The red breached indicator comes from the task_sla table where the has_breached field is true. Query that table directly, then group or dot-walk to the parent task to get the tickets.
Quickest way (list view filter):
1. Navigate to task_sla.list (Service Level Management > Task SLAs).
2. Add filter: Has breached is true (optionally also Active is true to exclude completed/cancelled SLAs).
3. Personalize the list to show Task, SLA, Business time left, Stage.
4. Right-click the column header > Export to get the ticket numbers.
Script equivalent:
var sla = new GlideRecord('task_sla');
sla.addQuery('has_breached', true);
sla.addQuery('active', true);
sla.query();
while (sla.next()) {
gs.info(sla.task.number + ' breached ' + sla.sla.getDisplayValue());
}
Note: a task can have multiple task_sla records (response, resolution, OLAs), so the same ticket may appear more than once — de-duplicate on task if needed.
