How to Automate Remote IT Support with the GlobalProtect ServiceNow Integration

Jul 22, 2026
5 minutes

Imagine the following: you are just minutes away from leading a critical client call or pushing a major code update, when suddenly the connection drops and you are digitally paralyzed. The rest of the day is wasted as you begin to navigate a labyrinth of internal directories, browse websites for relevant threads, open various helpdesk tickets hoping for a response, and scramble to find that mythical figure that your colleague once told you about who “had the same issue and was able to fix it, but I don’t remember how.”

Now imagine that you are facing all this while working from home. Some of these potential troubleshooting options may not even be accessible to you in those scenarios. When users face such issues while working from home, frustration intensifies because the path to a resolution is unclear. The tools they need to restore connectivity may be inaccessible and this can leave employees in the dark on how to proceed. 

Today, we are eliminating that friction by bringing support directly to where the user already is. We are thrilled to introduce the new “Report an Issue” functionality, built natively into the Palo Alto Networks GlobalProtect agent interface. 

This capability allows remote employees to instantly generate comprehensive IT support tickets during network or connectivity failures with a single click. By automatically populating the ServiceNow incident ticket with critical real-time endpoint telemetry such as User ID, gateway context, and system timestamps. This feature removes manual ticketing barriers, prevents dangerous shadow IT workarounds, and can drastically reduce Mean Time to Resolution (MTTR).

The Security Risks of Remote Support Friction and Shadow IT 

There has always been a massive disconnect between the remote employee experiencing a network issue and the IT professional tasked with resolving it. When the barrier to getting help is too high, human nature takes over.

Consider the relatively-simple case of elderly patients with conditions like rheumatoid arthritis attempting to open medication packaging. Researchers found that while a significant percentage of patients were physically unable to open standard medicine containers, among those living independently at home, only 27% actually received help. What happens when people cannot easily get support? They resort to workarounds: they leave childproof caps unscrewed, transfer pills to unlabeled jars, or break the locks altogether, creating massive safety risks just to remove the friction.

The same human behavior applies to enterprise technology. When users are forced to context-switch—leaving their active workflow to log a ticket in a different, inefficient system—the barrier to entry is often too high. They simply won’t report the issue at all. Instead, they turn to “shadow IT” workarounds. They tether to personal, unmonitored devices, connect to unsecured public wifi networks, or attempt to bypass security protocols. Just like the medication workarounds, these shortcuts might solve the immediate inconvenience for the user, but they introduce severe, unmanaged dangers to the company’s security protocols.

Even when users do submit tickets, the information is often understandably vague. A ticket that simply reads that ‘the internet is broken’ leaves the IT helpdesk entirely in the dark. Without technical context, engineers are forced to play 20 Questions with the user before any actual troubleshooting can even begin.

Minimizing Ticket Friction with One-Click Support via GlobalProtect

With our new “Report an Issue” feature, we are putting the power back in users’ hands. The workflow is incredibly simple: if an employee experiences a connectivity hiccup, they just open their GlobalProtect agent, click the “Report an Issue” button, add a brief description of what they are experiencing (optional), and hit submit. 

There is no portal hunting, no waiting on hold. It is an immediate, frictionless way for users to raise a flag and get back to their day, knowing that support is already in motion without the need for workarounds.

Under the Hood: Automating ServiceNow Incident Management 

What makes this feature truly powerful isn’t just the button itself—it’s what happens after the click.

When the user hits submit, GlobalProtect generates an incident directly within ServiceNow. There is no manual data entry required from either the user or the helpdesk. More importantly, the integration attaches vital context to the payload. The ServiceNow ticket isn’t just a blank alert; it is automatically populated with essential baseline telemetry from the GlobalProtect agent. This includes the user ID, timestamp, the specific gateway they are connected to, and their endpoint details.

Accelerating MTTR Across the Enterprise

By bridging the gap between the edge and the helpdesk, this integration delivers immediate value across the board:

  • For the End-User: A frictionless experience. Immediate confirmation that their issue is logged. And a safer, faster return to productivity.
  • For the IT Helpdesk: The complete elimination of manual ticket creation. The queue is instantly populated with standardized, accurate data, entirely bypassing the initial guessing game and setting the stage for significantly faster resolution times.

What’s Next?

“Report an Issue” is a massive leap forward in user experience, but it is only the first step in our journey to modernize network support.

Ready to eliminate support friction and secure your remote workforce? Schedule a personalized  demo with our team today to see the integration in action.


Subscribe to Sase Blogs!

Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.