Every 5 minutes
Post new high-priority ServiceNow incidents to Slack
Every new priority 1 or 2 incident appears in your IT Slack channel within minutes, with its number, short description and a link.
- Runs
- Every 5 minutes
- Apps
- ServiceNow, Slack
- AI
- Not needed
- Access
- ServiceNow itil read; Slack chat:write
Send this to your assistant
Create a ClickRuntime automation: every 5 minutes, post new ServiceNow incidents with priority 1 or 2 to #it-ops with the number, short description, assignment group and a link.
First time? Adding ClickRuntime to your assistant takes about two minutes.
Why use it
Why teams use this automation
The IT team at a mid-sized logistics company logs everything in ServiceNow, but nobody sits watching the incident queue. When the warehouse scanning system goes down at 7am, the incident is logged by the service desk and then waits for someone to refresh a list. Meanwhile the team is chatting in Slack, unaware.
This automation brings urgent incidents to where the team already is. Every 5 minutes it checks ServiceNow for new priority 1 and 2 incidents and posts each one to #it-ops with the number, short description, assignment group and a link. The right people see it straight away and can swarm on it in a thread.
What you get out of it
Faster response to outages
Minutes matter in a major incident. Seeing it in Slack as soon as it is logged means the response starts sooner and the business loses less time.
Only the incidents that need attention
Filtering to priority 1 and 2 keeps the channel focused. People take the alerts seriously because they are not drowned in routine tickets.
A place to coordinate
Each incident gets its own Slack message, so the team can discuss it in a thread. Updates stay together and anyone joining late can catch up quickly.
One click to the full record
The link opens the incident in ServiceNow. Updates and resolution notes still go where they belong.
How it works
What happens, step by step
Every 5 minutes, ClickRuntime asks ServiceNow for incidents created since its last check with priority 1 or 2.
It remembers the time of the newest incident it has seen, so each one is only posted once.
Each new incident is posted to your #it-ops Slack channel with its number, priority, short description, assignment group and a link.
Before it runs live
- Connect ServiceNow
- Connect Slack, then invite the app to the channel (type /invite @ClickRuntime there)
What you get
Build your own
Need it to work differently?
Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.
Changes you can ask for
- Act only on the items that match your own rules, and skip the rest
- Add an AI step, for example to summarize, sort or draft a reply
- Add another app, for example also send it to Google Sheets
- Combine it with other ServiceNow and Slack steps into one automation
Under the hood
The code that runs this automation
from datetime import datetime, timezone
from clickruntime import on_trigger, credentials, http, state, notify, report_fetched
INSTANCE = "northwind.service-now.com"
def sn(method, path, **kw):
r = http.request(method, f"https://{INSTANCE}/api/now/table/{path}", auth=(credentials.secret("SERVICENOW_USER"), credentials.secret("SERVICENOW_PASSWORD")),
headers={"Accept": "application/json"}, **kw)
r.raise_for_status()
return r.json()["result"]
@on_trigger
def run(event):
since = state.get("since") or datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
incidents = sn("GET", "incident", params={"sysparm_query": f"sys_created_on>{since}^priorityIN1,2^ORDERBYsys_created_on",
"sysparm_display_value": "true", "sysparm_fields": "sys_id,number,priority,short_description,assignment_group,sys_created_on"})
report_fetched(len(incidents))
if not incidents:
return {"posted": 0}
for inc in incidents:
group = (inc.get("assignment_group") or {}).get("display_value", "unassigned")
notify.slack(f"🚨 {inc['number']} ({inc['priority']}): {inc['short_description']}\nGroup: {group}\nhttps://{INSTANCE}/incident.do?sys_id={inc['sys_id']}", channel="#it-ops")
state.set("since", incidents[-1]["sys_created_on"])
return {"posted": len(incidents)}FAQ
Common questions
Can I change which incidents are posted?
Does it post updates when an incident changes?
Can ServiceNow send incidents instantly instead?
What permissions does it need?
Does it need AI?
How many runs does it use?
Can I change how it works?
Related
You might also like
Escalate ServiceNow incidents before they breach SLA
Open incidents that have used more than 75 percent of their SLA are raised in priority and flagged in Slack once, while there is still time to act.
See how it worksSpot recurring incidents in ServiceNow every morning
Each morning your IT channel gets a short list of problems that keep coming back across the last week of incidents, with counts and links.
See how it worksSee new job listings as they're posted
Jobs that match your keywords show up in a Slack channel, each one only once.
See how it worksKeep exploring
Set up “Post new high-priority ServiceNow incidents to Slack” from your assistant
Copy the prompt above, or connect your assistant first. Free plan, no credit card.
