ITSM — IT Service Management (Zero → Pro)

اقرأ أولاً: ../MASTER_ALL_IN_ONE_SUMMARY.md · ../html/MASTER_ALL_IN_ONE_SUMMARY.html
الدليل الشامل: ../MASTER_ALL_IN_ONE.md · ../html/MASTER_ALL_IN_ONE.html
ممارسة الشاشات: ../html/MASTER_PRACTICE_GUIDE_ALL_TOPICS.html
Australia · Scope x_786686_hr_leave

Australia Instance — نسخة أستراليا

Direct Navigation URLs — روابط التنقل المباشرة

Platform target: ServiceNow Australia (Sep 2026) · next EA: Brazil
URLs: ../../SERVICENOW_DIRECT_URLS_CATALOG.md · 1-week: ../../SERVICENOW_ONE_WEEK_STUDY_DEPLOY_AUSTRALIA.md
HR Leave: Scope x_786686_hr_leave

CIS-ITSM Professional Implementer Guide
الأسلوب: عربية + إنجليزية تكمّلان بعضهما — بدون ترجمة حرفية لأسماء الشاشات.

ملخص ووصف بالعربية (Arabic Summary)

ملخص في سطر: من بلاغ الحادث وطلب الكتالوج حتى SLA والتغيير والمعرفة — دورة ITIL على المنصة.

وصف مختصر: يشرح Incident، Problem، Change، Service Catalog، Knowledge، SOW، Employee Center، قواعد الإسناد، Flow للموافقات، وربط CMDB. مناسب CIS-ITSM والتنفيذ من الصفر.

1) Overview & Business Value

ITSM manages the full lifecycle of IT services for employees. — هو الموديول الأساسي الذي تبدأ منه معظم تطبيقات ServiceNow.

Core processes (ITIL 4 aligned):
- Incident Management — استعادة الخدمة بسرعة بعد عطل.
- Problem Management — معالجة السبب الجذري لمنع التكرار.
- Change Management — تغيير الخدمات بأمان ومخاطر محسوبة.
- Request Management — تلبية الطلبات عبر الكتالوج.
- Service Level Management (SLA) — قياس الالتزام بالأوقات.
- Knowledge Management — توثيق الحلول ونشر المعرفة.

2) Architecture & Data Model

Table hierarchy (المهم للامتحان):

task (base table)
├─ incident
├─ problem
├─ change_request
│ └─ (types: normal / standard / emergency)
├─ sc_request (Request)
│ └─ sc_req_item (RITM)
│ └─ sc_task (Catalog Task)
└─ sla / task_sla (SLA tracking)

Key tables:

كل جداول العمليات ترث من task، لذلك تتشارك الحقول الأساسية (number, state, assigned_to, priority).

3) Plugins & Activation — كيف تفتح وتفعّل

Most ITSM is active by default, but these add features:

How to activate:

1. Navigate: All > System Definition > Plugins — Open direct
2. Search the plugin name.
3. Right-click → Activate/Repair.
4. For Store apps:
   Navigate: All > System Applications > All Available Applications > All — Open direct
   Then Install. — بعد التفعيل افتح Guided Setup لإكمال الإعداد. Navigate: All > Guided Setup > ITSM — Open direct

4) Guided Setup & All Options — كل الخيارات

ITSM Guided Setup sections:

• Company & Branding — الشعار والألوان.
• Email — إعداد البريد (inbound/outbound).
• Users, Groups & Roles — المستخدمون والفرق.
• Assignment — قواعد الإسناد (Assignment Rules).
• Notifications — الإشعارات.
• Incident — حالات، أولوية، SLA.
• Problem / Change / Request — لكلٍّ إعداده.
• Service Catalog — الكتالوج.
• Knowledge — قواعد المعرفة.
• CMDB — ربط عناصر التهيئة.

Important configuration options (افتحها كلها وجرّبها):

5) End-to-End Process Cycle

Incident lifecycle

New → In Progress → On Hold → Resolved → Closed

Major Incident هو حادث حرج يُصعّد ويُدار بفريق خاص.

Problem lifecycle

New → Assess → Root Cause Analysis → Fix in Progress → Resolved → Closed

Change lifecycle (Normal)

New → Assess → Authorize (CAB) → Scheduled → Implement → Review → Closed

Standard Change = معتمد مسبقًا من كتالوج التغيير (لا يحتاج CAB).
Emergency Change = طارئ، موافقة سريعة.

Request lifecycle

Catalog Item → REQ (sc_request) → RITM (sc_req_item) → Catalog Tasks (sc_task) → Closed

6) Development — التطوير

Business Rule example (auto-set priority note)

(function executeRule(current, previous) {
 // before insert/update on incident
 if (current.impact == 1 && current.urgency == 1) {
 current.work_notes = 'Critical P1 — auto-flagged.';
 }
})(current, previous);

Assignment via Script (Assignment Rule alternative)

// route network incidents to Network team
if (current.category == 'network') {
 current.assignment_group.setDisplayValue('Network');
}

Client Script (onChange of category)

function onChange(control, oldValue, newValue, isLoading) {
 if (isLoading || newValue === '') return;
 if (newValue === 'hardware') {
 g_form.setMandatory('cmdb_ci', true);
 }
}

Development topics to master:
- Flow Designer for approvals (Change CAB approval flow).
- SLA Definitions + conditions (start/stop/pause).
- Notifications + events.
- UI Policies vs Data Policies.
- Service Catalog items + variables + variable sets.
- Knowledge workflows (publish/retire).

SLA Definition (concept)

SLA يبدأ بشرط (Start)، يتوقف بشرط (Stop)، وقد يتوقف مؤقتًا (Pause) عند On Hold.

7) Administration — الإدارة

Key admin areas:

Roles to know:
- itil — agent (يعمل على الحوادث/المشكلات).
- itil_admin — مدير ITIL.
- sn_change_write / change_manager — التغيير.
- knowledge / knowledge_admin — المعرفة.

8) Hands-on Labs — تدريب عملي

Lab 1 — Create & resolve an Incident:
1. Navigate: All > Incident > Create New. — Open direct
2. Set Caller, Short description, Impact=2, Urgency=2.
3. Watch Priority auto-calculate (Moderate).
4. Assign to a group, move to In Progress, then Resolved with resolution code.

Lab 2 — Build a Catalog Item + Request flow:
1. Navigate: All > Service Catalog > Catalog Definitions > Maintain Items. — Open direct
2. Create item “Laptop Request” with variables.
3. Order it from Service Portal → observe REQ/RITM/sc_task.

Lab 3 — Normal Change with CAB approval:
1. Create a Normal change.
2. Build/inspect the approval flow.
3. Move through Assess → Authorize → Scheduled → Implement → Closed.

Lab 4 — SLA:
1. Create SLA Definition on incident (Priority 1, 4h resolution).
2. Open a P1 incident, watch the task_sla timer.

Lab 5 — Knowledge:
1. Create a KB article, submit, publish.
2. Link it from an incident (resolution).

9) Best Practices & Common Mistakes

Best practices:
- Use Flow Designer, not legacy Workflow, for new approvals.
- Keep priority via Impact×Urgency matrix (don’t hardcode).
- Use Assignment Rules / Data Lookup instead of long scripts.
- Always relate the CI (cmdb_ci) for reporting and impact.

Common mistakes:
- خلط Standard و Normal change.
- نسيان شرط Stop في الـ SLA فيبقى يعمل.
- كتابة منطق إسناد في Business Rule بدل Assignment Rule.
- تعديل جداول OOTB بدل الإضافة عبر scope.

10) CIS-ITSM Exam Focus

High-yield topics:
- Task table hierarchy & inheritance.
- Incident vs Problem vs Change differences.
- Change types: Normal / Standard / Emergency + when each.
- Request model: REQ → RITM → sc_task.
- SLA: start/stop/pause conditions, retroactive start.
- Priority = Impact × Urgency (matrix/data lookup).
- Notifications: event-driven vs record-driven.
- Roles: itil, itil_admin, approver_user.
- Knowledge lifecycle and KCS basics.

Exam tip: — ركّز على أي جدول وأي حالة وأي دور — أسئلة CIS كثيرًا ما تختبر التسلسل والوراثة.

11) Portals, Workspaces, Role Hierarchy & Feature Catalog

ملاحظة عن الروابط:
URLs الـ Workspaces قد تختلف قليلًا حسب الإصدار والـ App Config.
إن لم يعمل رابط، افتح: All > Now Experience Framework > UI Builder وتحقّق من الـ path. — Open direct

11.1 Service Portals (end-user)

11.2 Workspaces (agents/managers)

SOW هو الأحدث ويجمع Incident/Problem/Change/Request مع CMDB والـ AI في مكان واحد.

11.3 Role Hierarchy (تسلسل الأدوار)

admin
└─ itil_admin
 └─ itil (agent — incident/problem/change/request)
 ├─ sn_change_write / change_manager
 ├─ problem_admin / problem_manager / problem_coordinator
 ├─ knowledge_admin → knowledge_manager → knowledge
 ├─ sn_incident_write
 └─ approver_user (approvals only)
sn_request_read / catalog roles
ess (Employee Self Service — لا يملك itil)

itil يرث صلاحيات العمل على المهام؛ ess للموظف العادي بلا أدوار تشغيلية.

11.4 Full Business Cycle (موحّد ITSM)

Employee (/esc or /sp)
 → Catalog request OR Incident report
 Request → REQ → RITM → sc_task → fulfilled
 Incident → triage (priority = impact×urgency)
 → Agent (SOW) works the task
 ↳ if recurring → Problem (root cause)
 ↳ if change needed → Change (Normal/Std/Emergency → CAB)
 → SLA timers run (task_sla)
 → Resolve → document in Knowledge (KCS)
 → Close → CSAT survey → report/dashboards

11.5 Feature Catalog (كل ما يمكن تنفيذه)

Process features:
- Incident, Major Incident Management.
- Problem (RCA, Known Error, Workarounds).
- Change (Normal/Standard/Emergency, CAB, Change Calendar, Risk Assessment).
- Request (Catalog Items, Order Guides, Record Producers, Variable Sets).
- Service Level Management (SLA/OLA, definitions, schedules).
- Knowledge Management (KCS, versioning, approval publish/retire).
- Continual Improvement Management (CIM).
- Walk-up Experience.
- Vendor Manager Workspace.
- Incident Communications / Notifications.

Platform features used:
- Flow Designer (approvals/automation).
- Assignment Rules / Data Lookup.
- Service Catalog + Variable Sets.
- Surveys & Assessments (CSAT).
- Performance Analytics + Dashboards.
- Now Assist (GenAI: summarization, resolution).
- Virtual Agent (deflection).
- Predictive Intelligence (categorization/assignment).

12) End-to-End Implementation (Post-Activation)

اقرأ هذا بعد تفعيل البلجن.
هذا هو ترتيب التنفيذ الكامل خطوة بخطوة مع كل القوائم والصفحات والجداول.

12.1 Application Menus map (كل القوائم)

All > Incident
 ├─ Create New / Open / Open - Unassigned / Resolved / Closed / All
 ├─ Overview / Assigned to me / Critical Incidents Map
 └─ Major Incidents
All > Problem
 ├─ Create New / Open / Known Errors / All
 └─ Problem Tasks
All > Change
 ├─ Create New / Open / My Approvals / Schedule (Change Calendar)
 ├─ Normal / Standard / Emergency / Change Tasks
 └─ Administration (Models, States, Risk, CAB Definition)
All > Service Catalog
 ├─ Catalogs / Categories / Catalog Items (Maintain Items)
 ├─ Order Guides / Record Producers / Variable Sets
 └─ Catalog Policies / Catalog UI Policies
All > Knowledge
 ├─ Articles / Create New / My Knowledge / Knowledge Bases
 └─ Knowledge Categories / Homepage
All > Service Level Management
 ├─ SLA Definitions / SLA / OLA / Workflow
 └─ Active SLAs (task_sla)
All > Reports / Dashboards / Performance Analytics

12.2 Core tables to know (Tables & Lists)

أي جدول تفتحه بكتابة اسمه التقني متبوعًا بـ .list في شريط التنقّل.

12.3 End-to-end build order (بعد التفعيل)

1. Foundation data:
   - Users/Groups/Roles.
   All > User Administration > Users / Groups / Roles — Open direct
   - Locations, Companies, Departments.
2. CMDB baseline:
   - تأكد من وجود CIs (انظر CMDB.md).
3. Assignment:
   - Assignment Rules أو Data Lookup للإسناد التلقائي.
   All > System Policy > Assignment — Open direct
4. Priority:
   - Priority Lookup Rules (Impact × Urgency).
   All > Incident > … > Priority Lookup Rules / dl_matcher. — Open direct
5. SLA:
   - SLA Definitions + schedules + conditions.
   All > Service Level Management > SLA Definitions. — Open direct
6. Notifications + Events:
   - All > System Notification > Email > Notifications. — Open direct
7. Service Catalog:
   - Catalog → Categories → Items → Variables → Record Producers.
8. Knowledge:
   - Knowledge Base → Categories → Article templates → publish workflow.
9. Change governance:
   - Change Models, Risk Assessment, CAB Definition, Change Calendar.
10. Flows:
    - Flow Designer approvals (Change, Request).
    All > Process Automation > Flow Designer. — Open direct
11. UI/UX:
    - Service Portal /sp, Employee Center /esc.
    - Service Operations Workspace /now/sow/home.
12. Reporting:
    - Reports, Dashboards, PA indicators.
13. Test + Deploy:
    - ATF tests, Update Set, move to test→prod.

12.4 All configuration pages (الصفحات الإدارية)

Study path note: — للدراسة من الصفر اتبع الملف: STUDY_ROADMAP.md

13) Options & Instance Notes — بدائل وميزات قد لا تظهر

Quick activation: Plugins → Store → Guided Setup → Classic *.list

14) Implementation Scenarios, Options, Best Practices & Customizations

Master detail: MODULE_IMPLEMENTATION_PLAYBOOK.md → ITSM

14.1 Implementation scenarios

S2 build order: Users/Roles → CMDB → Assignment → Priority matrix → SLA → Catalog → Change models/CAB → Flows → /esc + SOW → UAT → Update Set.

14.2 Options matrix (consultant choices)

14.3 Plugins — activation checklist

Navigate: Plugins → Guided Setup > ITSM

14.4 Roles, groups & security

Develop: ACL scripts, user_criteria, domain separation (enterprise).

14.5 Common customizations (what to build)

14.6 Best practice decisions

• Standard Change for repetitive low-risk work.
• Always attach CI to incidents.
• SLA stop on Resolved — verify in UAT.
• Document chosen scenario (S1/S2/S3) in workshop sign-off.

14.7 Go-live checklist

• [ ] Plugins + Guided Setup done
• [ ] Assignment + Priority tested
• [ ] SLA timers verified
• [ ] Catalog + KB smoke test
• [ ] SOW/SP roles correct
• [ ] Update Set committed to test

15) Zero-to-Hero End-to-End Implementation (Scratch → Go-Live)

Framework: MODULE_ZERO_TO_HERO_CONSULTING.md

من ورشة اكتشاف حتى Service Desk + Catalog + Change يعمل على Production.

15.1 Business goals

15.2 Phase 0 — Discover (Week 1)

• Map as-is: phone/email vs portal, change process, SLAs.
• Define tiers (L1/L2/L3), catalog scope, CAB members.
• Deliverable: ITSM charter + process diagrams.

15.3 Phase 1 — Activate (Week 2)

15.4 Phase 2 — Foundation (Week 2–3)

Users, groups, roles (itil, change_manager), companies, locations, CMDB sample CIs (CMDB.md).

15.5 Phase 3 — Core processes (Week 3–8)

15.6 Phase 4 — Channels (Week 8–10)

Employee Center /esc, Service Operations Workspace, email inbound actions.

15.7 Phase 5 — UAT (Week 10–11)

15.8 Phase 6 — Go-live (Week 12)

Hypercare, war room, daily backlog review.

15.9 Phase 7 — Operate

PA: MTTR, SLA breach %, catalog adoption, change success rate.

15.10 Master checklist

• [ ] Phases 0–6 complete · [ ] CMDB linked · [ ] Training done · [ ] Prod deploy

16) Full E2E Practice · Pages · Requirements · Options (AR + EN)

Extended reference: MODULE_FULL_E2E_PRACTICE.md · Consulting framework: MODULE_ZERO_TO_HERO_CONSULTING.md

هذا القسم يكمّل §15 بـ متطلبات الأعمال، كل الصفحات، كل الخيارات، دورة الاستشارة الكاملة، ومختبر PDI خطوة بخطوة.

16.1 Business goals & success criteria

Why the client buys ITSM (consultant pitch):
One platform for employees to request services, agents to resolve, and managers to see SLA and change risk. — منصة واحدة للموظف (طلب/بلاغ)، للفريق (حل وتصعيد)، وللإدارة (SLA ومخاطر التغيير).

16.2 Functional & non-functional requirements

16.3 Full consultation cycle & deliverables

Consultation questions (bilingual):

• How do users report issues today? (phone, email, walk-up)
  كيف يبلّغ الموظفون عن المشاكل اليوم؟
• What are your P1/P2 definitions and who gets notified?
  ما تعريف P1/P2 ومن يُنبَّه؟
• Which changes need CAB vs pre-approved standard?
  أي تغييرات تحتاج CAB وأيها Standard؟
• What catalog items are wave-1 must-have?
  ما عناصر الكتالوج الإلزامية للموجة الأولى؟

16.4 All implementation options (A / B / C)

Instance note: menus differ if plugins missing — see MODULE_OPTIONS_AND_INSTANCE_NOTES.md → ITSM.

16.5 All pages, menus & workspaces (Navigate)

16.6 Full PDI practice lab (end-to-end — do not skip steps)

Lab goal: Incident + SLA + Catalog + Change + KB + security check.
Time: ~3–4 hours · Roles needed: admin, itil, ess (impersonation)

UAT scripts (sign-off):

16.7 Related pages by process (quick map)

Incident lifecycle pages:
 Create → incident.do · Work → SOW or incident form · SLA → task_sla.list
 Resolve → Close codes · Major → Major Incident workspace

Request lifecycle:
Order → /sp?id=sc_cat_item · REQ → sc_request.list · RITM → sc_req_item.list
Tasks → sc_task.list · Flow → Flow Designer execution

Change lifecycle:
Model → chg_model · Request → change_request · Tasks → change_task
Calendar → change_request (Schedule) · CAB → Flow approval task

16.8 Sign-off checklist (consulting)

• [ ] Requirements FR-01–FR-08 demonstrated in UAT
• [ ] Options document records A/B/C choices per area (§16.4)
• [ ] All §16.5 pages visited once by implementer
• [ ] RACI signed for incident owner, change manager, catalog admin
• [ ] Training completed for agents + end-user quick guide (AR+EN)
• [ ] Hypercare runbook includes Navigate paths for war room

§17 — Power User Playbook (ITSM)

Day-in-the-life recipes, role workflows, and 20 production-grade scripts.
ملف عملي مكثّف لكل دور — موظف، وكيل، مدير حادث/تغيير/مشكلة، مؤلف معرفة.

17.1 Personas — what each role does in a day

لكل دور قائمة طاولة عمل خاصة. الدور الأكثر استعمالاً هو itil لوكلاء المكتب، وess لكل الموظفين تلقائيًا.

⚠️ لا تعطِ دور admin لوكلاء الإنتاج — استخدم أدوار ITSM المحددة.

17.2 End-user (Employee) — day in the life

Step-by-step on /esc (Employee Center):

Approval inbox (mobile/desktop):

/esc → My Approvals → click record → Comment → Approve | Reject
On mobile: Now Mobile app → Approvals tab → swipe right (approve) / left (reject)

⚠️ Employee never sees Change / Problem unless granted; that’s ess security working.

17.3 Tier 1 Agent recipes — first 15 minutes of an incident

Recipe A — Triage incoming incident (SOW)

Navigate: /now/sow/home → Lists → My Group's Work → New incident
1) Read short_description + caller VIP flag
2) Set Category (or accept Predictive Intelligence suggestion)
3) Confirm CI via "Find CI by short description" (§17.10.14)
4) Set Impact + Urgency → Priority computed via matrix
5) Reassign to right group if not your queue
6) Add work note: "Initial triage complete"

Recipe B — Use Now Assist Summarize Incident

// Pre-req: Now Assist for ITSM licensed + enabled
// On the incident form, click the "Summarize" button in the UI
// It calls the Generative AI controller and returns a single-paragraph synopsis
// To trigger programmatically (e.g. from a Flow):
var gr = new GlideRecord('incident');
gr.get('<sys_id>');
var summary = new sn_nowassist.NowAssistInline().summarize(gr);
gs.info('Summary: ' + summary);

Recipe C — Search KB and link the article

1) On the incident, side panel → Knowledge → "Suggest articles"
2) Predictive Intelligence ranks top 3 by short_description
3) Click "Attach" on the relevant article
4) The kb_use record is logged → analytics later
5) Add work note: "Sent KB0010234 to user; awaiting confirmation"

Recipe D — Resolve & set close code

State → Resolved
Close code → "Solved (Permanently)" | "Solved (Workaround)" | "User Education" | "Not reproducible"
Resolution notes → mandatory; auto-populated from Now Assist if licensed
Save → SLA stops, survey triggers (§17.10.19)

Recipe E — Escalate to Tier 2

Assignment group → <Tier 2 group>
State → In Progress (do NOT mark Pending)
Work note (private) → reason for escalation, what you tried, links to KB
Notify Assignee → checkbox

⚠️ Never use “On Hold” to dump on another team — that pauses SLA and hides the work.

17.4 Tier 2 Specialist recipes

Recipe A — Pick up & investigate

1) Filter incident list: Assignment Group is <my group> AND State != Resolved
2) Open oldest by priority, then by Opened
3) Run diagnostics referencing CI relationships (CMDB.md §17.3)
4) If pattern across multiple incidents → create Problem (Recipe B)

Recipe B — Create related Problem from one or many incidents

// Script Action on incident — "Create Problem from this incident"
(function createProblemFromIncidents(currentIncident) {
 var prb = new GlideRecord('problem');
 prb.initialize();
 prb.short_description = 'Pattern: ' + currentIncident.short_description;
 prb.description = 'Created from ' + currentIncident.number + '\n' + currentIncident.description;
 prb.cmdb_ci = currentIncident.cmdb_ci;
 prb.priority = currentIncident.priority;
 prb.assignment_group = currentIncident.assignment_group;
 prb.assigned_to = gs.getUserID();
 var prbId = prb.insert();

// Link the incident
currentIncident.problem_id = prbId;
currentIncident.update();

gs.addInfoMessage(‘Created Problem ’ + prb.number);
return prbId;
})(current);

Recipe C — Link multiple related incidents to one Problem

// Background script — link last 5 password-reset incidents to a Problem
var problemId = '<problem_sys_id>';
var inc = new GlideRecord('incident');
inc.addQuery('short_description', 'CONTAINS', 'password reset');
inc.addQuery('state', '!=', 6); // not resolved
inc.orderByDesc('opened_at');
inc.setLimit(5);
inc.query();
while (inc.next()) {
 inc.problem_id = problemId;
 inc.update();
}
gs.info('Linked ' + inc.getRowCount() + ' incidents');

Recipe D — RCA template (paste into Problem description)

1. Symptoms : ...
2. Affected CIs : ...
3. First detected : <timestamp> by <source>
4. Investigation :
 - Hypothesis 1 — Result
 - Hypothesis 2 — Result
5. Root cause : ...
6. Workaround : ...
7. Permanent fix : <change_request number, if any>
8. Prevention : KB article, monitor, automation

نموذج RCA لا يتغيّر بين الحالات — استخدمه دائمًا لتضمن جودة موحدة.

17.5 Major Incident Manager — playbook

Declare a Major Incident:

1) On incident → Priority = 1 (Critical) → fill business impact
2) Click "Promote to Major Incident" (form button)
3) Choose MI Type (Candidate / Confirmed)
4) Notifications fire to MI distribution list (sys_user_group "Major Incident Comms")
5) MI Workspace opens → war-room timeline

During the war-room:

- Pin the MI tab → /now/major_incident/<sys_id>
- Run "Communications" workflow → Sends to status page + Teams + email
- Capture timeline entries every 15 min (auto-prompt)
- Link related incidents (mass-link via §17.10.3)
- Assign comms lead, technical lead, exec liaison

Status page comms snippet (post to public page via REST):

var r = new sn_ws.RESTMessageV2();
r.setEndpoint('https://api.statuspage.io/v1/pages/<pageId>/incidents');
r.setHttpMethod('POST');
r.setRequestHeader('Authorization', 'OAuth ' + gs.getProperty('statuspage.token'));
r.setRequestHeader('Content-Type', 'application/json');
r.setRequestBody(JSON.stringify({
 incident: {
 name: current.short_description.toString(),
 status: 'investigating',
 impact_override: 'critical',
 body: 'We are investigating an issue affecting ' + current.cmdb_ci.name
 }
}));
var resp = r.execute();
gs.info('Status page: ' + resp.getStatusCode());

Post-mortem (after MI close):

Within 5 business days:
1) Use Problem template (§17.4 Recipe D)
2) Hold blameless retro — record attendees in problem.work_notes
3) Action items become change_request OR problem_task
4) Publish KB article (Known Error) — link from problem.kb_knowledge

⚠️ Major Incident does NOT skip Change for the fix — emergency change still needs CAB chair approval.

17.6 Change Manager — full week loop

Monday — CAB calendar review:

Navigate: All > Change > Schedule
View: Week
Filter: State IN (Assess, Authorize, Scheduled) AND Type IN (Normal, Emergency)
Action: Open each → check Risk + Conflict

Tuesday — risk assessment script (auto-rate risk on insert):

// Business Rule: before insert on change_request — set risk score
(function riskScore() {
 var score = 0;
 if (current.type == 'emergency') score += 30;
 if (current.cmdb_ci && current.cmdb_ci.business_criticality == '1') score += 20;
 if (gs.daysBetween(current.start_date, current.end_date) > 1) score += 10;
 var hasBackout = current.backout_plan && current.backout_plan.length > 50;
 if (!hasBackout) score += 25;
 var hasTestPlan = current.test_plan && current.test_plan.length > 50;
 if (!hasTestPlan) score += 15;

current.risk = score >= 70 ? ‘high’ : (score >= 40 ? ‘moderate’ : ‘low’);
current.risk_value = score;
})();

Wednesday — conflict detection (via change_conflict):

// Script Action — find conflicts before CAB
(function findChangeConflict(chg) {
 var conf = new GlideRecord('change_request');
 conf.addQuery('cmdb_ci', chg.cmdb_ci);
 conf.addQuery('sys_id', '!=', chg.sys_id);
 conf.addQuery('start_date', '<=', chg.end_date);
 conf.addQuery('end_date', '>=', chg.start_date);
 conf.addQuery('state', 'IN', '-2,-3,-4'); // Assess, Authorize, Scheduled
 conf.query();
 var conflicts = [];
 while (conf.next()) {
 conflicts.push(conf.number + ' on ' + conf.cmdb_ci.name);
 // Create change_conflict record
 var c = new GlideRecord('change_conflict');
 c.initialize();
 c.change = chg.sys_id;
 c.conflicting_change = conf.sys_id;
 c.reason = 'Overlapping window on same CI';
 c.insert();
 }
 if (conflicts.length) {
 chg.work_notes = 'CONFLICTS DETECTED: ' + conflicts.join(', ');
 chg.update();
 }
})(current);

Thursday — freeze window enforcement:

// Business Rule before_insert/update on change_request
(function blockInFreeze() {
 var freeze = new GlideRecord('change_freeze_window');
 freeze.addActiveQuery();
 freeze.addQuery('start_date', '<=', current.start_date);
 freeze.addQuery('end_date', '>=', current.start_date);
 freeze.query();
 if (freeze.next() && current.type != 'emergency') {
 gs.addErrorMessage('Change blocked: inside freeze window "' + freeze.name + '". Only emergency changes allowed.');
 current.setAbortAction(true);
 }
})();

Friday — post-implementation review (PIR):

After end_date passes:
1) Change → "Review" state
2) Fill close_code (Successful / Successful with issues / Unsuccessful)
3) Capture actual_start / actual_end
4) Link any incident created within 48h of change (regression detection)
5) Sign-off via approver → state Closed

أتمتة CAB توفر ساعات أسبوعية لمدير التغيير — لا تترك أي شيء يدوي.

17.7 Knowledge Author recipes

KB workflow (Flow Designer) auto-archive after 365 days no use:

// Scheduled job — Monthly KB hygiene
var kb = new GlideRecord('kb_knowledge');
kb.addQuery('workflow_state', 'published');
kb.addQuery('sys_view_count', '<', 5);
kb.addQuery('sys_updated_on', '<', gs.daysAgo(365));
kb.query();
while (kb.next()) {
 kb.workflow_state = 'retired';
 kb.retired = gs.nowDateTime();
 kb.work_notes = 'Auto-retired: 365 days inactive, <5 views';
 kb.update();
}
gs.info('Retired ' + kb.getRowCount() + ' stale KB articles');

⚠️ Retire, don’t delete — articles may be cited from old incidents.

17.8 Process Owner (Continual Service Improvement)

دور Process Owner هو ضامن استمرار التحسين بعد Go-Live — بدونه يموت ITSM ببطء.

17.9 Quick-fire navigation cheatsheet

incident.list → all incidents (URL)
incident.do?sys_id=-1 → new incident form
sn_si_incident.list → security incidents (SecOps)
problem.list → problem records
change_request.list → all changes
change_request_calendar.do → CAB calendar
sc_req_item.list → request items (RITM)
kb_knowledge.list → all KB articles
contract_sla.list → SLA definitions
task_sla.list → live SLAs on tasks
/now/sow/home → Service Operations Workspace
/now/major_incident → Major Incident Workspace
/esc → Employee Center
/sp → Service Portal
/now/cwf/agent → Configurable Workspace agent home

17.10 Top 20 ITSM scripts — copy/paste ready

All scripts assume scope global unless stated. Adjust group/category sys_ids before running.
⚠️ Always test in dev first. Add try/catch where you’ll schedule daily.

1) Auto-assign by CI assignment group

// Business Rule — before insert/update on incident
// When: current.cmdb_ci changes
(function autoAssignByCI() {
 if (!current.cmdb_ci) return;
 var ci = new GlideRecord('cmdb_ci');
 if (ci.get(current.cmdb_ci) && !ci.support_group.nil()) {
 if (current.assignment_group.nil()) {
 current.assignment_group = ci.support_group;
 current.work_notes = 'Auto-assigned via CI support group: ' + ci.support_group.getDisplayValue();
 }
 }
})();

2) Auto-close resolved incident after 5 days

// Scheduled Job — daily 02:00
var gr = new GlideRecord('incident');
gr.addQuery('state', 6); // Resolved
gr.addQuery('resolved_at', '<', gs.daysAgo(5));
gr.query();
while (gr.next()) {
 gr.state = 7; // Closed
 gr.close_code = gr.close_code || 'Solved (Permanently)';
 gr.work_notes = 'Auto-closed after 5 days in Resolved.';
 gr.update();
}
gs.info('Auto-closed ' + gr.getRowCount() + ' incidents');

3) Major Incident detector — 5+ related incidents in 30 min

// Scheduled Job — every 5 min
var ga = new GlideAggregate('incident');
ga.addQuery('opened_at', '>', gs.minutesAgo(30));
ga.addQuery('state', '!=', 7);
ga.addAggregate('COUNT', 'cmdb_ci');
ga.groupBy('cmdb_ci');
ga.addHaving('COUNT', '>=', 5);
ga.query();
while (ga.next()) {
 var ciId = ga.cmdb_ci.toString();
 if (!ciId) continue;
 var alreadyMI = new GlideRecord('incident');
 alreadyMI.addQuery('cmdb_ci', ciId);
 alreadyMI.addQuery('major_incident_state', '!=', '');
 alreadyMI.addQuery('opened_at', '>', gs.hoursAgo(2));
 alreadyMI.query();
 if (alreadyMI.hasNext()) continue;

var seed = new GlideRecord(‘incident’);
seed.addQuery(‘cmdb_ci’, ciId);
seed.orderBy(‘opened_at’);
seed.setLimit(1);
seed.query();
if (seed.next()) {
seed.major_incident_state = ‘proposed’;
seed.update();
gs.eventQueue(‘major.incident.candidate’, seed, ga.getAggregate(‘COUNT’, ‘cmdb_ci’), ciId);
}
}

4) Reopen blocker if user replies via email

// Inbound Action — on incoming email matching incident
(function reopenIfUserReplied(email, current) {
 if (current.state == 6 || current.state == 7) {
 if (gs.daysBetween(current.resolved_at, gs.nowDateTime()) < 7) {
 current.state = 2; // In Progress
 current.reopen_count = (parseInt(current.reopen_count) || 0) + 1;
 current.comments = 'Reopened via email reply:\n\n' + email.body_text;
 current.work_notes = 'Auto-reopened: user replied within 7 days of resolution.';
 current.update();
 } else {
 // Too old — create new incident, link
 var clone = new GlideRecord('incident');
 clone.initialize();
 clone.short_description = '[Re-open requested] ' + current.short_description;
 clone.description = email.body_text;
 clone.parent_incident = current.sys_id;
 clone.caller_id = current.caller_id;
 clone.insert();
 }
 }
})(email, current);

5) CAB auto-bypass for Standard changes

// Business Rule — before insert on change_request
(function autoApproveStandard() {
 if (current.type == 'standard') {
 current.state = -1; // Implement (skip Assess + Authorize)
 current.approval = 'approved';
 current.work_notes = 'Auto-approved: Standard change from pre-approved template ' +
 current.std_change_producer_version.getDisplayValue();
 }
})();

6) CI relationship traverser — blast radius

// Script Include or Background script — find downstream CIs
function findBlastRadius(rootCiSysId, maxDepth) {
 var visited = {};
 var queue = [{id: rootCiSysId, depth: 0}];
 var result = [];
 while (queue.length) {
 var node = queue.shift();
 if (visited[node.id] || node.depth > (maxDepth || 5)) continue;
 visited[node.id] = true;
 result.push(node.id);
 var rel = new GlideRecord('cmdb_rel_ci');
 rel.addQuery('parent', node.id);
 rel.query();
 while (rel.next()) {
 queue.push({id: rel.child.toString(), depth: node.depth + 1});
 }
 }
 return result;
}
// Usage:
var blast = findBlastRadius('<ci_sys_id>', 4);
gs.info('Blast radius: ' + blast.length + ' downstream CIs');

7) SLA pause when assigned to vendor

// Business Rule — after update on incident
(function pauseSlaForVendor() {
 if (current.assignment_group.getDisplayValue().toString().indexOf('Vendor') < 0) return;
 var sla = new GlideRecord('task_sla');
 sla.addQuery('task', current.sys_id);
 sla.addQuery('active', true);
 sla.addQuery('stage', '!=', 'paused');
 sla.query();
 while (sla.next()) {
 sla.stage = 'paused';
 sla.update();
 }
 current.work_notes = 'SLA paused (vendor handling).';
})();

8) KB article suggestion via AI Search

// On incident form — UI Action "Suggest KB"
var aisRoute = '/api/sn_ais/search';
var payload = {
 indexes: ['kb_knowledge'],
 query: g_form.getValue('short_description'),
 size: 3
};
var ga = new GlideAjax('AISearchAjax');
ga.addParam('sysparm_name', 'search');
ga.addParam('sysparm_payload', JSON.stringify(payload));
ga.getXMLAnswer(function(answer) {
 var hits = JSON.parse(answer);
 var html = hits.map(function(h) { return '<li><a href="kb_view.do?sys_id=' + h.id + '">' + h.title + '</a></li>'; }).join('');
 g_form.showFieldMsg('short_description', '<ul>' + html + '</ul>', 'info', true);
});

9) Bulk update stale incidents (>30d)

// Background script — close stale "Pending" incidents
var stale = new GlideRecord('incident');
stale.addQuery('state', 3); // On Hold / Pending
stale.addQuery('sys_updated_on', '<', gs.daysAgo(30));
stale.query();
while (stale.next()) {
 stale.state = 6;
 stale.close_code = 'Closed/Resolved by Caller';
 stale.close_notes = 'Auto-closed: no activity 30 days. Reopen if needed.';
 stale.update();
}
gs.info('Stale closed: ' + stale.getRowCount());

10) Change conflict detector — see §17.6 Wednesday script.

11) Outage announcement creator

// Script Action — when CI marked operational_status = "Non Operational"
(function createOutage(ci) {
 var out = new GlideRecord('cmdb_ci_outage');
 out.initialize();
 out.cmdb_ci = ci.sys_id;
 out.type = 'outage';
 out.begin = gs.nowDateTime();
 out.short_description = 'Outage on ' + ci.name;
 out.message = 'Service ' + ci.name + ' is currently impacted. Engineering is engaged.';
 var outId = out.insert();

// Public announcement
var ann = new GlideRecord(‘announcement’);
ann.initialize();
ann.title = ‘Service degraded: ’ + ci.name;
ann.message = out.message;
ann.style = ‘critical’;
ann.active = true;
ann.insert();
return outId;
})(current);

12) Top contributor leaderboard (weekly)

// Scheduled Job — weekly Mon 08:00
var ga = new GlideAggregate('incident');
ga.addQuery('resolved_at', '>=', gs.daysAgo(7));
ga.addAggregate('COUNT');
ga.groupBy('resolved_by');
ga.orderByAggregate('COUNT', 'desc');
ga.setLimit(5);
ga.query();
var board = [];
while (ga.next()) {
 board.push({
 agent: ga.resolved_by.getDisplayValue(),
 resolved: ga.getAggregate('COUNT')
 });
}
gs.eventQueue('itsm.leaderboard.weekly', null, JSON.stringify(board), '');

13) Trigger Now Assist resolution notes

// UI Action on incident — "Generate resolution notes"
(function {
 if (!current.work_notes) {
 gs.addErrorMessage('Add work notes first — model needs context.');
 return;
 }
 var na = new sn_nowassist.NowAssistInline();
 var notes = na.generateResolutionNotes(current);
 current.close_notes = notes;
 current.update();
 gs.addInfoMessage('Resolution notes generated.');
})();

14) Auto-link CMDB CI by short description

// Business Rule — before insert on incident
(function linkCiBySD() {
 if (!current.cmdb_ci.nil()) return;
 var sd = (current.short_description || '').toString().toLowerCase();
 var ci = new GlideRecord('cmdb_ci');
 ci.addQuery('operational_status', '1');
 ci.addEncodedQuery('nameLIKE' + sd.split(' ')[0]);
 ci.setLimit(1);
 ci.query();
 if (ci.next()) {
 current.cmdb_ci = ci.sys_id;
 current.work_notes = 'CI auto-linked via short_description: ' + ci.name;
 }
})();

15) Detect duplicate incident by similarity

// Business Rule — after insert on incident
(function flagDuplicates() {
 var dup = new GlideRecord('incident');
 dup.addQuery('caller_id', current.caller_id);
 dup.addQuery('cmdb_ci', current.cmdb_ci);
 dup.addQuery('opened_at', '>', gs.hoursAgo(2));
 dup.addQuery('sys_id', '!=', current.sys_id);
 dup.addQuery('state', '!=', 7);
 dup.query();
 if (dup.next()) {
 current.parent_incident = dup.sys_id;
 current.work_notes = 'Possible duplicate of ' + dup.number;
 current.update();
 }
})();

16) Auto-tag VIPs

// Business Rule — before insert on incident
(function tagVip() {
 var u = new GlideRecord('sys_user');
 if (u.get(current.caller_id) && (u.vip == true || u.vip == 'true')) {
 current.priority = 1;
 current.impact = 1;
 current.urgency = 1;
 current.assignment_group = gs.getProperty('itsm.vip.group');
 current.work_notes = 'VIP caller — priority elevated, routed to VIP queue.';
 }
})();

17) Mass-notify users on outage CI

// Script Action — outage_create event
(function notifyAffectedUsers(ci) {
 // Find users with incidents on this CI in past 7d
 var inc = new GlideRecord('incident');
 inc.addQuery('cmdb_ci', ci.sys_id);
 inc.addQuery('opened_at', '>', gs.daysAgo(7));
 inc.query();
 var users = {};
 while (inc.next()) users[inc.caller_id.toString()] = true;

Object.keys(users).forEach(function(userId) {
gs.eventQueue(‘outage.notify.user’, null, userId, ci.sys_id);
});
})(current);

18) P1 escalation timer

// Scheduled Job — every 5 minutes
var p1 = new GlideRecord('incident');
p1.addQuery('priority', 1);
p1.addQuery('state', 'IN', '1,2'); // New, In Progress
p1.addQuery('opened_at', '<', gs.minutesAgo(30));
p1.addQuery('escalation', 0);
p1.query();
while (p1.next()) {
 p1.escalation = 1;
 p1.work_notes = 'Auto-escalated: P1 unresolved 30 minutes.';
 p1.update();
 gs.eventQueue('itsm.p1.escalate', p1, p1.assignment_group.toString(), '');
}

19) Survey trigger on close

// Business Rule — after update on incident, state changed to 7
(function triggerSurvey() {
 if (current.state != 7 || previous.state == 7) return;
 if (current.contact_type == 'self-service' || current.opened_by == current.caller_id) {
 gs.eventQueue('asmt.send.survey', current, 'incident_satisfaction', current.caller_id.toString());
 }
})();

20) Major incident dashboard refresher

// Scheduled Job — every 10 minutes
var ind = new GlideRecord('pa_indicators');
ind.addQuery('name', 'CONTAINS', 'Major Incident');
ind.query();
while (ind.next()) {
 var dc = new sn_pa.PADataCollector();
 dc.collectIndicator(ind.sys_id.toString());
}
gs.info('Refreshed ' + ind.getRowCount() + ' MI indicators');

17.11 Power-user keyboard shortcuts

اختصارات Forms مفيدة جدًا للوكلاء — اطبعها وعلقها بجانب الشاشة.

§18 — From-Scratch Implementation (Day 0 → Day 30)

A 30-day pragmatic ITSM rollout. Each day is independently sign-off-able.
خطة بناء ITSM من الصفر في 30 يومًا — كل يوم له مخرجات وتسليم.

18.1 Day 0 — Prep (the week before)

ITIL maturity self-assessment (score each 1–5):

Stakeholder map (RACI):

Vendor map:

Success criteria (must agree before Day 1):

- All P1/P2 incidents created in ServiceNow within 5 minutes of detection
- 100% of changes recorded; no rogue prod changes
- KB deflection target: 20% by month 3
- SLA breach rate < 5% by month 6
- CSAT >= 4.0 / 5.0
- Update Set "ITSM_Baseline_v1" exported and version-controlled

لا تنتقل ليوم 1 قبل الحصول على توقيع الراعي على معايير النجاح.

18.2 Day 1 — Activate plugins & confirm CMDB

Navigate: All > System Definition > Plugins
Activate (with demo data DISABLED for prod):
- com.snc.incident (Incident Management)
- com.snc.problem (Problem Management)
- com.snc.change_request (Change Management)
- com.snc.knowledge (Knowledge Management)
- com.snc.service_catalog (Service Catalog)
- com.snc.service_portal (Service Portal)
- com.snc.service_portal.employee_center (Employee Center)
- com.snc.sla (Service Level Management)
- com.snc.major_incident_mgmt (Major Incident)

Confirm CMDB present — see CMDB.md Day 1. — بدون CMDB لن يعمل تحليل التأثير ولا ربط CI بالحادث.

⚠️ Do NOT activate plugins straight on prod. Use a clone of prod, test, then promote via Update Set.

18.3 Day 2–3 — Categories, groups, on-call

Categories & subcategories:

Navigate: All > System Definition > Choice Lists
Filter: Table = incident · Element = category
Add:
 hardware → laptop, desktop, monitor, peripheral
 software → office, browser, antivirus, custom_app
 network → wifi, vpn, dns, lan
 access → ad, mfa, vpn, app_access
 inquiry → how_to, policy

Assignment groups (seed list):

On-call rotation seed:

Navigate: All > On-Call Scheduling > Schedules
Create: "Server Ops 24x7"
Roster: 4 engineers, weekly rotation Mon 08:00
Escalation: 5 min, 15 min, 30 min, Manager

18.4 Day 4–5 — Incident states, priority matrix, SLAs

Incident states (default + custom):

Priority matrix (Data Lookup dl_matrix):

Impact \ Urgency | 1 High | 2 Medium | 3 Low
1 High | 1 | 2 | 3
2 Medium | 2 | 3 | 4
3 Low | 3 | 4 | 5

SLA targets (seed):

Navigate: All > Service Level Management > SLA Definitions
Create one definition per Priority. Use "Run on" → Task SLAs.

18.5 Day 6–7 — Change Types, CAB, Calendar

Change Types:

CAB meeting (recurring):

Wednesdays 14:00–15:00 — chaired by Change Manager
Quorum: Change Mgr + Tech Lead + Security + Business rep
Agenda template (Knowledge article):
1) Implemented since last CAB
2) Pending Authorize
3) Pending Schedule
4) Conflicts (§17.10.10)
5) Freeze windows

Change Schedule view:

Navigate: All > Change > Schedule
Filter: this week + next two weeks
Color: by risk

18.6 Day 8–9 — Problem, RCA, Known Errors

Problem states:

New → Assess → RCA → Fix in Progress → Resolved → Closed

RCA workflow — see §17.4 Recipe D for template.

Known Errors KB:

Create kb_knowledge_base: "Known Errors"
Visibility: itil + ess (read)
Each KE article auto-created when problem.known_error = true

18.7 Day 10–12 — Knowledge bases & workflow

Knowledge bases (seed):

KB workflow with approval:

Draft → Review → Published
Review state requires kb_owner approval (Flow)
Auto-archive after 365d inactive (§17.7 script)

Article templates — create 3:
1. How-to (steps, screenshots, related)
2. FAQ (Q&A list)
3. Troubleshoot (Problem → Cause → Resolution)

18.8 Day 13–14 — Service Catalog (10 items)

Wave-1 catalog items:

Record Producer #2 — Password reset:

// Script — record producer for incident table, category=access
(function() {
 current.short_description = 'Password reset request for ' + producer.system_name;
 current.category = 'access';
 current.subcategory = 'ad';
 current.urgency = 2;
 current.impact = 3;
 current.caller_id = gs.getUserID();
 current.assignment_group = gs.getProperty('itsm.password.reset.group');
 current.contact_type = 'self-service';
 current.description = 'System: ' + producer.system_name +
 '\nReason: ' + producer.reason +
 '\nLast known login: ' + (producer.last_login || 'unknown');
})();

Record Producer #5 — RMA:

(function() {
 current.short_description = 'RMA — ' + producer.asset_tag;
 current.category = 'hardware';
 current.subcategory = producer.device_type;
 current.cmdb_ci = (function() {
 var ci = new GlideRecord('cmdb_ci_hardware');
 ci.addQuery('asset_tag', producer.asset_tag);
 ci.query();
 return ci.next() ? ci.sys_id.toString() : '';
 })();
 current.description = 'Defect: ' + producer.defect_description +
 '\nFirst seen: ' + producer.first_seen +
 '\nShipping: ' + producer.shipping_address;
})();

Record Producer #10 — Terminate access:

(function() {
 current.short_description = 'Terminate access for ' + producer.user.getDisplayValue();
 current.category = 'access';
 current.urgency = 1;
 current.impact = 2;
 current.assignment_group = gs.getProperty('itsm.offboarding.group');
 current.description = 'User: ' + producer.user.getDisplayValue() +
 '\nLast day: ' + producer.last_day +
 '\nManager: ' + producer.manager.getDisplayValue() +
 '\nSystems to disable: ' + producer.systems_list +
 '\nForward email to: ' + producer.email_forward;
})();

18.9 Day 15–16 — Service Portal & branding

Navigate: All > Service Portal > Portals
Clone "Service Portal" → "IT Hub" → URL suffix /ithub
Update widgets:
- Header logo (PNG max 200×60)
- Color theme (primary, accent, header)
- Homepage tiles: Get Help · Request Something · Knowledge · My Items
Test impersonate ess → must work on mobile width 375px

Employee Center:

Navigate: All > Employee Center > Configuration
Topic taxonomy: IT · HR · Finance · Facilities
Featured items (top 5 from §18.8)
Search collections: KB + Catalog + Articles

18.10 Day 17 — Notifications

Notifications to seed (sysevent_email_action):

Bilingual templates — provide both EN + AR body fields; respect user language sys_user.preferred_language.

18.11 Day 18–19 — Reports & ITSM dashboard

4-tile ITSM Dashboard:

Build:

Navigate: All > Performance Analytics > Dashboards
New → "ITSM Operations"
Add 4 widgets: Single Score for each tile
Set refresh: 5 min real-time, others daily
Share with: itil_admin, change_manager, exec_viewer

18.12 Day 20 — PA Indicators & Data Collector

Navigate: All > Performance Analytics > Indicator Source
Create source: "All Incidents" → table incident, conditions: active=true
Indicators:
 - INC Volume (count, daily)
 - MTTR (avg duration resolved-opened, daily)
 - FCR rate (resolved_at - opened_at < 1h)
 - P1 Volume
Data Collector: nightly 02:00

18.13 Day 21–22 — ATF regression suite (10 tests)

Navigate: All > Automated Test Framework > Tests
Create:
T1 — Create incident as ess, save, verify caller_id auto-set
T2 — Set Impact=1, Urgency=1, verify Priority=1
T3 — Create Standard change, verify auto-approved
T4 — Create Normal change, verify CAB approval task
T5 — Resolve incident, verify task_sla stopped
T6 — Order catalog item, verify REQ+RITM+SC_TASK
T7 — Approve REQ as manager, verify state → Approved
T8 — Inbound email creates incident with caller from email
T9 — Impersonate ess, verify cannot see change.list
T10 — Major incident promotion, verify MI workspace opens
Schedule: Nightly 22:00, alert on fail

18.14 Day 23 — AI / Now Assist features

Navigate: All > Now Assist > Setup
Enable:
- Predictive Categorization (incident)
- Resolution Notes (incident)
- Similar Incidents
- Summarize Incident
- Now Assist for KB authoring
Train: 90 days of historic incidents (>5000 records min)
Test: open new test incident, verify category suggested with confidence > 0.7

18.15 Day 24–25 — Integrations

Outlook email-to-incident:

1) Create mailbox [email protected]
2) Configure ServiceNow Email Properties: incoming POP3/IMAP/OAuth
3) Inbound Action "Create Incident from email" (default OOTB)
4) Test: send email → check incident.list within 2 min

Teams notifications:

Spoke: Microsoft Teams Spoke (Integration Hub)
Subflow: "Post to Teams channel on P1 incident"
Trigger: incident.priority = 1 AND state inserts
Action: Teams - Post message to channel "MI War Room"

JIRA bi-directional:

Spoke: Atlassian Jira Spoke
Use cases:
- ServiceNow incident → JIRA bug (when category=software AND subcategory=defect)
- JIRA issue status change → ServiceNow incident work note
Auth: OAuth + dedicated service account

18.16 Day 26 — ACL hardening

⚠️ Do NOT use Any role on incident. Always specify itil or stricter.

18.17 Day 27 — UAT 30-scenario plan

Categories: 10 end-user + 10 agent + 5 change + 3 catalog + 2 KB
Pass/fail captured in atf_test_result-like table or simple spreadsheet
Sample scenarios:
UC-01 ess opens incident from /esc
UC-02 ess orders laptop, manager approves
UC-03 itil triages new incident, sets priority via matrix
UC-04 itil escalates P2 to Tier 2
UC-05 itil resolves with close code
UC-06 itil reopens within 7 days
UC-07 ess gets survey on close
UC-08 MI declared, comms fire
UC-09 problem from incident, link 5 incidents
UC-10 KE published to KB
UC-11 standard change auto-approved
UC-12 normal change → CAB approval
UC-13 emergency change with post-justify
UC-14 change conflict detected
UC-15 freeze window blocks new change
...
UC-30 PA dashboard renders all 4 tiles within 3 sec

18.18 Day 28 — Training & video

Audiences:
1) Admin (4 hours) — config, ACLs, scripts, troubleshooting
2) Agent (2 hours) — SOW, triage recipes (§17), KB linking
3) End-user (15 minutes) — EC tour, raise issue, approvals, my items
Deliverables:
- Slides EN + AR
- Recorded video (≤ 10 min each)
- Quick reference card (1 page bilingual)
- LMS handoff

18.19 Day 29 — Go-Live readiness review

Sign-off checklist:

[ ] All UAT scenarios PASS (≥ 28/30)
[ ] ATF regression GREEN for 3 consecutive nights
[ ] Update Set "ITSM_Baseline_v1" exported, committed to source-control
[ ] Notifications tested with real email + Teams
[ ] CMDB pre-loaded with critical CIs (see CMDB.md Day 8)
[ ] Knowledge base seeded with ≥ 50 articles
[ ] Catalog has 10 wave-1 items live
[ ] PA dashboard renders for exec_viewer role
[ ] War-room runbook printed & distributed
[ ] Hypercare squad on call 24x7 for week 1
[ ] Comms sent to all employees (T-7, T-1, Go-Live)

18.20 Day 30 — Hypercare day-1 monitoring

- Every 30 min: check incident.list backlog
- Every hour: review P1 / P2 count
- Stand-up at 10:00 and 16:00 with squad
- Watch for: ACL errors, missing fields, slow loads (Cache Inspector)
- Communication: daily exec email "ITSM Go-Live Day N status"
- Capture issues in a tracker — fix-forward not rollback unless critical

18.21 Common pitfalls

18.22 Post Go-Live month-1 KPIs

لو لم تصل لهذه الأرقام في الشهر الأول، خذها كموجة CSI ولا تنتظر — اعقد retro أسبوعي.

18.23 Final implementation checklist

• [ ] §18.1 Stakeholder map signed
• [ ] §18.2 Plugins activated; CMDB linked
• [ ] §18.3 Groups + on-call seeded
• [ ] §18.4 SLAs live for all 5 priorities
• [ ] §18.5 CAB calendar populated
• [ ] §18.6 Problem & KE workflow live
• [ ] §18.7 KB seeded (≥ 50 articles)
• [ ] §18.8 10 catalog items live (3 with Record Producer code)
• [ ] §18.9 EC + Service Portal branded
• [ ] §18.10 10 notifications active, bilingual templates
• [ ] §18.11 4-tile dashboard rendering for exec
• [ ] §18.12 PA Data Collector nightly
• [ ] §18.13 10 ATF tests GREEN
• [ ] §18.14 Now Assist live
• [ ] §18.15 Email + Teams + JIRA integrations validated
• [ ] §18.16 ACLs hardened, audit log on
• [ ] §18.17 UAT 28/30 passed
• [ ] §18.18 3 training tracks delivered
• [ ] §18.19 Go-Live sign-off captured
• [ ] §18.20 Hypercare week 1 monitored daily
• [ ] §18.21 Pitfall scan done
• [ ] §18.22 Month-1 KPIs reviewed in retro

§19 — CIS-ITSM Exam & Z-to-Hero Feature Labs

19.1 Exam bank linkage

Primary bank: C:\SVCProject\EXAM_BANK_ITSM_360.md (~120 questions, 103 KB)

Coverage: Incident, Problem, Change (Std/Normal/Emergency), Knowledge, Catalog, SLA, Workflows, Workspace, Reports, PA.

19.2 Z-to-Hero Feature Labs (15 labs)

19.3 Top 20 ITSM concepts to master

1. Task hierarchy: task → incident, problem, change_request, sc_request, sc_req_item, sc_task
2. State model (incident 1-Active to 7-Closed)
3. Priority = Impact × Urgency via Data Lookup
4. Assignment Rule order of evaluation
5. SLA: definition, start condition, pause condition, stop condition
6. Change Types: Standard (pre-approved), Normal (CAB), Emergency (post-review)
7. Change Approval: Approval Definition vs Flow approval
8. Change Risk: assessment matrix
9. Problem Workaround vs Resolution vs Known Error
10. Knowledge: KCS lifecycle (Capture, Structure, Reuse, Improve)
11. Service Catalog: Item vs Record Producer vs Order Guide
12. RITM lifecycle: Request → RITM → SC Task
13. Major Incident: declare → child/parent linking → comms
14. Notifications: Event-driven (preferred) vs direct subscription
15. Service Operations Workspace components
16. Performance Analytics: Indicators for incident, problem, change
17. Incident → Problem auto-promotion logic
18. ATF for ITSM: incident creation + state transitions
19. Reports vs Dashboards vs PA
20. ITSM Pro features: Now Assist, Vendor Mgr, DevOps integration

19.4 5 sample CIS-ITSM questions

Q. Which is the correct order of evaluation for Assignment Rules?
A. By order field ascending; first matching rule applies
B. Random
C. By sys_created_on desc
D. Domain → order → first match

Answer: D (in domain-separated instances) — otherwise just order ascending.

Q. A change is rejected after CAB. What state does it move to?
A. Closed
B. Cancelled
C. Authorize → Reject
D. Implement (skipped)

Answer: Depends on workflow — usually moves to Closed with reason “Rejected”.

Q. When should you use a Record Producer vs Catalog Item?
A. RP creates any record type; Item creates only sc_req_item
B. RP needs Flow; Item needs Workflow
C. RP is faster
D. They’re identical

Answer: A

Q. SLA stop condition for incident is typically…
A. state=resolved OR state=closed
B. state=closed
C. state=in_progress
D. priority=4

Answer: A

Q. Service Operations Workspace URL is…
A. /now/sow/home
B. /sp?id=service_ops
C. /itil_homepage.do
D. /now/sow/agent

Answer: A

(Use the full bank EXAM_BANK_ITSM_360.md for remaining 115+ questions.)

19.5 What “Hero” looks like for ITSM

• Designs end-to-end Incident → Problem → Change workflow
• Defines SLA with pause/stop conditions
• Configures Major Incident process with child linking + comms
• Implements Knowledge-Centered Service (KCS)
• Builds Service Catalog with Variable Sets + Flow fulfillment
• Sets up Service Operations Workspace with custom KPI tiles
• Integrates Now Assist for summarization + suggestion
• Passes CIS-ITSM with ≥85% on first attempt

Hands-on Labs — مختبرات عملية

Step-by-step labs for PDI / Australia instance. Replace {BASE} with your instance URL.
مختبرات خطوة بخطوة — استبدل {BASE} برابط نسختك.

1. Lab 1 — Create & resolve an incident / إنشاء حادث وحله
   - Open {BASE}/incident.do?sys_id=-1.
   - Set Caller, Category, Short description; submit.
   - Assign to your group; move state to In Progress → Resolved → Closed.
   - Verify SLA record on Related Lists → Task SLAs.

2. Lab 2 — Priority matrix / مصفوفة الأولوية
   - Open an incident; change Impact and Urgency.
   - Confirm Priority auto-calculates via Data Lookup.
   - Document the matrix in a personal cheat sheet.

3. Lab 3 — Catalog request E2E / طلب كتالوج من البداية للنهاية
   - Browse {BASE}/esc or {BASE}/sp.
   - Order a catalog item; track REQ → RITM → catalog tasks.
   - Complete fulfillment tasks and close the request.

4. Lab 4 — Standard Change auto-approval / تغيير قياسي
   - Create a Standard Change from a template at {BASE}/change_request.do?sys_id=-1.
   - Walk through Implement → Review → Close without CAB.

5. Lab 5 — Assignment rule / قاعدة إسناد
   - At {BASE}/sysrule_assignment_list.do, create a rule matching Category = Software.
   - Create a matching incident; verify auto-assignment.

6. Lab 6 — Knowledge publish / نشر مقال معرفة
   - Create KB article at {BASE}/kb_knowledge.do?sys_id=-1.
   - Submit for review; publish; link from a resolved incident.

7. Lab 7 — Service Operations Workspace / مساحة عمل الوكيل
   - Open {BASE}/now/sow/home.
   - Use List, Record, and Activity stream to work three incidents.

8. Lab 8 — Flow approval for Change / موافقة Flow للتغيير
   - Build a simple approval Flow at {BASE}/now/flow-designer.
   - Attach to Normal Change model; test end-to-end.

Best Practices — أفضل الممارسات

Common mistakes to avoid / أخطاء شائعة:
- Duplicate assignment logic in BR + Assignment Rules — duplicates cause race conditions.
- SLA without schedule → runs 24/7 incorrectly.
- Catalog items without fulfillment Flow → RITM stuck in Open.

Deployment Checklist — قائمة النشر

Direct URLs Quick Reference

§20 — Deep Implementation Labs (Create → Configure → Deploy)

Purpose: Production-grade, step-by-step labs with copy/paste scripts, SLA wiring, assignment rules, ATF smoke tests, and {BASE} URLs for every ITSM component touched.
Prerequisite: Replace {BASE} with your instance (e.g. https://devXXXX.service-now.com). Run all config in dev/sub-prod first; promote via Update Set.
Update Set: Create ITSM_Wave2_Incident_Problem_Change at {BASE}/sys_update_set_list.do before Step 20.0.

20.0 — Pre-Lab Foundation (do once)

20.0.1 Create Update Set

20.0.2 Verify plugins active

20.0.3 Seed groups & roles (background script)

Run at {BASE}/sys.scripts.do:

// ITSM Lab 20.0 — seed groups (idempotent)
var groups = [
  {name: 'Service Desk L1', desc: 'Tier 1 incident triage'},
  {name: 'Network Ops', desc: 'Network incidents'},
  {name: 'Server Ops', desc: 'Server / infrastructure'},
  {name: 'Application Support', desc: 'Business apps'},
  {name: 'Problem Management', desc: 'RCA and Known Errors'},
  {name: 'CAB Approvers', desc: 'Change Advisory Board'}
];
groups.forEach(function(g) {
  var gr = new GlideRecord('sys_user_group');
  gr.addQuery('name', g.name);
  gr.query();
  if (!gr.next()) {
    gr.initialize();
    gr.name = g.name;
    gr.description = g.desc;
    gr.insert();
    gs.info('Created group: ' + g.name);
  } else {
    gs.info('Group exists: ' + g.name);
  }
});

20.0.4 Assign itil role to lab agent

20.0.5 Verification script

// Run after 20.0.3 — expect 6 groups
var ga = new GlideAggregate('sys_user_group');
ga.addQuery('name', 'IN', 'Service Desk L1,Network Ops,Server Ops,Application Support,Problem Management,CAB Approvers');
ga.addAggregate('COUNT');
ga.query();
ga.next();
gs.info('Groups found: ' + ga.getAggregate('COUNT'));

20.1 — Incident Management Lab (Create → Configure → Deploy)

Goal: Full incident pipeline — categories, priority matrix, assignment rule, P1/P3 SLAs, Business Rule for VIP, notification, UAT, Update Set export.

Phase A — Configure (30 min)

A1. Incident categories

A2. Subcategories for hardware

A3. Priority matrix (Impact × Urgency)

A4. Incident properties

Phase B — Assignment rule for incidents (see §20.5 Lab-INC-01)

Create rule INC — Software → Application Support at {BASE}/sysrule_assignment_list.do (detailed in §20.5).

Phase C — Business Rules (15 min)

C1. VIP auto-escalation BR

Script:

(function executeRule(current, previous) {
  if (!current.caller_id) return;
  var u = new GlideRecord('sys_user');
  if (!u.get(current.caller_id)) return;
  if (u.vip != true && u.vip != 'true') return;
  current.impact = 1;
  current.urgency = 1;
  var grp = new GlideRecord('sys_user_group');
  grp.addQuery('name', 'Service Desk L1');
  grp.query();
  if (grp.next()) current.assignment_group = grp.sys_id;
  current.work_notes = 'VIP caller — priority elevated by ITSM Lab BR.';
})(current, previous);

C2. Auto-link CI from asset tag in short description

(function executeRule(current, previous) {
  if (!current.cmdb_ci.nil()) return;
  var sd = (current.short_description || '').toString();
  var match = sd.match(/ASSET[- ]?(\w+)/i);
  if (!match) return;
  var tag = match[1];
  var ci = new GlideRecord('cmdb_ci');
  ci.addQuery('asset_tag', tag);
  ci.setLimit(1);
  ci.query();
  if (ci.next()) {
    current.cmdb_ci = ci.sys_id;
    current.work_notes = 'CI linked via asset tag: ' + ci.name;
  }
})(current, previous);

Phase D — Create & walk incident lifecycle (20 min)

P1 incident quick test:

Phase E — Notification (5 min)

Phase F — Deploy (10 min)

Incident lab verification script:

// Background: {BASE}/sys.scripts.do — last 5 incidents with SLA status
var inc = new GlideRecord('incident');
inc.orderByDesc('sys_created_on');
inc.setLimit(5);
inc.query();
while (inc.next()) {
  var sla = new GlideRecord('task_sla');
  sla.addQuery('task', inc.sys_id);
  sla.query();
  var slaStatus = sla.next() ? sla.stage + ' / breached=' + sla.has_breached : 'NO SLA';
  gs.info(inc.number + ' | P' + inc.priority + ' | state=' + inc.state + ' | SLA=' + slaStatus);
}

20.2 — Problem Management Lab (Create → Configure → Deploy)

Goal: Problem from incident pattern, RCA workflow, Known Error flag, KB article link, deploy.

Phase A — Configure (20 min)

A1. Problem states (verify OOTB)

A2. Problem properties

A3. Assignment rule PRB-01

Phase B — Script: Create Problem from incident (UI Action alternative)

Navigate: {BASE}/sys_ui_action_list.do?sysparm_query=table%3Dincident

Or run once as background script to create problem from latest incident:

// ITSM Lab 20.2 — Create Problem from most recent open incident
var inc = new GlideRecord('incident');
inc.addQuery('state', '!=', 7);
inc.addQuery('problem_id', '');
inc.orderByDesc('opened_at');
inc.setLimit(1);
inc.query();
if (!inc.next()) {
  gs.error('No suitable incident found');
} else {
  var prb = new GlideRecord('problem');
  prb.initialize();
  prb.short_description = 'RCA: ' + inc.short_description;
  prb.description = 'Pattern investigation from ' + inc.number + '\n\n' + inc.description;
  prb.cmdb_ci = inc.cmdb_ci;
  prb.priority = inc.priority;
  var grp = new GlideRecord('sys_user_group');
  grp.addQuery('name', 'Problem Management');
  grp.query();
  if (grp.next()) prb.assignment_group = grp.sys_id;
  prb.assigned_to = gs.getUserID();
  var prbId = prb.insert();
  inc.problem_id = prbId;
  inc.update();
  prb.number = prb.number; // refresh
  prb.get(prbId);
  gs.info('Created ' + prb.number + ' linked to ' + inc.number);
}

Phase C — Walk Problem lifecycle (25 min)

Known Errors list verify:

{BASE}/problem_list.do?sysparm_query=known_error%3Dtrue

Phase D — Business Rule: Auto-flag recurring incidents

(function executeRule(current, previous) {
  if (!current.cmdb_ci) return;
  var ga = new GlideAggregate('incident');
  ga.addQuery('cmdb_ci', current.cmdb_ci);
  ga.addQuery('opened_at', '>', gs.daysAgo(1));
  ga.addQuery('sys_id', '!=', current.sys_id);
  ga.addAggregate('COUNT');
  ga.query();
  if (!ga.next()) return;
  if (parseInt(ga.getAggregate('COUNT'), 10) >= 2) {
    current.work_notes = 'PATTERN ALERT: 3+ incidents on same CI in 24h — consider Problem record.';
    current.update();
  }
})(current, previous);

Phase E — Deploy

Same Update Set workflow as §20.1 Phase F. Include: assignment rule PRB-01, BR, any KB base config.

20.3 — Change Management Lab (Create → Configure → Deploy)

Goal: Standard (auto-approve), Normal (CAB Flow), Emergency (post-review) — full lifecycle with scripts.

Phase A — Change models & types (15 min)

A1. Verify Change models

A2. CAB Definition

Phase B — Flow Designer CAB approval (20 min)

Standard Change auto-approve BR (if not OOTB):

Navigate: {BASE}/sys_script_list.do?sysparm_query=collection%3Dchange_request

(function executeRule(current, previous) {
  if (current.type != 'standard') return;
  if (current.operation() != 'insert') return;
  current.state = -1; // Implement
  current.approval = 'approved';
  current.work_notes = 'ITSM Lab: Standard change auto-approved.';
})(current, previous);

Phase C — Lab C1: Standard Change (15 min)

Phase D — Lab C2: Normal Change with CAB (25 min)

Change calendar verify:

{BASE}/change_request_calendar.do

Phase E — Lab C3: Emergency Change (15 min)

Conflict detection script (run before CAB):

// Background: {BASE}/sys.scripts.do — check overlapping changes on same CI
var chgSysId = '<paste_change_sys_id>';
var chg = new GlideRecord('change_request');
if (!chg.get(chgSysId)) { gs.error('Change not found'); }
var conflict = new GlideRecord('change_request');
conflict.addQuery('cmdb_ci', chg.cmdb_ci);
conflict.addQuery('sys_id', '!=', chg.sys_id);
conflict.addQuery('start_date', '<=', chg.end_date);
conflict.addQuery('end_date', '>=', chg.start_date);
conflict.addQuery('state', 'IN', '-2,-3,-4');
conflict.query();
while (conflict.next()) {
  gs.warn('CONFLICT: ' + conflict.number + ' overlaps on ' + conflict.cmdb_ci.name);
}

Phase F — Deploy Change config

20.4 — SLA Configuration Lab (Complete Step-by-Step)

Goal: Five priority-based SLA definitions with schedules, start/pause/stop conditions, retroactive start, and breach notifications.

20.4.1 — Schedules (prerequisite)

Create 8x5 schedule if missing:

20.4.2 — SLA Definition template (repeat for P1–P5)

Open SLA Definitions: {BASE}/contract_sla_list.do

P1 Critical — Response SLA

P1 Critical — Resolution SLA

P2 High — Response / Resolution

P3 Moderate — Response / Resolution

P4 Low / P5 Planning

20.4.3 — SLA properties to verify

20.4.4 — SLA test procedure (hands-on)

SLA verification script:

// {BASE}/sys.scripts.do — audit active SLAs on open incidents
var sla = new GlideRecord('task_sla');
sla.addQuery('task.active', true);
sla.addQuery('stage', '!=', 'cancelled');
sla.orderByDesc('sys_created_on');
sla.setLimit(10);
sla.query();
while (sla.next()) {
  gs.info(sla.task.number + ' | ' + sla.sla.name + ' | stage=' + sla.stage +
    ' | breach=' + sla.has_breached + ' | time_left=' + sla.time_left);
}

20.4.5 — SLA breach notification

20.5 — Assignment Rules Lab (Complete Step-by-Step)

Goal: Six production assignment rules with order, conditions, scripts, and automated verification.

Open Assignment Rules: {BASE}/sysrule_assignment_list.do

Evaluation order: Rules run by Order ascending — first match wins. Lower number = higher priority.

Rule catalog

Step-by-step: Create INC-SW-01

Optional script (Assign to least-loaded agent in group):

// Assignment Rule script — round-robin by open incident count
var groupId = 'Application Support'; // or use current assignment_group
var grp = new GlideRecord('sys_user_group');
grp.addQuery('name', groupId);
grp.query();
if (!grp.next()) return;
var bestUser = null;
var minCount = 999999;
var m = new GlideRecord('sys_user_grmember');
m.addQuery('group', grp.sys_id);
m.query();
while (m.next()) {
  var ga = new GlideAggregate('incident');
  ga.addQuery('assigned_to', m.user);
  ga.addQuery('active', true);
  ga.addAggregate('COUNT');
  ga.query();
  var cnt = ga.next() ? parseInt(ga.getAggregate('COUNT'), 10) : 0;
  if (cnt < minCount) { minCount = cnt; bestUser = m.user; }
}
if (bestUser) current.assigned_to = bestUser;

Assignment Lookup Rules (alternative for complex routing)

Use when routing depends on multiple fields (category + subcategory + location).

Verification procedure

Assignment audit script:

// {BASE}/sys.scripts.do — unassigned open incidents (should be zero after rules)
var inc = new GlideRecord('incident');
inc.addQuery('active', true);
inc.addQuery('assignment_group', '');
inc.query();
gs.info('Unassigned open incidents: ' + inc.getRowCount());
while (inc.next()) gs.warn('  ' + inc.number + ' — ' + inc.short_description);

20.6 — ATF Smoke Test Suite (Create → Schedule → Deploy)

Goal: 12 Automated Test Framework tests covering Incident, Problem, Change, SLA, Assignment, Catalog, and security — runnable nightly.

Prerequisites:

20.6.1 — Create test suite

20.6.2 — Test definitions (12 tests)

ATF-01 — Incident: Priority matrix P1

ATF-02 — Incident: Assignment rule software

ATF-03 — Incident: SLA starts on insert

// ATF server step — assert task_sla exists
var incSysId = test.getRecordSysId('incident');
var sla = new GlideRecord('task_sla');
sla.addQuery('task', incSysId);
sla.query();
assertTrue(sla.hasNext(), 'Expected task_sla record for P1 incident');

ATF-04 — Incident: SLA pause on hold

ATF-05 — Incident: Resolve stops SLA

ATF-06 — Problem: Create and assign

ATF-07 — Change: Standard auto-approve

ATF-08 — Change: Normal creates approval

ATF-09 — Catalog: Order creates REQ/RITM

ATF-10 — Security: ess cannot read change_request.list

ATF-11 — Knowledge: Publish workflow

ATF-12 — SOW loads for itil user

20.6.3 — Schedule nightly run

20.6.4 — Run manually & read results

Pass criteria for deploy: 12/12 green for 3 consecutive nightly runs (matches §18.19).

20.6.5 — ATF deploy checklist

20.7 — Master URL Index (Every ITSM Component)

Single reference — replace {BASE} with your instance. All links open the corresponding list or form.

20.7.1 — Core process tables

20.7.2 — Service Catalog & Request

20.7.3 — Knowledge

20.7.4 — Administration & Policy

20.7.5 — Change administration

20.7.6 — Users, groups, security

20.7.7 — CMDB (ITSM cross-links)

20.7.8 — Portals & workspaces

20.7.9 — Reporting & analytics

20.7.10 — Development & deploy

20.7.11 — HR Leave app cross-reference (scope x_786686_hr_leave)

20.8 — Integrated Deploy Runbook (Dev → Test → Prod)

Single cutover sequence after Labs 20.1–20.6 pass locally.

Post-deploy health script (run in PROD):

// ITSM Wave2 health check — {BASE}/sys.scripts.do
var checks = [];
// 1. Assignment rules active
var ar = new GlideAggregate('sysrule_assignment');
ar.addQuery('active', true);
ar.addQuery('table', 'IN', 'incident,problem,change_request');
ar.addAggregate('COUNT');
ar.query(); ar.next();
checks.push('Assignment rules: ' + ar.getAggregate('COUNT'));
// 2. SLA definitions
var sla = new GlideAggregate('contract_sla');
sla.addQuery('active', true);
sla.addQuery('collection', 'incident');
sla.addAggregate('COUNT');
sla.query(); sla.next();
checks.push('Incident SLAs: ' + sla.getAggregate('COUNT'));
// 3. Open P1 count
var p1 = new GlideAggregate('incident');
p1.addQuery('priority', 1);
p1.addQuery('active', true);
p1.addAggregate('COUNT');
p1.query(); p1.next();
checks.push('Open P1 incidents: ' + p1.getAggregate('COUNT'));
checks.forEach(function(c) { gs.info('HEALTH — ' + c); });

20.9 — §20 Lab Sign-Off Checklist

• [ ] 20.0 Foundation: 6 groups, roles, Update Set current
• [ ] 20.1 Incident: P1/P3 lifecycle, VIP BR, CI link BR, SLA pause/resume/stop
• [ ] 20.2 Problem: RCA, Known Error, KB linked, pattern BR
• [ ] 20.3 Change: Standard + Normal + Emergency all closed successfully
• [ ] 20.4 SLA: 10 definitions (5 priorities × response+resolution), schedules wired
• [ ] 20.5 Assignment: 7 rules verified with test incidents/problems/changes
• [ ] 20.6 ATF: 12/12 smoke tests green × 3 nights
• [ ] 20.7 URLs: bookmark §20.7 master index
• [ ] 20.8 Deploy: TEST commit + PROD smoke complete
• [ ] Update Set exported and stored in source control

Estimated total lab time: 6–8 hours (single implementer) · Recommended: split across 2 days with UAT on day 2.

§20 added: Deep Implementation Labs — Incident / Problem / Change create-configure-deploy, SLA suite, assignment rules, ATF smoke tests, master URL index.