CIS cheat sheet

The ServiceNow AI Platform is built on a single data model: every record in every application is a row in a table, and every table extends another table via the sys_db_object hierarchy.

Core table hierarchy: task (extends sys_glide_object-like base) → incident, problem, change_request, sc_request, sc_task; cmdb_ci → cmdb_ci_server, cmdb_ci_appl. Extending inherits all parent fields and business rules.

sys_id is a 32-character GUID primary key; records are addressed by table + sys_id. Display values come from the table's display column (usually number or name).

GlideRecord is the server-side data API: addQuery(), addEncodedQuery(), query(), next(), get(sys_id), insert(), update(), deleteRecord(). GlideAggregate adds count/sum/avg/groupBy.

Client-side GlideRecord is available in scoped apps but is asynchronous; use GlideAjax with a Script Include (AbstractAjaxProcessor) for secure server calls from client scripts.

ACL evaluation order: record-level ACLs (read/write/create/delete) are checked first, then field-level ACLs; a user must pass at least one ACL per operation and role-based conditions are ANDed within a single ACL.

AI fundamentals on the platform: Predictive Intelligence uses classification/regression/similarity solutions trained on table data; Now Assist uses LLMs via skills invoked from flows, Virtual Agent topics, and workspace actions.

Update Sets capture configuration changes (business rules, UI policies, workflows, ACLs) but not data; they are scoped by application scope and applied in a defined order (base, then dependent, then default).

Form design layers: form layout (sys_ui_element), field-level ACLs, UI policies (client-side, can be mandatory/read-only/visible), data policies (server-enforced mandatory/read-only, apply to import and API), and client scripts (onLoad, onChange, onSubmit, onCellEdit).

Business rule timing: before (modify current before write), after (post-write actions, cannot change current), async (queued), display (before form render, replaces UI). Order field controls execution sequence; condition and filter define when it fires.

Flow Designer components: trigger (record created/updated, schedule, form submission), action (spoke action or custom), flow logic (if, for each, do until, wait). Subflows are reusable and callable from other flows.

Workflow Editor (legacy) uses activities (approval, task, notification) with transitions; it is table-driven and less reusable than Flow Designer, which is preferred for new builds.

Import Sets: staging table (sys_import_set_row) → transform map with field mappings and transform scripts (onStart, onBefore, onAfter, onComplete). Coalesce on a unique field to update instead of insert.

Scoped vs. global apps: scoped apps have a private API surface, require cross-scope privileges to access global tables, and cannot modify global artifacts directly.

Instance clone: copies data and configuration from production to a sub-production instance; excludes sys_attachment optionally, resets sys_id conflicts, and preserves the target's instance name and email settings.

Scheduled jobs use sys_trigger and run in the background; system properties (sys_properties) hold instance-wide configuration read via gs.getProperty() and cached until cache flush.

ITSM core process flow: incident → problem (root cause) → change (fix) → knowledge article; incident can spawn problem, problem can spawn change, change can reference affected CIs in the CMDB.

ITOM: Discovery uses MID Server to find CIs and populate CMDB; Service Mapping builds application service maps from entry points; Event Management ingests alerts and creates incidents via alert rules.

CSM (Customer Service Management) uses the customer service case table (sn_customerservice_case) with account, contact, and product models; it extends the platform's case management with SLA and omni-channel.

HR Service Delivery uses hr_case and hr_task with COEs (centers of excellence), document templates, and journey designer; employee center is the unified portal.

ITBM/SPM (Strategic Portfolio Management) covers demand, project, and agile: demand → project → story/task, with portfolio and resource planning.

Security Operations: Security Incident Response (SIR) uses security_incident, threat intelligence, and playbooks; Vulnerability Response tracks vulnerable items against CIs.

Field Service Management uses work order and work order task tables with scheduling, dispatching, and mobile agent workflows.

IntegrationHub uses spokes (prebuilt connectors) and actions; REST/SOAP outbound calls are configured via REST Message and SOAP Message records with method-level authentication.

Predictive Intelligence solution types: Classification (predict a choice field), Regression (predict a numeric field), Similarity (find similar records), and Clustering; each requires training data with a defined target field.

Now Assist skills are LLM-backed capabilities (case summarization, resolution notes, chat summarization) enabled per application; they require a Now Assist license and are governed by skill-level access controls.

Virtual Agent topics are built with NLU (intents, entities, utterances) or LLM-based topic discovery; topic blocks define prompts, actions, and branching.

Data governance: data policies enforce mandatory/read-only on import and API; ACLs and field-level encryption (Edge Encryption) protect sensitive data; data classification tags (PII, sensitive) drive masking and retention.

AI governance on the platform: AI Control Tower / AI Governance tracks model inventory, risk classification, and approval workflows for AI assets; audit records live in the sys_audit and AI-specific tables.

CMDB data governance: Health Dashboard (completeness, correctness, compliance), CMDB 360, and Identification and Reconciliation Engine (IRE) rules determine CI creation and deduplication.

Performance: slow queries are diagnosed via the transaction log (syslog_transaction), slow query log, and query hints; indexes on frequently filtered fields reduce table scans.

Instance security: high-security plugin, IP access control, MultiSSO, and the security center (instance security center) score configuration against hardening checks.