ServiceNow SLA Breach Risk in n8n + Slack Escalation

Automatically estimate ServiceNow SLA breach risk every 15 minutes—and escalate the risky incidents to Slack

This n8n workflow polls ServiceNow to estimate the likelihood of SLA breach for open incidents using recent resolution history, then updates urgency in ServiceNow and posts an alert to Slack when risk is high (probability > 70%).

What this workflow does

• Runs on a schedule every 15 minutes.
• Fetches active, unresolved incidents from ServiceNow and extracts key fields such as sys_id, number, category, priority, and opened_at.
• Builds historical resolution benchmarks by grouping incidents by category and priority, then retrieving the 20 most recent resolved incidents for each group.
• Calculates breach risk for each open incident using: elapsed time ÷ historical average resolution time. If no history exists, it uses a default of 240 minutes.
• Applies a risk threshold: it checks whether breach probability is greater than 70%.
• Escalates in ServiceNow by updating the incident’s urgency and adding a work note documenting the auto-escalation.
• Notifies your team in Slack by posting a breach-risk alert to a configured channel.

Use cases

• Proactively surface high-risk ServiceNow incidents before SLA breach occurs.
• Reduce manual monitoring by using recent resolution history to estimate breach probability.
• Trigger consistent escalation updates (urgency + work notes) and real-time Slack alerts for on-call teams.

Technical details

• Integrations: ServiceNow (Basic Auth) and Slack (channel alerts).
• Core workflow logic: if, set, code, no op, wait, limit.
• Configurable settings: breach-risk threshold (default 70%), default SLA minutes (default 240), and ServiceNow query filters (active/state/category/priority) to match your SLA rules.