AI & Prediction Pack

sn-ai-001

Predictive Intelligence for Incident Assignment Group

Predictive Intelligence Priority: Critical Effort: Medium

To reduce manual triage time and rework by automatically predicting the correct assignment group for new incidents based on their content. This directly addresses the most significant rework loop identified in the process.

Why this pack: This rule uses a machine learning classification model to predict a field value, which is a core capability of the Predictive Intelligence framework.

Trigger

Incident is created.

Conditions

·assignment_group is empty

Actions

·Predict the 'assignment_group' based on the trained classification model.

·Set the 'assignment_group' with the predicted value if confidence is above a defined threshold (e.g., 80%).

·If confidence is below the threshold, present the top 3 suggestions to the service desk agent in the Agent Workspace UI.

Evidence used

·Transition 'Assigned -> Active' occurs in 35.60% of tasks, indicating frequent re-triaging after initial assignment.

·Variant 'New -> Active -> Assigned -> Active -> Assigned -> Closed' (7.80% of tasks) shows a clear pattern of assignment ping-pong.

·The 'assignment_group' field is widely distributed, making manual assignment complex and error-prone.

ServiceNow implementation

Target table

·incident

Configuration area

·Predictive Intelligence

Configuration trigger

·On Incident creation

Configuration conditions

·current.assignment_group.nil()

Implementation steps

·Navigate to Predictive Intelligence > Classification > Solution Definitions.

·Create a new Solution Definition for 'Incident Assignment Group Prediction'.

·Set the Table to 'Incident'.

·Set the Output Field to 'assignment_group'.

·Set Input Fields to 'short_description', 'description', and 'contact_type'.

·Define the filter for the training data set: Incidents closed in the last 6-12 months with a valid 'assignment_group' and 'close_code'.

·Train the model. Review the precision and coverage metrics.

·Once satisfied, activate the solution.

·Configure a Business Rule or Flow Designer action to call the prediction API on incident creation and populate the assignment_group field based on the prediction confidence.

Fields used

·short_description

·description

·contact_type

·assignment_group

Test cases

·Create a new incident with 'short_description' = 'File share access denied'. Verify the assignment group is predicted correctly.

·Create a new incident with a vague 'short_description'. Verify the model provides recommendations but does not automatically assign if confidence is low.

Rollback notes

·Deactivate the Business Rule or Flow Designer flow that calls the prediction service.

·Deactivate the Predictive Intelligence Solution Definition.

Requirements / prerequisites

·ServiceNow Predictive Intelligence plugin (com.glide.platform_ml) must be active.

·A historical dataset of at least 30,000 resolved incidents with accurately populated 'assignment_group' and 'short_description' fields is required for effective model training.

sn-ai-002

Similar Incident and Knowledge Article Recommendations

Predictive Intelligence Priority: High Effort: Low

To accelerate incident resolution and improve consistency by proactively showing agents similar resolved incidents and relevant knowledge articles. This helps agents reuse proven solutions for common, recurring issues.

Why this pack: This rule uses AI-powered similarity and clustering frameworks to analyze unstructured text and provide contextual recommendations, a key feature of Now Assist and Predictive Intelligence.

Trigger

Incident form is viewed or updated.

Conditions

·Incident state is not 'Closed' or 'Cancelled'.

Actions

·Display a list of similar resolved incidents in the Agent Workspace contextual side panel.

·Display a list of relevant Knowledge Base articles based on the incident's short description and description.

Evidence used

·Sample tasks show high frequency of recurring summaries like 'Application error on login', 'File share access denied', 'Laptop will not power on', 'Password reset required'.

·High process variability (49+ variants) suggests inconsistent resolution paths, which could be standardized by leveraging past solutions.

·Close codes like 'Training Issue' (6.6%) suggest that existing knowledge is not being effectively utilized.

ServiceNow implementation

Target table

·incident

Configuration area

·Predictive Intelligence

Configuration trigger

·On form load and field change for 'short_description'

Configuration conditions

·current.active == true

Implementation steps

·Navigate to Predictive Intelligence > Similarity > Solution Definitions.

·Activate the out-of-the-box 'Similar Incidents' solution. Review the training filter and input fields ('short_description' is standard).

·Train the similarity model.

·Navigate to Contextual Search > Table Configuration and ensure the Incident table is configured.

·Configure the 'Related Search Results' widget in Agent Workspace to display both Knowledge Articles and Similar Incidents.

·Ensure the Knowledge solution for Agent Assist is trained and active.

Fields used

·short_description

·description

·work_notes

·close_notes

Test cases

·Open an incident with 'short_description' = 'VPN connection drops intermittently'. Verify that other resolved incidents with similar text and relevant KB articles about VPN troubleshooting are displayed.

·Open an incident for 'Password reset'. Verify that a knowledge article on self-service password reset is suggested.

Rollback notes

·Deactivate the Similarity Solution Definition.

·Remove the 'Related Search Results' widget from the Agent Workspace view.

Requirements / prerequisites

·ServiceNow Predictive Intelligence plugin.

·Agent Workspace is being used by fulfillers.

·A populated Knowledge Base with articles linked to past incidents.

sn-ai-003

Now Assist - Incident Summary on Return from Pending

Predictive Intelligence Priority: High Effort: Low

To reduce the time it takes for an agent to re-engage with an incident after a user has responded. An AI-generated summary provides immediate context, preventing the need to re-read the entire activity log.

Why this pack: This rule leverages a generative AI capability (Now Assist) to create summaries from unstructured text in work notes and comments, which is a core feature of the AI & Prediction pack.

Trigger

Incident state changes from a 'Pending' or 'Awaiting' state to an 'Active' state.

Conditions

·Incident was previously in 'Pending User' or 'Awaiting User Info'.

·Incident state changes to 'Work in Progress' or 'Assigned'.

Actions

·Generate a summary of the incident's history, including key work notes and user comments.

·Display the summary prominently in the Agent Workspace UI or post it as an internal work note.

Evidence used

·The transition 'Work in Progress -> Pending User' is very common, occurring in 43% of all tasks.

·Tickets return to the active queue via transitions like 'Pending User -> Work in Progress' (4.4%) and 'Awaiting User Info -> Work in Progress' (2.1%).

·Complex rework variants (e.g., Variant ID 22, 1.10% of tasks) involve multiple state changes, creating long activity streams that are time-consuming to review.

ServiceNow implementation

Target table

·incident

Configuration area

·Now Assist

Configuration trigger

·Incident state changes

Configuration conditions

·current.state.changesTo(state_value_for_wip) && previous.state == (state_value_for_pending_user)

Implementation steps

·Ensure the Now Assist for ITSM plugin is active and configured.

·Navigate to Now Assist Admin > Summarization Configurations.

·Activate and configure the Incident Summarization capability.

·Optionally, create a Business Rule or Flow that triggers on the specified state change.

·The action in the flow would call the `sn_nowassist_llm.LLMProxyAPI().generateSummarization()` script include function.

·The output can then be added to the work notes using `current.work_notes = summary;`.

Fields used

·state

·work_notes

·comments

Test cases

·Move an incident with several work notes to 'Pending User'. Add a customer comment.

·Change the state back to 'Work in Progress'. Verify that a concise summary of the incident's history is generated and added to the work notes.

Rollback notes

·Disable the Business Rule or Flow that triggers the summarization action.

Requirements / prerequisites

·Now Assist for ITSM license and plugin (sn_nowassist_itsm) must be active.

·Generative AI capabilities must be enabled on the instance.

sn-ai-004

Performance Analytics Signal for SLA Breach Risk

Performance Analytics Priority: Medium Effort: Medium

To proactively identify and alert teams to incidents that are at high risk of breaching their resolution SLA. This allows supervisors and agents to prioritize work and take corrective action before the SLA is missed.

Why this pack: This uses historical performance data to create a predictive signal, which is a key component of the 'Prediction' aspect of this pack. It enables proactive, data-driven intervention.

Trigger

Performance Analytics daily data collection job completes.

Conditions

·Incident is Active

·Incident Resolution SLA is not paused

·Combination of factors (e.g., priority, re-assignment count, age) exceeds a risk threshold.

Actions

·Flag at-risk incidents on a dashboard for team leads.

·Generate a notification to the assigned group or manager for incidents with a critical risk score.

Evidence used

·A majority of incidents (60.2%) breach their SLAs ('SLA breached?' is 'Yes').

·SLA breaches occur across all priority levels, as seen in the sample tasks (e.g., INC0015073, INC0014463).

·The high number of rework loops and process variants directly contributes to longer resolution times and subsequent SLA breaches.

ServiceNow implementation

Target table

·incident

Configuration area

·Performance Analytics

Configuration trigger

·Daily data collection

Configuration conditions

·Indicator 'Number of open incidents' is broken down by a 'Breach Risk' breakdown source.

Implementation steps

·Create a new script-based Breakdown Source on the Incident table that calculates a risk score. The script could factor in `reassignment_count`, `priority`, `age`, and `sla_percentage_timer`.

·The script should return buckets like 'High Risk', 'Medium Risk', 'Low Risk'.

·Create a new Breakdown and run the mappings job.

·Apply this breakdown to key indicators like 'Number of open incidents'.

·Create a new Signal definition in Performance Analytics > Signals.

·Configure the signal to monitor the 'Number of open incidents' for the 'High Risk' bucket.

·Set a threshold (e.g., if count is > 10). When the threshold is crossed, the signal becomes active.

·Configure the signal to notify a specific user or group when it becomes active.

Fields used

·state

·priority

·reassignment_count

·sys_created_on

·sla.percentage

Test cases

·Manually run the breakdown source script against a high-priority incident that has been reassigned multiple times. Verify it is categorized as 'High Risk'.

·After the daily data collection job runs, verify the signal dashboard reflects the count of high-risk incidents.

Rollback notes

·Deactivate the Signal definition in Performance Analytics.

·Remove the 'Breach Risk' breakdown from the indicators.

Requirements / prerequisites

·ServiceNow Performance Analytics Premium plugin.

·Historical data for incidents and their associated SLAs must be available in PA.