large alert volumes without failure, chunking files automatically.

Scenario 3: Extending Granular Data Control to SolarWinds

The Challenge

SolarWinds monitors network devices, servers, and UPS systems that support Constellation's critical energy infrastructure. That data includes IP addresses, MAC addresses, and other identifiers that cannot be exposed to every ServiceNow user, especially since Constellation operates part of North America's bulk electrical infrastructure. Filtering this data inside ServiceNow's own ingestion layer would mean any ServiceNow admin with transform access could see the raw, unredacted feed.

The ZigiOps Solution

Constellation is connecting SolarWinds to ServiceNow ITOM through ZigiOps, using field mapping and expressions such as Replace Pattern (regex) to mask or strip sensitive identifiers before the data ever reaches ServiceNow. Only the operationally relevant details, such as a device being down or trending as a top talker, are passed through.

The Benefits

• Granular control: technical teams keep full detail in SolarWinds, while managers and planners see incident status without exposing IP or MAC addresses.
• Reduced risk: redaction happens before data reaches ServiceNow, so fewer people have access to the raw feed.
• Easier changes: adjusting what gets sent is a configuration change in ZigiOps' guided UI, not a ServiceNow development project.
• Flow control: data cadence can be throttled or paused without touching SolarWinds or ServiceNow.

Scenario 4: Reconnecting Oracle Enterprise Manager

The Challenge

Constellation runs a version of Oracle Enterprise Manager (OEM) that ServiceNow's native integration does not support. Closing that gap the conventional way would have required either a cloud-based subscription service or an on-premises licensing upgrade, both costly options for what was fundamentally a data transport problem.

The ZigiOps Solution

ZigiOps connects to OEM as a standard connected system, regardless of version, so Constellation can send OEM alerts into ServiceNow without upgrading Oracle licensing or moving to a cloud subscription.

The Benefits

• No added licensing cost: avoids the cloud subscription or on-premises upgrade a native integration would have required.
• Version independence: connects regardless of the specific OEM release in use.
• Same granular control: the same field-level mapping and throttling used for SolarWinds applies here.
• Faster time to value: alerts reach ServiceNow without a separate Oracle procurement cycle.

Unified Outcome

With ZigiOps, Constellation achieved a unified and secure alert-to-incident pipeline:

• Nagios alerts flowed automatically into ServiceNow as incidents with zero manual intervention.
• SCOM alerts were filtered, transformed, and sanitized before entering ServiceNow, ensuring compliance without slowing down operations.
• SolarWinds data will be redacted at the field level before reaching ServiceNow ITOM, keeping sensitive network details out of the wrong hands.
• Oracle Enterprise Manager reconnects to ServiceNow without a costly licensing or cloud migration detour.

Together, these workflows delivered:

• Faster incident resolution: Critical issues were in ServiceNow and assigned to the right teams within seconds.
• Improved compliance: Sensitive data from SCOM never left the monitoring environment without sanitization.
• Higher efficiency: Service desk agents and operations teams focused on solving problems, not on data entry.
• Future-proofing: All four workflows were built on the same integration platform, allowing Constellation to extend integrations to other tools as needed.

Key Takeaways

Constellation’s dual integrations with ZigiOps highlight how enterprises can:

• Automate routine alert-to-incident processes across multiple monitoring tools.
• Transform and secure sensitive data before it enters ITSM systems.
• Ensure compliance while still delivering operational speed.
• Scale seamlessly to handle thousands of alerts daily without manual bottlenecks.
• Avoid unnecessary costs when a monitoring tool's version falls outside native vendor support, instead of paying for a licensing or cloud upgrade just to move alerts.

By addressing speed, security, and cost across all four integrations, ZigiOps enabled Constellation to build a robust, compliant, and efficient IT operations pipeline that aligned technical workflows with business and regulatory priorities.