ITOM Office Hours Q&A October 2026 | APAC Session

[DoroDownUnder]

This document contains 15 questions and answers from the APAC ITOM Office Hours session held on October 28, 2026.

Note: Answers were processed using AI transcription and extraction. While we have made every effort to ensure accuracy, these answers may contain inaccuracies or miss nuances from the original spoken response.

#	Question		Answer
1	Has anyone started using AI with their ITOM products?		One attendee shared a use case (not yet in production, pending internal AI council review). When a critical or major alert arrives, a custom agentic workflow reviews the most relevant past alerts. It assesses significance using the business service, how long the alert was open, severity, keywords, and human-entered work notes. It validates the payload before calling the LLM to save tokens, uses a script include to score significance as a percentage, then has the LLM summarise everything and write initial triage and possible resolution steps into the alert work notes. The goal is to reduce MTTR and handle alerts before they become incidents.
2	We want to build a use case for event correlation on events. What parameters should we look for?		There are many alert grouping and correlation options, and the documentation explains where each applies. Event Management project workshop presentation pack: https://mynow.servicenow.com/now/best-practices/assets/event-management-project-workshop. Alert grouping types and creation methods: https://www.servicenow.com/docs/r/it-operations-management/event-management/Alert-Groups.html
3	Are there examples of discovering and monitoring NVIDIA GPUs and NVLink 72 racks, including metrics such as utilisation, temperature and power? (Context: an AI factory engagement; NVIDIA exposes these metrics through Kubernetes GPU extensions and commands such as nvidia-smi.)		Discovery is supported through the NVIDIA GPU discovery pattern, believed to be a step within Linux server pattern discovery: https://www.servicenow.com/docs/r/it-operations-management/discovery-and-service-mapping-patterns/nv.... The panel isn't aware of any time-based metrics collection today and will check and get back.
4	When is LEAP planned for the Alerts table? Today it only covers the Incident table, and an alert-first organisation needs it for alerts.		No product manager was on the call. As far as the panel knows, there is no roadmap for LEAP to analyse alert data.
5	When will Health Log Analytics and Metric Intelligence support mTLS between the MID Server and the instance? Basic authentication is being deprecated, and the new ITOM Infrastructure Services workspace helps migrate to mTLS and other secure methods. However, the HLA documentation says MID Servers running mTLS can't be selected for log ingestion, and a support case said there is no roadmap for mTLS.		We’ve checked internally, there currently is a backlog item to look at the support for mTLS. Unfortunately, there is no timeline at this stage. With JWT, this is relatively new and has not been tested with ACC-L. The recommendation at this time is to use basic authentication for ACC-L as per documentation.
6	What percentage of usage is Service Operations Workspace (SOW) versus the legacy UI? Are there specific UI policies or checks to be aware of before rolling out SOW enterprise-wide and reducing legacy forms (Alerts, Event Rules, etc.)?		SOW is at parity and in places beyond it for Event Management. For example, enhancements to CI binding with fallback - https://www.servicenow.com/docs/r/australia/it-operations-management/event-management/enrich-alert-s.... All AI capabilities for Event Management, such as summarisation, are available only in SOW, not in the native UI.
7	SOW security follow-up: SOW originally offered only three Event Management personas (operator, user, admin), which was solved using groups. However, UI policies and access rights seem to differ between the legacy UI and SOW. For example, a user who can't edit the Business Service field in the legacy UI can edit it in SOW with the same access. Do UI policies need to be reviewed so that granting SOW access for Now Assist and agentic skills doesn't accidentally elevate permissions?		Review UI policies, but as an access-control review, not just UI parity. UI policies control form behaviour: ACLs control write permission. A read-only legacy field doesn't prove the user can't write to it. For the Business Service example, if the SOW change doesn't save, it's a form-behaviour issue. If it persists, check the table and field write ACLs. SOW may not be granting extra access; it may be exposing access the legacy form hid. Next actions Reproduce with the same non-admin user and record, and check whether the change persists against the write ACLs. Put form behaviour in UI policies and hard restrictions in write ACLs. Review agent invocation, run-as identity, and role masking separately from workspace access. Before enablement, test that each persona's prohibited writes are denied across legacy UI, SOW, and agents, and that allowed actions still work. Keep these as upgrade regression tests. Conclusion: Don't sign off Now Assist or agentic enablement on form consistency alone. Sign off once write restrictions and agent boundaries are verified.
8	When starting alert grouping, which method should come first (tag-based, CMDB-based or automated) if the goal is faster root cause analysis rather than noise reduction?		Start with tag-based grouping as a quick win. It doesn't depend on other data, and you fully control the rules and policies. CMDB-based grouping depends on the accuracy and completeness of CMDB data. Beyond that, the right method depends on what data is readily available, since some methods require specific data. Network traffic-based alert grouping, introduced late last year, is also worth evaluating. A phased approach (tag-based first, prioritised via the system setting for grouping order, then automated and CMDB-based) was confirmed as being on the right track.
9	What are the top new ITOM features in the Brazil release?		Release notes: https://www.servicenow.com/docs/r/release-notes/rn-summary-new-features.html. Highlights mentioned on the call: Health Log Analytics updates, MID-less integration through an MCP client, and many AIOps features, including alert auto-closing with more transparency. The AIOps AI Specialist is expected around November, before the Brazil release; this needs to be confirmed in the product documentation.
10	Tag Governance with a multi-source CMDB (Cloud Discovery and the Wiz Service Graph Connector) and millions of CMDB key value records: how can duplicate tag creation be prevented, and how can table performance be improved? Duplicates matter because the policy compliance job picks one record at random, which can flag a compliant CI as non-compliant and create unnecessary tasks.		There is no out-of-the-box deduplication for n keys and values; the same key can legitimately repeat with different values. The key value table isn't a CMDB CI table, so IRE doesn't apply, and deduplication would need to be built. This is tricky because each data source maintains key value records differently. For example, the Kubernetes Visibility Agent deletes records by script, Discovery uses deletion strategies, and Service Graph Connectors likely behave differently again. Recommendation: raise a support case to confirm expected out-of-the-box behaviour. Tag-based service families and maps were reported to work well once duplicates are removed
11	How should tag policies be made case-insensitive (e.g. "PRD" vs "prd", "TEST" vs "test") so correct values aren't flagged non-compliant? Is it better to add a business rule on the CMDB key value table to lowercase values on insert/update, or to clone the out-of-the-box policy type definition and lowercase values before evaluation?		The panel hasn't seen customers enforce case-in sensitive tag policies; they usually check that standard keys are used and populated. How strict to make policies is your choice, but a case-sensitive policy will keep generating tasks. If two sources bring different cases for the same value, one population method is reformatting the data, which I dot shouldn't. Values should come in one-to-one with the source. Check the value at the root source (e.g. the AWS resource), identify which population method changes it, and raise a support case against that source, calling out the discrepancy between Discovery and the Service Graph Connector. No recommendation was given on business rule versus cloned policy type.
12	Has any customer successfully deployed an MCP server with the CMDB agent to provide context around services?		No ANZ customer is known to have deployed it to production. The panel will check with the responsible product manager (Mark Bodman) about customers worldwide.
13	Feasibility of automating the response to zero-day vulnerabilities: trigger an analysis from a vulnerability system to identify potentially impacted systems, users and business services, create the appropriate approvals and changes, then orchestrate patching and CMDB updates.		Vulnerability Response, part of Unified Security Exposure Management (USEM), does most of this. Note that it requires additional licensing.
14	The Kubernetes Visibility Agent informers (18) were deployed with YAML files and upgraded remotely from ServiceNow (e.g. to 2.9.1), but the version in the YAML files wasn't updated. Could a sync with the stale YAML roll the informers back to the previous version? Does the latest YAML need to be applied on every upgrade?		Upgrading from within ServiceNow isn't expected to be a problem. You select the target version, trigger the update, and the instance shows the version hat is n actually running. Common to see customers upgrading KVA using Helm instead. Don't mix the two methods: if you manage the deployment with Helm, stick with Helm, because updates made from ServiceNow put it out of sync. Therefore, if you apply the old/stale YAML, it can roll it back – do test.
15	Can we migrate the Kubernetes Visibility Agent deployment from YAML files to Helm?		Discuss it with your infrastructure/Kubernetes team who manage the clusters and what their standard is for managing deployments. Helm is a supported install method for KVA.