Create Business rule for incident auto downgrade from P2 to P5

[sureshp89882164]

All P2 incidents created by an System alert and caller is Event management, it trigger notification and should later be automatically downgrade to P5.

Business rule conditions on Incident table:

Caller: Event Management

Channel: Alert

Created by: System

Assignment group: Release management

priority: 2

A business Rule will be created to confirm the source of the incident and apply the following logic:

*The Business Rule will be triggered only after a P2 incident is created.

 *The Business Rule wait for 1 minute from the incident creation time.

  *After the 1-minute wait, the business rule will automatically downgrade the incident from Priority 2               (P2) to Priority 5 (P5).

* Work note will be added to the incident upon downgrade, stating: "The Incident has been downgraded from Priority 2 (P2) to Priority 5 (P5). If escalation is required, the support engineer must follow standard escalation procedures."

*Safeguard condition: If the incident is later manually escalated back to P2, the Business rule must not reapply. To enforce this, the rule will check for the presence of the above work note. If the note exists, the Business Rule will not downgrade the incident again.

[AndersBGS]

Hi @sureshp89882164 ,

Why a business rule? Why not set the right priority from start if they are created by event management?

[Laveena_A]

Hi @sureshp89882164 

Let’s not proceed with this requirement in its current form. It introduces significant long-term maintenance overhead and potential performance issues.

The implementation involves a 1-minute sleep and introduces dependencies on work notes—on top of that, it impacts the "incident" table, which is among the most heavily utilized tables in the ServiceNow ecosystem.

From what I see, the only intent behind this Business Rule is to downgrade the priority and log it in work notes—primarily to bypass future modifications. That’s not scalable or sustainable.

The right approach is to create the incident with Priority 5 directly at the source. Since this is coming from the Event Management tool, I recommend aligning the priority mapping there.

However, if there’s a compelling use case that mandates this approach, please share the full context before you proceed.

Thanks & Regards,

Laveena Agarwal

[sureshp89882164]

Yes, this is the use case. Need guidance on to achieve this requirement.