Skip to content

Every 5 minutes

Post P1 and P2 incidents to Slack

High-priority incidents show up in your chat channel within minutes of being logged.

Runs
Every 5 minutes
Apps
ServiceNow
AI
Not needed
Access
itil (read incident)

Send this to your assistant

Create a ClickRuntime automation: every 5 minutes, check ServiceNow for new incidents with priority 1 or 2 and post the number, short description and assignment group to #major-incidents in Slack.

Paste it into your assistant. It tells you what it will send or change before it runs live.

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

A P1 incident in ServiceNow, such as the payment system being down, needs people within minutes. But the notification depends on whoever happens to be looking at the queue, or on email rules that go to a distribution list people have muted. On a busy day, a new P2 sits unassigned for forty minutes because the queue is full of routine tickets and nobody sees the one that matters. The cost is longer outages and breached response targets.

Every five minutes the automation queries the incident table for records created since its last check, keeps only priority 1 and 2, and posts them to Slack with number, short description and assignment group. It saves the newest timestamp so nothing repeats. Service desks, on-call engineers and IT managers use it to make sure critical incidents are seen quickly.

What you get out of it

  • Critical incidents are seen within minutes

    A channel post puts a new P1 in front of everyone on call. Starting work within five minutes rather than forty reduces the outage's duration and its effect on customers.

  • Routine tickets stay out of the way

    Only P1 and P2 incidents are posted, so the channel carries urgent items alone. People trust that a message deserves attention, which makes them react at once. A hundred routine P4 tickets a day never appear, so the channel does not train people to ignore it.

  • Unassigned incidents are noticed

    The post shows the assignment group, or the lack of one. A manager can see an incident with no owner and assign it, before the response target slips. An incident with an empty assignment group is visible within five minutes, not after the response target has slipped.

  • Shared awareness across teams

    Network, application and database teams all see the same alert, so cross-team incidents are noticed by every group involved. The first bridge call starts sooner and with the right people.

  • Evidence for SLA reviews

    Posts carry timestamps, so you can show when an incident was announced and how quickly someone responded. That is useful when reviewing response performance or explaining a delay to a customer.

How it works

What happens, step by step

  1. Every 5 minutes, ClickRuntime checks ServiceNow for incidents logged since its last check.

  2. It keeps only the critical and high-priority ones.

  3. Each is posted to your Slack channel with its priority, number, title and assigned group.

Before it runs live

  • Connect ServiceNow

What you get

RunsEvery 5 minutes
Post P1 and P2 incidents to Slacktoday, 9:00Succeeded
Slack · #major-incidents1 - Critical: INC0041219 Payments API returning 500s → Platform Ops

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.
  • Your own rules

    Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.

  • Any number of apps

    One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.

  • AI where it helps

    Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.

  • On a schedule or on each event

    Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

  • Act only on the items that match your own rules, and skip the rest
  • Add an AI step, for example to summarize, sort or draft a reply
  • Add another app, for example also send it to Slack
  • Combine it with other ServiceNow steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.
new_incident_alert.pyexample
from datetime import datetime, timezone
from clickruntime import on_trigger, credentials, http, state, notify, report_fetched

INSTANCE = "northwind"

def snow(method, path, **kw):
    resp = http.request(method, f"https://{INSTANCE}.service-now.com/api/now/{path}",
                        auth=(credentials.secret("SERVICENOW_USER"), credentials.secret("SERVICENOW_PASSWORD")),
                        headers={"Accept": "application/json"}, **kw)
    resp.raise_for_status()
    return resp.json()["result"]

@on_trigger
def run(event):
    since = state.get("since") or datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
    rows = snow("GET", "table/incident", params={
        "sysparm_query": f"sys_created_on>{since}^priorityIN1,2^ORDERBYsys_created_on",
        "sysparm_display_value": "true", "sysparm_fields": "number,short_description,assignment_group,priority,sys_created_on"})
    report_fetched(len(rows))
    if not rows:
        return {"summary": "Nothing new"}
    for i in rows:
        group = (i["assignment_group"] or {}).get("display_value", "unassigned")
        notify.slack(f"{i['priority']}: *{i['number']}* {i['short_description']} → {group}", channel="#major-incidents")
    state.set("since", datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S"))
    return {"posted": len(rows)}

FAQ

Common questions

Which priorities are posted by default?
Priority 1 (Critical) and priority 2 (High). The filter is a simple condition on the priority field, so you can include priority 3 or limit alerts to P1 only, depending on how busy your channel is.
Will updates to an existing incident trigger a new post?
No. The query looks at creation time, so each incident is posted once when it first appears. For changes in state or priority, a separate automation that watches sys_updated_on can send those updates.
What if ServiceNow is slow or unavailable when it checks?
The run would fail and appear in the run log. Because the timestamp is only saved after a successful run, the next check picks up every incident created during the gap, so none are missed.
What permissions does it need?
itil (read incident). Nothing else in your accounts is used.
Does it need AI?
No. It runs without AI, so it doesn't use your plan's AI allowance.
How many runs does it use?
One run each time it checks. Checks that find nothing new and stop right away aren't counted.
Can I change how it works?
Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Set up “Post P1 and P2 incidents to Slack” from your assistant

Copy the prompt above, or connect your assistant first. Free plan, no credit card.