diff --git a/docs/management/connectors/action-types/servicenow-sir.asciidoc b/docs/management/connectors/action-types/servicenow-sir.asciidoc
index 40fb07897d206..b924837c97bc3 100644
--- a/docs/management/connectors/action-types/servicenow-sir.asciidoc
+++ b/docs/management/connectors/action-types/servicenow-sir.asciidoc
@@ -37,6 +37,7 @@ Use the <<action-settings, Action configuration settings>> to customize connecto
    actionTypeId: .servicenow-sir
    config:
      apiUrl: https://example.service-now.com/
+     isLegacy: false
    secrets:
      username: testuser
      password: passwordkeystorevalue
@@ -45,6 +46,9 @@ Use the <<action-settings, Action configuration settings>> to customize connecto
 Config defines information for the connector type.
 
 `apiUrl`:: An address that corresponds to *URL*.
+`isLegacy`:: A boolean that indicates if the connector should use the Table API (legacy) or the Import Set API.
+
+Note: If `isLegacy` is set to false the Elastic application should be installed in ServiceNow.
 
 Secrets defines sensitive information for the connector type.
 
diff --git a/docs/management/connectors/action-types/servicenow.asciidoc b/docs/management/connectors/action-types/servicenow.asciidoc
index eae1fce75731d..73da93e57dae9 100644
--- a/docs/management/connectors/action-types/servicenow.asciidoc
+++ b/docs/management/connectors/action-types/servicenow.asciidoc
@@ -37,6 +37,7 @@ Use the <<action-settings, Action configuration settings>> to customize connecto
    actionTypeId: .servicenow
    config:
      apiUrl: https://example.service-now.com/
+     isLegacy: false
    secrets:
      username: testuser
      password: passwordkeystorevalue
@@ -45,6 +46,9 @@ Use the <<action-settings, Action configuration settings>> to customize connecto
 Config defines information for the connector type.
 
 `apiUrl`:: An address that corresponds to *URL*.
+`isLegacy`:: A boolean that indicates if the connector should use the Table API (legacy) or the Import Set API.
+
+Note: If `isLegacy` is set to false the Elastic application should be installed in ServiceNow.
 
 Secrets defines sensitive information for the connector type.
 
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts
index 5f57555a8f9e1..af8d1b9f38b17 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts
@@ -14,7 +14,7 @@ export const ExternalIncidentServiceConfigurationBase = {
 
 export const ExternalIncidentServiceConfiguration = {
   ...ExternalIncidentServiceConfigurationBase,
-  isLegacy: schema.boolean({ defaultValue: false }),
+  isLegacy: schema.boolean({ defaultValue: true }),
 };
 
 export const ExternalIncidentServiceConfigurationBaseSchema = schema.object(
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
index 7c720148780a4..f491376e5078c 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
@@ -414,5 +414,43 @@ describe('ServiceNowActionConnectorFields renders', () => {
           .includes(errorMessage)
       ).toBeTruthy();
     });
+
+    test('should set the isLegacy to false when creating a connector', async () => {
+      const newConnector = { ...usesTableApiConnector, config: {}, secrets: {} };
+      const editActionConfig = jest.fn();
+
+      mountWithIntl(
+        <ServiceNowConnectorFields
+          // @ts-expect-error
+          action={newConnector}
+          errors={{ apiUrl: [], username: [], password: [] }}
+          editActionConfig={editActionConfig}
+          editActionSecrets={() => {}}
+          readOnly={false}
+          setCallbacks={setCallbacks}
+          isEdit={false}
+        />
+      );
+
+      expect(editActionConfig).toHaveBeenCalledWith('isLegacy', false);
+    });
+
+    test('it should set the legacy attribute if it is not undefined', async () => {
+      const editActionConfig = jest.fn();
+
+      mountWithIntl(
+        <ServiceNowConnectorFields
+          action={usesTableApiConnector}
+          errors={{ apiUrl: [], username: [], password: [] }}
+          editActionConfig={editActionConfig}
+          editActionSecrets={() => {}}
+          readOnly={false}
+          setCallbacks={setCallbacks}
+          isEdit={false}
+        />
+      );
+
+      expect(editActionConfig).not.toHaveBeenCalled();
+    });
   });
 });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
index 20d38cfc7cea8..a0b4bdca47ff5 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
@@ -36,7 +36,7 @@ const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<ServiceNowA
       http,
       notifications: { toasts },
     } = useKibana().services;
-    const { apiUrl } = action.config;
+    const { apiUrl, isLegacy } = action.config;
     const { username, password } = action.secrets;
     const isOldConnector = isLegacyConnector(action);
 
@@ -123,6 +123,18 @@ const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<ServiceNowA
       toasts,
     ]);
 
+    /**
+     * Defaults the isLegacy attribute to false
+     * if it is not defined. The isLegacy attribute
+     * will be undefined only at the creation of
+     * the connector.
+     */
+    useEffect(() => {
+      if (isLegacy == null) {
+        editActionConfig('isLegacy', false);
+      }
+    });
+
     return (
       <>
         {showUpdateConnector && (
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itsm.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itsm.ts
index 82f43ed4a3040..97c2a77a8f074 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itsm.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_itsm.ts
@@ -91,6 +91,7 @@ export default function serviceNowITSMTest({ getService }: FtrProviderContext) {
             connector_type_id: '.servicenow',
             config: {
               apiUrl: serviceNowSimulatorURL,
+              isLegacy: false,
             },
             secrets: mockServiceNow.secrets,
           })
@@ -125,7 +126,7 @@ export default function serviceNowITSMTest({ getService }: FtrProviderContext) {
         });
       });
 
-      it('should set the isLegacy to false when not provided', async () => {
+      it('should set the isLegacy to true when not provided', async () => {
         const { body: createdAction } = await supertest
           .post('/api/actions/connector')
           .set('kbn-xsrf', 'foo')
@@ -143,7 +144,7 @@ export default function serviceNowITSMTest({ getService }: FtrProviderContext) {
           .get(`/api/actions/connector/${createdAction.id}`)
           .expect(200);
 
-        expect(fetchedAction.config.isLegacy).to.be(false);
+        expect(fetchedAction.config.isLegacy).to.be(true);
       });
 
       it('should respond with a 400 Bad Request when creating a servicenow action with no apiUrl', async () => {
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_sir.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_sir.ts
index 0cdb279ac0746..3a13e055e7aeb 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_sir.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow_sir.ts
@@ -95,6 +95,7 @@ export default function serviceNowSIRTest({ getService }: FtrProviderContext) {
             connector_type_id: '.servicenow-sir',
             config: {
               apiUrl: serviceNowSimulatorURL,
+              isLegacy: false,
             },
             secrets: mockServiceNow.secrets,
           })
@@ -129,7 +130,7 @@ export default function serviceNowSIRTest({ getService }: FtrProviderContext) {
         });
       });
 
-      it('should set the isLegacy to false when not provided', async () => {
+      it('should set the isLegacy to true when not provided', async () => {
         const { body: createdAction } = await supertest
           .post('/api/actions/connector')
           .set('kbn-xsrf', 'foo')
@@ -147,7 +148,7 @@ export default function serviceNowSIRTest({ getService }: FtrProviderContext) {
           .get(`/api/actions/connector/${createdAction.id}`)
           .expect(200);
 
-        expect(fetchedAction.config.isLegacy).to.be(false);
+        expect(fetchedAction.config.isLegacy).to.be(true);
       });
 
       it('should respond with a 400 Bad Request when creating a servicenow action with no apiUrl', async () => {
diff --git a/x-pack/test/case_api_integration/common/lib/utils.ts b/x-pack/test/case_api_integration/common/lib/utils.ts
index f34d7398db0c2..0a875f9f1e822 100644
--- a/x-pack/test/case_api_integration/common/lib/utils.ts
+++ b/x-pack/test/case_api_integration/common/lib/utils.ts
@@ -329,6 +329,7 @@ export const getServiceNowConnector = () => ({
   },
   config: {
     apiUrl: 'http://some.non.existent.com',
+    isLegacy: false,
   },
 });
 
@@ -385,6 +386,7 @@ export const getServiceNowSIRConnector = () => ({
   },
   config: {
     apiUrl: 'http://some.non.existent.com',
+    isLegacy: false,
   },
 });