IT & Security package
ServiceNow posts a new or escalated incident; the criteria table flags major incident candidates and the incident manager declares major or not.
Connects to ServiceNow
About this package
ServiceNow major incident review turns "is this a major incident?" into a fast, recorded decision. A business rule or Flow Designer action on the incident table posts the incident sys_id to the workflow when a P1 or P2 is raised or escalated.
The workflow reads the incident from the Table API with display values (number, short description, priority, impact, urgency, assignment group and CI), looks the CI up in the Business services table for its tier and stakeholder list, and runs the Major incident criteria decision table: candidate or not, proposed severity, communication cadence and whether a bridge is needed.
For candidates the incident manager gets a 30-minute review task with Declare major incident and Not a major incident buttons, the proposed severity and cadence filled in. The decision is written back to the incident as a work note with its major incident state, and a declared major incident emails the service's stakeholders with the impact, the incident manager and the next update time.
Starts from ServiceNow: an async business rule (or Flow Designer REST step) on incident insert / priority change posts {"sys_id": current.sys_id} to the workflow webhook.
Another system starts it over REST or an inbound webhook. No UI is needed; people only appear where a decision needs a human.
The flow
Incident posted
A ServiceNow business rule posts the incident sys_id when a high-priority incident is raised or escalated.
Read the incident
GET /table/incident/{sys_id} returns number, description, priority, impact, urgency, assignment group and CI with display values.
Apply the criteria
The CI's tier comes from Business services; the Major incident criteria decide candidate, severity, comms cadence and bridge.
Incident manager decides
A 30-minute task with Declare major incident / Not a major incident buttons, severity, cadence, impact and bridge link.
Write back and tell people
PATCH /table/incident/{sys_id} adds a work note and the major incident state; declared incidents email the stakeholder list.
Forms
The inputs a caller passes when it starts a run, and the forms people complete when the process needs a decision.
Start inputs
Passed by the calling system
User Task
Major incident review: {{number}} ({{priority_label}}) {{short_description}} · 2-column grid · own header and theme
Headless
Every workflow can be started over REST, MCP or the CLI, whatever its trigger, with the sample input below. Runs start straight away on the published version; replace <workflow id> with the id the install created.
REST
curl -X POST "$USERTASKS_URL/api/v1/workflows/start" \
-H "Authorization: Bearer $USERTASKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"workflow_id":"<workflow id>","variables":{"sys_id":"9d385017c611228701d22104cc95c371","number":"INC0010342","event":"inserted"}}'CLI
usertasks workflows inputs <workflow id> # the start form: keys, types, required
usertasks workflows run <workflow id> --input sys_id=9d385017c611228701d22104cc95c371 --input number=INC0010342 --input event=inserted --waitInbound webhook
usertasks webhooks create <workflow id> # prints the hook slug and secret once
curl -X POST "$USERTASKS_URL/api/webhooks/inbound?hook=<slug>" \
-H "Authorization: Bearer <webhook secret>" -H "Content-Type: application/json" \
-d '{"sys_id":"9d385017c611228701d22104cc95c371","number":"INC0010342","event":"inserted"}'What's included
| Type | Name | Details |
|---|---|---|
| Email template | Major incident declared | Sent to the service's stakeholder list when the incident manager declares a major incident. |
| Data table | Business services | Business services / CIs with their service tier and who to tell when one has a major incident. The workflow looks the incident's CI up here by name. |
| Integration | ServiceNow | ServiceNow Table API (/api/now). Use an OAuth bearer token (or switch to Basic auth) for an integration user with itil and the major incident roles. |
| API reference | Get incident | GET /table/incident/{{sys_id}} — Read one incident from the Table API with display values (GET /table/incident/{sys_id}?sysparm_display_value=all): number, description, priority, impact, urgency, assignment group and CI. |
| API reference | Update incident | PATCH /table/incident/{{sys_id}} — Write the review decision back to the incident (PATCH /table/incident/{sys_id}): a work note and the major incident state (proposed / accepted / rejected, Major Incident Management plugin). |
| Decision table | Major incident criteria | 5 rules — Whether an incident is a major incident candidate, its severity and the stakeholder communication cadence, from ServiceNow priority / impact / urgency and the service tier. First matching rule wins. |
| Workflow | ServiceNow major incident review | 15 steps — A ServiceNow business rule or flow posts an incident sys_id; the incident is read from the Table API, checked against the major incident criteria and, for candidates, the incident manager declares it major or not. The decision is written back as a work note and stakeholders are emailed. |
Business services · 5 sample rows
CI / serviceService tierService ownerStakeholder listStatus page componentCustomer facing
Requirements
Credentials never travel in a package. The install wizard asks for what your environment must provide, or installs it incomplete until you finish setup.
Integration “ServiceNow”Required
Workflow “ServiceNow major incident review” assigneesRequired
Install
Works on UserTasks cloud and on any self-hosted instance. Installing creates the assets above; nothing runs until you complete setup and start it.
curl -fLO https://usertasks.com/gallery/servicenow-incident-major-review-1.0.0.utpkg
usertasks packages inspect servicenow-incident-major-review-1.0.0.utpkg # offline: checksum, hashes, signature
usertasks packages install servicenow-incident-major-review-1.0.0.utpkg --dry-run
usertasks packages install servicenow-incident-major-review-1.0.0.utpkg # prompts for each requirement
usertasks packages install servicenow-incident-major-review-1.0.0.utpkg --keep-incomplete --yes # in CI; finish with:
usertasks packages complete servicenow-incident-major-review -f values.yamlVerify the download
shasum -a 256 servicenow-incident-major-review-1.0.0.utpkg should print the file SHA-256. How gallery packages are signed.
Versions
Installing a newer version upgrades in place: local credentials and requirement values are kept, and changes you made are flagged first. How packages work
More packages
IT & Security Official
Monitoring alerts open prioritised ITSM incidents automatically; repeat alerts are deduplicated and P1/P2 incidents page the on-call engineer with escalation.
Needs:REST APIAssigneesInbound webhook
IT & Security Official
SIEM alerts are enriched with IP reputation, user and asset context, then auto-closed, opened as a SOAR case, or contained after analyst approval.
Needs:REST APIAssigneesInbound webhook
IT & Security Official
ServiceNow sends a change for approval; CI criticality and a risk table route it, the CAB approves, rejects or asks for info, and the approval is written back.
Needs:REST APIInbound webhookAssigneesEmail