On a schedule

Escalate ServiceNow incidents before they breach SLA

Open incidents that have used more than 75 percent of their SLA are raised in priority and flagged in Slack once, while there is still time to act.

Runs: On a schedule
Apps: ServiceNow, Slack
AI: Not needed
Access: ServiceNow read+write; Slack chat:write

Send this to your assistant

Create a ClickRuntime automation: every 15 minutes, check open ServiceNow incidents whose SLA is over 75% elapsed, raise their priority, and alert #it-ops once per incident.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

An IT service provider has contractual response and resolution times with each client, and missed SLAs mean service credits and awkward review meetings. ServiceNow tracks the timers, but nobody watches them minute by minute, so an incident often comes to light only after it has already breached.

This automation gives the team a warning while there is still time. Every 15 minutes it checks active SLAs that are more than 75 percent elapsed, raises the priority of each related incident so it moves up the queue, and posts one alert in #it-ops. The team can pick it up, reassign it or update the customer before the clock runs out.

What you get out of it

Fewer missed SLAs
A warning at 75 percent leaves time to act. Fixing or escalating before the deadline protects both the customer relationship and your service credits.
The queue reorders itself
Raising the priority moves at-risk incidents to the top of everyone's list. Engineers working the queue see them first without checking timers.
One alert per incident
Each incident is flagged once, not every 15 minutes. The channel stays readable and each alert gets attention.
Better conversations with customers
Knowing early lets you update a customer before a breach rather than after. That is a much easier conversation.

How it works

What happens, step by step

Every 15 minutes, ClickRuntime asks ServiceNow for active SLAs that are more than 75 percent elapsed.
It skips incidents it has already flagged, so each one is only escalated once.
For each new at-risk incident, it raises the priority by one level in ServiceNow.
It posts an alert to #it-ops with the incident number, how much of the SLA has passed and a link.

Before it runs live

Connect ServiceNow
Connect Slack, then invite the app to the channel (type /invite @ClickRuntime there)

What you get

RunsOn a schedule

Escalate ServiceNow incidents before they breach SLAtoday, 9:00Succeeded

Slack · #it-ops⏱️ INC0012388 is 82% through its SLA: Acme Corp VPN drops every hour. Raised to P2.

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Google Sheets
Combine it with other ServiceNow and Slack steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

warn_on_incidents_at_risk_of_sla_breach.pyexample

from clickruntime import on_trigger, credentials, http, state, notify

INSTANCE = "northwind.service-now.com"

def sn(method, path, **kw):
    r = http.request(method, f"https://{INSTANCE}/api/now/table/{path}", auth=(credentials.secret("SERVICENOW_USER"), credentials.secret("SERVICENOW_PASSWORD")),
                     headers={"Accept": "application/json"}, **kw)
    r.raise_for_status()
    return r.json()["result"]

@on_trigger
def run(event):
    flagged = set(state.get("flagged") or [])
    slas = sn("GET", "task_sla", params={"sysparm_query": "active=true^percentage>75^task.sys_class_name=incident",
                                         "sysparm_fields": "task.sys_id,task.number,task.priority,task.short_description,percentage"})
    new = [s for s in slas if s["task.sys_id"] not in flagged]
    for s in new:
        priority = max(1, int(s["task.priority"] or 4) - 1)
        sn("PATCH", f"incident/{s['task.sys_id']}", json={"priority": str(priority)})
        notify.slack(f"⏱️ {s['task.number']} is {float(s['percentage']):.0f}% through its SLA: {s['task.short_description']}\nRaised to P{priority}. "
                     f"https://{INSTANCE}/incident.do?sys_id={s['task.sys_id']}", channel="#it-ops")
        flagged.add(s["task.sys_id"])
    state.set("flagged", list(flagged)[-2000:])
    return {"escalated": len(new)}

FAQ

Common questions

Can I change the 75 percent threshold?

Yes. Use any percentage, such as 50 percent for critical clients and 80 percent for others.

What priority does it set?

It raises the incident by one level, for example from 3 to 2, and never above priority 1. You can choose a fixed priority instead.

Does it need write access to ServiceNow?

Yes, to change the priority. If you would rather only be warned, it can skip that step and just post the alert.

What permissions does it need?

ServiceNow read+write; Slack chat:write. Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it runs (on a schedule). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

On a scheduleAI