Can ServiceNow detect emerging risk across multiple low-priority incidents?

ItlogicC · 3 weeks ago

Can ServiceNow automatically detect when multiple individually low-priority incidents may collectively indicate an emerging operational problem?

For example, suppose several P3 incidents occur across different departments and applications. Each incident is resolved within SLA, overall incident volume is normal, and MTTR looks healthy. However, the incidents have similar symptoms or timing that could indicate a common underlying issue.

Can ServiceNow automatically correlate these incidents and alert an IT operations manager that the combined pattern may warrant attention, even though the individual incidents and normal KPIs do not?

If yes, which capability handles this today — Incident Management, Predictive Intelligence, Now Assist, Performance Analytics, AIOps, or something else?

If not, is this type of correlation normally identified manually by incident/problem management teams?

vaishali231 · 3 weeks ago

Hey @ItlogicC

Yes, ServiceNow can help identify this type of pattern, but it is important to distinguish between incident similarity/correlation and automatically determining that the incidents represent a common underlying operational problem.

For the scenario described, I would not rely on Incident Management or Performance Analytics alone.

1. Incident Management

Incident Management primarily manages the lifecycle of individual incidents.

For example, if several P3 incidents are created:

Each incident is within SLA

MTTR is healthy

No incident reaches a major incident threshold

Overall incident volume appears normal

Incident Management by itself does not generally conclude that these incidents collectively indicate an emerging operational problem.

So the individual incident KPIs can remain healthy while a larger pattern is developing.

2. Predictive Intelligence

This is one of the closest capabilities for the scenario.

Predictive Intelligence can use similarity and clustering to identify incidents that have similar characteristics.

For example:

P3 - Login timeout

P3 - Authentication failure

P3 - SSO timeout

P3 - Unable to access application

P3 - Login intermittently failing

Individually, these may all remain P3 incidents.

However, Predictive Intelligence can identify that the incidents have similarities and can help group related records.

This is particularly useful for identifying patterns that may otherwise require someone from Incident or Problem Management to notice manually.

One important point is that similarity does not automatically mean that the incidents have the same root cause. It provides a correlation or pattern that needs to be investigated.

3. AIOps / ITOM

If these incidents are associated with monitoring events, infrastructure, applications, services, metrics, logs, or CIs, then AIOps is generally the stronger capability.

For example:

Monitoring Events

|

v

Event Management / AIOps

|

+--> Alert correlation

+--> Similar alerts

+--> Anomaly detection

+--> CI / service relationships

+--> Service impact

|

v

Potential operational issue

|

v

Incident / Problem investigation

AIOps can correlate operational signals using information such as CI relationships, service dependencies, alert characteristics and other telemetry.

This is particularly valuable when the objective is to detect the operational condition before it becomes a major incident.

4. Performance Analytics

Performance Analytics is useful for identifying trends and patterns in the incident data.

For example, you could create breakdowns around:

Application

Service

CI

5. Now Assist

Now Assist can be useful for investigation and summarization, but I would not describe it as the primary mechanism responsible for detecting this pattern.

A better way to position it is:

Predictive Intelligence / AIOps

|

v

Detect / correlate

|

v

Now Assist

|

v

Summarize / investigate

The exact capabilities available will depend on the ServiceNow release and licensed products.

Important limitation

I would not say that ServiceNow automatically understands that "10 P3 incidents = an emerging operational problem" out of the box in every implementation.

ServiceNow provides capabilities such as incident similarity, clustering, major incident detection/recommendation and AIOps-based event/alert correlation. The actual business rule for something like:

"If 8 similar P3 incidents occur across different applications within 2 hours, notify the IT Operations Manager."

would normally require configuration based on your organization's definition of an emerging issue.

The threshold could depend on:

Number of incidents

Time window

Similarity

Affected service

CI

Application

Symptom

Business criticality

Geographic location

User impact

What happens traditionally?

Without these capabilities, this is often identified manually by Incident or Problem Management teams.

For example, an incident manager may notice:

"We have had six unrelated P3 incidents this morning, but all of them mention authentication failures."

That person may then investigate whether there is a common underlying problem.

Predictive Intelligence and AIOps can reduce this dependency on manual observation by identifying the pattern earlier.

*************************************************************************************************************************************

If this response helps, please mark it as Accept as Solution and Helpful.

Doing so helps others in the community and encourages me to keep contributing.

Regards

Vaishali Singh

Servicenow Developer
Linkedin - https://www.linkedin.com/in/vaishali-singh-2273361bb