ServiceNow AI Lens

Overview

AI Lens provides contextual intelligence for any ServiceNow record, surfacing insights that are not immediately visible on the form or list view:

• Related Information: Connected records, upstream/downstream dependencies, and associated knowledge
• Pattern Analysis: Historical trends for similar records, recurring issues, and anomaly detection
• Risk Assessment: SLA risk, escalation likelihood, and potential business impact
• Recommended Actions: Next best actions based on record state, history, and peer analysis
• Cross-Module Context: Information from ITSM, CSM, HRSD, CMDB, and other modules that enrich understanding
• Predictive Insights: Estimated resolution time, likely assignment, and probable root cause

When to use: When agents, managers, or analysts need a comprehensive contextual view of any record that goes beyond what is visible on the standard form, or when building AI-augmented workspace experiences.

Prerequisites

• Roles: itil, sn_customerservice_agent, sn_hr_core.case_reader, or admin
• Plugins: Platform foundation (no specific plugin required; leverages existing module data)
• Access: Read access to the target table and related tables (CMDB, knowledge, SLA)
• Knowledge: Cross-module ServiceNow data model, relationship patterns between tables
• Related Skills: itsm/incident-activity-summarization for activity context, genai/playbook-recommendations for action recommendations

Procedure

Step 1: Identify the Target Record and Table

Determine what record the user is viewing and its table context.

MCP Approach:

Tool: SN-Get-Record
Parameters:
  table_name: incident
  sys_id: <record_sys_id>
  fields: sys_id,sys_class_name,number,short_description,description,state,priority,impact,urgency,category,subcategory,assigned_to,assignment_group,opened_at,opened_by,caller_id,cmdb_ci,parent,caused_by,problem_id,rfc

REST Approach:

GET /api/now/table/incident/<record_sys_id>
  ?sysparm_fields=sys_id,sys_class_name,number,short_description,description,state,priority,impact,urgency,category,subcategory,assigned_to,assignment_group,opened_at,caller_id,cmdb_ci,problem_id,rfc
  &sysparm_display_value=true

Step 2: Discover Table Schema for Context Fields

Understand what fields and references are available for this record type.

MCP Approach:

Tool: SN-Get-Table-Schema
Parameters:
  table_name: incident

Identify reference fields that link to other tables for cross-module exploration.

Step 3: Surface Related Records

Query for records connected to the target through references, relationships, and shared attributes.

Related Incidents (same CI or category):

MCP Approach:

Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: cmdb_ci=<ci_sys_id>^sys_id!=<current_sys_id>^active=true^ORDERBYDESCopened_at
  fields: sys_id,number,short_description,state,priority,opened_at,assigned_to
  limit: 10

CMDB Relationships (upstream/downstream services):

Tool: SN-Query-Table
Parameters:
  table_name: cmdb_rel_ci
  query: parent=<ci_sys_id>^ORtype_id.name=Depends on::Used by
  fields: sys_id,parent,child,type_id
  limit: 20

Related Knowledge Articles:

Tool: SN-Query-Table
Parameters:
  query: workflow_state=published^123TEXTQUERY321=<short_description>
  table_name: kb_knowledge
  limit: 5

Associated Change Requests:

Tool: SN-Query-Table
Parameters:
  table_name: change_request
  query: cmdb_ci=<ci_sys_id>^state!=closed^ORstate=closed^closed_at>javascript:gs.daysAgo(7)
  fields: sys_id,number,short_description,state,type,start_date,end_date,risk
  limit: 5

Problem Records:

Tool: SN-Query-Table
Parameters:
  table_name: problem
  query: sys_id=<problem_id>^ORcmdb_ci=<ci_sys_id>^active=true
  fields: sys_id,number,short_description,state,root_cause,workaround
  limit: 5

Step 4: Analyze Historical Patterns

Find patterns from similar records in the past.

Similar Past Incidents:

MCP Approach:

Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: category=<category>^subcategory=<subcategory>^state=6^resolved_at>javascript:gs.daysAgo(180)
  fields: sys_id,number,short_description,resolved_at,resolution_code,close_notes,assigned_to,assignment_group,calendar_duration
  limit: 25

Aggregate Statistics:

REST Approach:

GET /api/now/stats/incident
  ?sysparm_query=category=<category>^subcategory=<subcategory>^resolved_at>javascript:gs.daysAgo(180)
  &sysparm_avg_fields=calendar_duration,reassignment_count
  &sysparm_count=true

Build pattern analysis:

=== PATTERN ANALYSIS ===
Based on 47 similar incidents (same category/subcategory, last 180 days):

Resolution Statistics:
- Average Resolution Time: 4.2 hours
- Median Resolution Time: 2.8 hours
- 90th Percentile: 12 hours
- Current Incident Age: 1.5 hours (below average)

Common Resolution Methods:
1. Service restart (42%) - Average 1.5 hours
2. Configuration change (28%) - Average 3.2 hours
3. Vendor escalation (18%) - Average 18 hours
4. Patch deployment (12%) - Average 8 hours

Assignment Patterns:
- Most frequently resolved by: Network Operations (38%)
- Second: Application Support (25%)
- Current assignment: Database Team (resolves 15% of similar incidents)

Recurrence:
- Same CI has had 3 similar incidents in 90 days
- Same category averages 8 incidents per month

Step 5: Assess Risk Factors

Evaluate current risk indicators for the record.

SLA Status:

MCP Approach:

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: task=<record_sys_id>
  fields: sys_id,sla,stage,has_breached,planned_end_time,percentage,business_percentage
  limit: 5

Escalation Risk:

=== RISK ASSESSMENT ===

SLA Risk:
- Response SLA: 45% elapsed, 55% remaining (ON TRACK)
- Resolution SLA: 35% elapsed, target in 6.5 hours (ON TRACK)
- Breach Probability: 15% (based on similar incident resolution times)

Escalation Indicators:
- VIP Caller: No
- Business-Critical CI: Yes (production database)
- Priority: P2 (escalation at 4 hours if unresolved)
- Current Age: 1.5 hours
- Reassignment Count: 0 (good)

Impact Assessment:
- Affected Users: ~200 (based on CI dependency mapping)
- Dependent Services: 3 (Order Processing, Reporting, Auth)
- Business Impact: Medium-High (production service, business hours)
- Revenue Impact: Potential (Order Processing affected)

Step 6: Generate Recommended Actions

Based on all gathered context, recommend next steps.

=== RECOMMENDED ACTIONS ===
Record: INC0067890 - Database connection pool exhaustion

IMMEDIATE ACTIONS:
1. [HIGH PRIORITY] Check current connection pool status
   - Similar incidents resolved 42% of the time by service restart
   - Run diagnostic: Query connection pool metrics via monitoring API

2. [RECOMMENDED] Review recent changes on this CI
   - CHG0012340 was implemented 2 hours ago on related app server
   - Potential correlation with incident timing

3. [SUGGESTED] Engage Network Operations
   - This team resolves 38% of similar incidents (highest rate)
   - Current team (Database) resolves 15% of similar incidents

KNOWLEDGE RESOURCES:
4. Review KB0012345: "Database Connection Pool Troubleshooting"
   - Rating: 4.5/5, used to resolve 12 similar incidents
   - Key procedure: Connection pool drain and restart (Section 3)

5. Review KB0013001: "Application Server Health Checks"
   - Related to recent change CHG0012340

PREVENTIVE ACTIONS:
6. Create Problem record to investigate recurrence
   - 3 similar incidents on this CI in 90 days suggests systemic issue
   - Link to existing Problem PRB0004567 if related

COMMUNICATION:
7. Notify affected service owners
   - Order Processing team (primary dependency)
   - Send proactive status update via major incident channel

Step 7: Cross-Module Enrichment

Pull contextual data from other ServiceNow modules.

Customer Context (for CSM cases):

MCP Approach:

Tool: SN-Query-Table
Parameters:
  table_name: sn_customerservice_case
  query: account=<account_sys_id>^active=true
  fields: sys_id,number,short_description,priority,state,product
  limit: 10

HR Context (for employee-related records):

Tool: SN-Query-Table
Parameters:
  table_name: sn_hr_core_case
  query: subject_person=<caller_sys_id>^active=true
  fields: sys_id,number,short_description,hr_service,state
  limit: 5

CMDB Asset Context:

Tool: SN-Query-Table
Parameters:
  table_name: alm_hardware
  query: ci=<ci_sys_id>
  fields: sys_id,display_name,model,serial_number,warranty_expiration,install_status,cost
  limit: 1

Step 8: Compile the AI Lens View

Assemble all insights into a comprehensive contextual panel:

=== AI LENS: INC0067890 ===
Database Connection Pool Exhaustion on prod-db-01

--- Quick Stats ---
Age: 1h 30m | Priority: P2 | SLA: On Track (65% remaining)
Similar Incidents (180d): 47 | Avg Resolution: 4.2h
Recurrence on this CI: 3 in 90 days (FLAGGED)

--- Related Records ---
Active on Same CI:
  - INC0067885 (P3, monitoring alert - auto-resolved)
  - CHG0012340 (Normal, app server config - completed 2h ago) *CORRELATION*

Known Problems:
  - PRB0004567: Recurring connection pool issues (Under Investigation)

Knowledge:
  - KB0012345: Connection Pool Troubleshooting (4.5 stars, 12 resolves)
  - KB0013001: App Server Health Checks (relevant to recent change)

--- Insights ---
1. Recent change CHG0012340 correlates with incident timing -- investigate
2. Connection pool issues are recurring (3 in 90 days) -- systemic root cause likely
3. Service restart resolves 42% of similar incidents -- try first
4. Current team assignment may not be optimal -- Network Ops has higher success rate

--- Recommended Actions ---
1. Check connection pool metrics [Most Likely Resolution: Service Restart]
2. Investigate correlation with CHG0012340 [Change-Related Root Cause]
3. Consider reassignment to Network Operations [Higher Success Rate]
4. Create/link to Problem PRB0004567 [Prevent Recurrence]

Step 9: Track Lens Usage and Effectiveness

Monitor how AI Lens recommendations are used.

MCP Approach:

Tool: SN-Create-Record
Parameters:
  table_name: u_ai_lens_usage
  data:
    u_record: "<record_sys_id>"
    u_table: "incident"
    u_recommendations_shown: 4
    u_recommendation_followed: ""
    u_user: "<current_user_sys_id>"
    u_timestamp: "2025-12-10 04:00:00"

Step 10: Provide Lens for List Views

Generate aggregate insights for a list of records.

MCP Approach:

Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: assignment_group=<group_sys_id>^active=true^ORDERBYpriority
  fields: sys_id,number,short_description,priority,state,opened_at,cmdb_ci,category
  limit: 50

=== AI LENS: Team Queue Overview ===
Team: Database Administration | Active Incidents: 12

Queue Health:
- P1: 0 | P2: 2 | P3: 7 | P4: 3
- SLA At Risk: 1 (INC0067888 - 85% elapsed)
- Avg Age: 3.2 days | Oldest: 8 days (INC0067500)
- Reassignment Rate: 15% (below team average of 22%)

Patterns Detected:
- 4 incidents related to "connection pool" on database CIs (cluster)
- 3 incidents from same caller (possible systemic issue for that user)
- 2 incidents linked to CHG0012340 (change correlation)

Priority Actions:
1. Address SLA-at-risk incident INC0067888 immediately
2. Investigate connection pool cluster (4 incidents) as potential problem
3. Contact repeat caller to address underlying issue

Tool Usage

Tool	Purpose	When to Use
SN-Get-Record	Retrieve target record details	Initial context gathering
SN-Query-Table	Fetch related records, history, patterns	Cross-module data retrieval
SN-Natural-Language-Search	Find knowledge articles by similarity	Knowledge recommendation
SN-Update-Record	Save lens insights to record	Persisting recommendations
SN-Get-Table-Schema	Discover available fields and references	Understanding record structure

Best Practices

1. Prioritize actionable insights -- surface what the user can act on, not just information
2. Show evidence for every insight -- link claims to data (e.g., "42% resolution rate based on 47 incidents")
3. Highlight correlations -- recent changes, recurring patterns, and related records are high-value
4. Respect performance -- limit queries to relevant time windows and record counts
5. Adapt to record type -- incident lens differs from change request lens or HR case lens
6. Flag anomalies -- unusual patterns (high reassignment, repeat caller, rapid reopen) deserve attention
7. Include knowledge proactively -- always search for relevant KB articles
8. Show SLA context -- time remaining and breach probability are critical for task records
9. Cross-reference CMDB -- CI dependencies reveal blast radius and root cause connections
10. Support both form and list views -- individual record insights and queue-level patterns serve different needs

Troubleshooting

Issue	Cause	Resolution
No related records found	CI field is empty on the record	Fall back to category-based and description-based similarity
Pattern analysis slow	Too many historical records queried	Narrow time window (90 days instead of 365) and add category filter
Knowledge results irrelevant	Short description too vague	Combine short_description with category for better NL search
CMDB relationships missing	CI not in CMDB or relationships not mapped	Use cmdb_ci table directly for basic CI info
SLA records absent	No SLA definitions for this record type	Skip SLA section and note in output
Cross-module data inaccessible	Role restrictions on other module tables	Limit lens to accessible tables based on user roles

Examples

Example 1: Incident Form AI Lens

Input: "Show AI Lens for INC0067890"

Steps: Retrieve incident, query related incidents on same CI, fetch CMDB dependencies, find knowledge articles, analyze historical patterns, assess SLA risk, generate recommended actions.

Example 2: CSM Case AI Lens

Input: "Analyze case CS0034567 with AI Lens"

Steps: Retrieve case, pull customer account history, find similar cases by product/category, check for known issues or outages, retrieve customer sentiment trend, recommend response strategy.

Example 3: Queue-Level AI Lens

Input: "Show AI Lens for the Network Operations incident queue"

Steps: Query all active incidents for the group, aggregate by priority/category/age, identify clusters and patterns, flag SLA risks, detect repeat issues, generate queue management recommendations.

Related Skills

• itsm/incident-activity-summarization - Detailed activity summaries for individual incidents
• genai/playbook-recommendations - Match records to automation playbooks
• cmdb/impact-analysis - CI dependency and impact analysis
• knowledge/content-recommendation - Knowledge article recommendations
• reporting/trend-analysis - Historical trend analysis and reporting
• itsm/incident-triage - Incident classification and routing