Detect Recurring ServiceNow Incidents with Gemini & Slack

Detect recurring ServiceNow incidents automatically with Gemini & share results in Slack

This n8n workflow pulls recent ServiceNow incidents, identifies repeating incident patterns with Google Gemini, creates matching ServiceNow Problem records, and posts a weekly summary to Slack—so your team can move from “symptoms” to actionable root-cause work faster.

What this workflow does

• Runs weekly (Mondays at 8:00 AM) to start a new analysis (or manually for testing).
• Fetches ServiceNow Incidents opened within the last 30 days, then normalizes key fields for consistent processing.
• Groups incidents into clusters by configuration item (cmdb_ci) and category.
• For each cluster, sends incident details to Google Gemini (via an AI agent) to:
  • assess whether the pattern is recurring,
  • estimate recurrence frequency,
  • generate a root-cause hypothesis,
  • draft a problem description, and
  • recommend an appropriate priority.
• Creates ServiceNow Problem records for clusters flagged as recurring and meeting a minimum recurrence threshold.
• Builds a Slack-formatted weekly report with links back to the created ServiceNow Problem records and posts it to your configured Slack channel.

Use cases

• Automation engineers who want recurring incident detection without manual triage.
• SaaS operators running weekly IT operations reviews and needing a Problem management pipeline from incidents.
• Teams aiming to reduce repeat outages by converting repeated incident clusters into tracked ServiceNow Problems.

Technical details

• ServiceNow integration using Basic Auth: read from Incident and create records in Problem.
• Google Gemini (PaLM) credential for the Gemini chat model used by the AI agent.
• Slack integration to post the weekly incident-to-problem summary.
• Core n8n nodes/logic include: if, set, code, no op, slack, and aggregate.