Every 5 minutes
Post P1 and P2 incidents to Slack
High-priority incidents show up in your chat channel within minutes of being logged.
- Runs
- Every 5 minutes
- Apps
- ServiceNow
- AI
- Not needed
- Access
- itil (read incident)
Send this to your assistant
Create a ClickRuntime automation: every 5 minutes, check ServiceNow for new incidents with priority 1 or 2 and post the number, short description and assignment group to #major-incidents in Slack.
First time? Adding ClickRuntime to your assistant takes about two minutes.
Why use it
Why teams use this automation
A P1 incident in ServiceNow, such as the payment system being down, needs people within minutes. But the notification depends on whoever happens to be looking at the queue, or on email rules that go to a distribution list people have muted. On a busy day, a new P2 sits unassigned for forty minutes because the queue is full of routine tickets and nobody sees the one that matters. The cost is longer outages and breached response targets.
Every five minutes the automation queries the incident table for records created since its last check, keeps only priority 1 and 2, and posts them to Slack with number, short description and assignment group. It saves the newest timestamp so nothing repeats. Service desks, on-call engineers and IT managers use it to make sure critical incidents are seen quickly.
What you get out of it
Critical incidents are seen within minutes
A channel post puts a new P1 in front of everyone on call. Starting work within five minutes rather than forty reduces the outage's duration and its effect on customers.
Routine tickets stay out of the way
Only P1 and P2 incidents are posted, so the channel carries urgent items alone. People trust that a message deserves attention, which makes them react at once. A hundred routine P4 tickets a day never appear, so the channel does not train people to ignore it.
Unassigned incidents are noticed
The post shows the assignment group, or the lack of one. A manager can see an incident with no owner and assign it, before the response target slips. An incident with an empty assignment group is visible within five minutes, not after the response target has slipped.
Shared awareness across teams
Network, application and database teams all see the same alert, so cross-team incidents are noticed by every group involved. The first bridge call starts sooner and with the right people.
Evidence for SLA reviews
Posts carry timestamps, so you can show when an incident was announced and how quickly someone responded. That is useful when reviewing response performance or explaining a delay to a customer.
How it works
What happens, step by step
Every 5 minutes, ClickRuntime checks ServiceNow for incidents logged since its last check.
It keeps only the critical and high-priority ones.
Each is posted to your Slack channel with its priority, number, title and assigned group.
Before it runs live
- Connect ServiceNow
What you get
Build your own
Need it to work differently?
Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.
Changes you can ask for
- Act only on the items that match your own rules, and skip the rest
- Add an AI step, for example to summarize, sort or draft a reply
- Add another app, for example also send it to Slack
- Combine it with other ServiceNow steps into one automation
Under the hood
The code that runs this automation
from datetime import datetime, timezone
from clickruntime import on_trigger, credentials, http, state, notify, report_fetched
INSTANCE = "northwind"
def snow(method, path, **kw):
resp = http.request(method, f"https://{INSTANCE}.service-now.com/api/now/{path}",
auth=(credentials.secret("SERVICENOW_USER"), credentials.secret("SERVICENOW_PASSWORD")),
headers={"Accept": "application/json"}, **kw)
resp.raise_for_status()
return resp.json()["result"]
@on_trigger
def run(event):
since = state.get("since") or datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
rows = snow("GET", "table/incident", params={
"sysparm_query": f"sys_created_on>{since}^priorityIN1,2^ORDERBYsys_created_on",
"sysparm_display_value": "true", "sysparm_fields": "number,short_description,assignment_group,priority,sys_created_on"})
report_fetched(len(rows))
if not rows:
return {"summary": "Nothing new"}
for i in rows:
group = (i["assignment_group"] or {}).get("display_value", "unassigned")
notify.slack(f"{i['priority']}: *{i['number']}* {i['short_description']} → {group}", channel="#major-incidents")
state.set("since", datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S"))
return {"posted": len(rows)}FAQ
Common questions
Which priorities are posted by default?
Will updates to an existing incident trigger a new post?
What if ServiceNow is slow or unavailable when it checks?
What permissions does it need?
Does it need AI?
How many runs does it use?
Can I change how it works?
Related
You might also like
Hear when your incidents change
You get an email when an incident assigned to you is updated, with what changed.
See how it worksLook up an incident from a Slack command
Typing an incident number into a slash command replies with its state, priority and assignee.
See how it worksTurn bug reports into ServiceNow incidents
Each report your bug tool sends becomes an incident with the description, page URL and browser details.
See how it worksKeep exploring
Set up “Post P1 and P2 incidents to Slack” from your assistant
Copy the prompt above, or connect your assistant first. Free plan, no credit card.
