Remedial actions using Playbook

  • Release version: Zurich
  • Updated July 31, 2025
  • 4 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Remedial actions using Playbook

    In the ServiceNow Zurich release, the Investigate tab within the Incident record page enables you to resolve Configuration Item (CI)-related issues using remedial actions powered by playbooks. These remedial actions primarily includeEnd processandRestart service, which help you manage problematic processes or services on affected CIs directly from the Service Operations Workspace.

    Show full answer Show less

    Playbooks provide an interactive, step-by-step UI to control and execute remediation workflows, enhancing your ability to respond effectively to CI issues.

    Prerequisites and Availability

    • The Investigation Framework [sninvestfwk] and Remedial Action Framework [com.snc.snreacf] applications must be installed and configured.
    • Remedial actions must be configured to appear on the UI for the Investigate tab.
    • Playbooks are accessible via the contextual side panel on the Incident record page.
    • Remedial actions are available only if triggered and cannot be run concurrently or duplicated on the same CI unless explicitly allowed through configuration.

    Using Remedial Actions and Playbooks

    When you perform remedial actions such as ending a process or restarting a service, these actions are logged and managed through playbooks, which appear in a dedicated panel with Current and History tabs:

    • Current tab: Lists ongoing remedial actions with statuses New and In Progress.
    • History tab: Shows completed, canceled, or failed remedial actions.

    You can apply remedial actions to both the affected CIs and their associated caller CIs. If a playbook is in progress, you can cancel it via the playbook menu, with appropriate status updates and the ability to view cancellation reasons when applicable.

    The Investigate tab also features a Remedial actions section that displays performed actions on the primary CI by default, with an option to view actions on all CIs linked to the incident.

    Details on Specific Remedial Actions

    End process

    • Available from metric cards such as "Top processes By Memory" and "Top processes By CPU".
    • For Device CI class: Requires user approval before stopping a process directly on the endpoint.
    • For Server CI class: Execution requires creating a standard change request with necessary details before ending the process.

    Restart service

    • Available from the Services metric information card.
    • For Device CI class: Requires user approval before restarting services on the endpoint.
    • For Server CI class: Requires a standard change request creation prior to restarting services.

    Important Notes

    • If the CI is DEX supported, DEX-specific playbooks are shown; if supported by Service Operations Workspace (SOW) or default views, corresponding playbooks display.
    • Concurrent or duplicate remedial actions on the same CI or CI type are blocked by default during an ongoing action, but this can be changed in configuration.

    Practical Benefits for ServiceNow Customers

    This functionality empowers you to:

    • Quickly identify and remediate CI-related issues directly within incident workflows.
    • Leverage guided playbooks to ensure consistency and control in remediation steps.
    • Manage remediation status with clear visibility into current and past actions.
    • Integrate change management processes where necessary (especially for servers), ensuring compliance and auditability.

    Overall, using remedial actions with playbooks in the Investigate tab streamlines resolving operational issues on devices and servers, improving incident resolution efficiency in Service Operations Workspace.

    Resolve the CI-related issues using the remedial actions using Playbook in the Investigate tab.

    The Investigate tab includes the following types of remedial action to resolve CI-related issues:
    • End process
    • Restart service
    These remedial actions are available on the Investigate tab only if the following conditions are met:
    Remedial actions use playbooks to resolve CI issues. Playbook provides you with an interactive UI to guide and execute the remedial actions step by step. With a playbook, you can control every execution step of the remediation process. Playbook is available on the contextual side panel of the Incident record page. When any remedial action is performed, that remediation process is added to a playbook. You can then select the playbook (Playbook icon) icon on the contextual side panel to open the playbook on a separate panel and execute the process. The playbook panel displays the following tabs:
    • Current: Displays the current list of playbooks that trigger the remedial action, including both processes and services run on the affected CIs or caller CIs with status New and In Progress.
    • History: Displays the historical list of playbooks, remedial actions including both processes and services run on the affected CIs or caller CIs with status Completed, Canceled, or Failed.
    You can perform remedial actions on both the affected CIs and the caller CIs associated with the incident record. The caller CIs are the CIs that are assigned to the caller.
    Note:
    If the CI is DEX supported, the remedial actions playbook for the DEX actions are displayed. If the CI is SOW or default view supported, the remedial actions playbook for SOW actions are displayed.
    You can cancel an ongoing End process or Restart service remedial action playbook. To cancel a remedial action playbook, select the remedial action playbook and select the menu (Menu icon) icon and then select Cancel action option. After the remedial action playbook is canceled, the corresponding action is also canceled. Then, the status of the remedial action is displayed as Canceled in the History tab of the playbook panel. To view the reason for cancellation, select the View reason option on the playbook. This option isn’t available if any of the following are true:
    • The remedial action is already in Canceled status.
    • The corresponding CI action record of the remedial action is already in progress.
    • The change request has already moved to implement state for actions associated to CIs of type server.

    The Remedial actions section on the Investigate tab also contains the Current and History tab to display the list of remedial actions performed. By default, this section displays the list of remedial actions for the primary CI or current CI. You can switch the Show actions performed on all CIs in this incident toggle to display the list of remedial actions for all the CIs associated with the Incident.

    Playbook is available only if both the Remedial Action Framework [com.snc.sn_reacf] application and the Investigation Framework [sn_invest_fwk] application are installed and configured, as well as if the remedial actions are triggered.

    Note:
    You can't execute concurrent or duplicate remedial actions when a remedial action is in progress on a process or service for a CI type device or server. You also can't execute concurrent or duplicate remedial actions on the same CI until the previous remedial action execution is completed. You can change this behavior and allow concurrent execution of the remedial action by selecting the Allow concurrent execution option for Remedial Action Type. For more information, see Configure the Remedial Actions Framework.

    End process

    The End process remedial action is available with the following metric information cards:
    • Top processes By Memory
    • Top processes By CPU
    Select the CI and then select End process to stop the process running on the CI. The remediation process then is added to the playbook. Select the Playbook (Playbook icon) icon from the contextual side panel to open the playbook on a separate panel and execute the process. You can execute the End process remedial action for the following CI classes:
    • Device: For this CI class, a two-step process is executed where you must get the user approval before the End process remediation process can be executed. After it’s approved, you can directly stop the process on the device, which is also known as the endpoint.
    • Server: For this CI class, you must create a change request before the End process remedial action can be executed using a standard change request. You must also provide additional information to create a change request.

    Restart service

    The Restart service remedial action is available with the Services metric information card.

    Select the CI and then select Restart service to restart the services running on the CI. The remediation process then is added to the playbook. Select the Playbook (Playbook icon) icon on the contextual side panel to open the playbook on a separate panel and execute the process. You can execute the Restart service remedial action for the following CI classes:
    • Device: For this CI class, a two-step process is executed where you must get the user approval before the Restart service remediation process is executed. After it's approved, you can directly restart the services on the device, which is also known as the endpoint.
    • Server: For this CI class, you must create a change request before you can execute the remedial action using a standard change request. You must also provide additional information to create a change request.