AI ServiceNow Incident Triage with RAG

Give every ServiceNow incident a knowledge-base-grounded first response before an engineer even opens it. This Kestra blueprint reacts to a webhook, reads the newest record from the ServiceNow incident table, embeds your operations playbook into the built-in Kestra KV vector store, and asks Google Gemini for triage steps through retrieval-augmented generation. If the model finds relevant playbook guidance, the proposal is written back to the incident comments; if the ticket is out of scope, the model answers 'N/A' and ServiceNow is left untouched, a simple but effective hallucination guardrail.

How it works

1. The incident_trigger (io.kestra.plugin.core.trigger.Webhook) is called by a ServiceNow business rule or outbound REST message, secured by SERVICENOW_WEBHOOK_KEY.
2. The get_incidents task (io.kestra.plugin.servicenow.Get) queries the incident table using credentials supplied once via pluginDefaults.
3. The last_incident task (io.kestra.plugin.core.debug.Return) sorts by incident number with jq and keeps only sys_id, number, priority, and the descriptions.
4. The build_kb_rag task (io.kestra.plugin.ai.rag.IngestDocument) embeds the inline playbook stub with gemini-embedding-001 into io.kestra.plugin.ai.embeddings.KestraKVStore, dropping the old index each run.
5. The ask_ai task (io.kestra.plugin.ai.rag.ChatCompletion) retrieves matching playbook sections and asks gemini-3.5-flash-lite for a summary, work notes, and proposed resolution with mandatory Risk, Steps, and Verification sections.
6. The if_suggestion task (io.kestra.plugin.core.flow.If) checks the answer is not 'N/A', and only then update_servicenow (io.kestra.plugin.servicenow.Update) patches the incident's comments field by sys_id.

What you get

• Incidents enriched with runbook-consistent triage steps directly inside ServiceNow.
• A conditional write-back that never posts noise for out-of-scope tickets.
• Retrieval grounded in your own playbooks, embedded without external vector infrastructure.
• Complete execution lineage from webhook to incident update for audits.

Who it's for

• ITSM teams on ServiceNow who want faster mean time to acknowledge.
• SRE and infrastructure teams encoding tribal knowledge into automated first responses.
• ServiceNow admins exploring AI enrichment without building a custom integration.

Why orchestrate this with Kestra

Building this inside ServiceNow means scripted REST calls, credential juggling, and no visibility into what the model was actually asked. Kestra gives you the ServiceNow plugin (Get, Update) and the AI plugin (IngestDocument, ChatCompletion) as declarative tasks, pluginDefaults so instance credentials are declared once, secrets kept out of the flow body, conditional branching with If, and per-task logs that capture the retrieved context and model output for every incident. Changing the model provider or vector store is a two-line edit, not a re-integration.

Prerequisites

• A ServiceNow instance with a service account allowed to read and update the incident table.
• A ServiceNow business rule or outbound REST message that calls the webhook on incident creation.
• A Google AI Studio API key with access to Gemini chat and embedding models.

Secrets

• SERVICENOW_DOMAIN: your instance domain, for example dev12345.service-now.com.
• SERVICENOW_USERNAME, SERVICENOW_PASSWORD: service account credentials for the ServiceNow plugin.
• GEMINI_API_KEY: Google Gemini API key for embeddings and chat.
• SERVICENOW_WEBHOOK_KEY: shared secret guarding the Webhook trigger.

Quick start

1. Add the secrets above to your Kestra namespace.
2. Replace the inline knowledge base stub in build_kb_rag with your real playbooks.
3. Deploy the flow and execute it manually once to verify credentials against your instance.
4. Configure ServiceNow to call the webhook URL with the configured key when incidents are created.
5. Open the incident in ServiceNow and review the AI triage comment.

How to extend

• Pass the incident sys_id in the webhook body and fetch that exact record instead of the newest one.
• Route by priority: page on-call through PagerDuty for P1, comment only for lower priorities.
• Add a Pause approval step before writing back so humans vet AI suggestions during rollout.
• Move KB ingestion to a scheduled flow and keep triage executions retrieval-only.
• Swap KestraKVStore for pgvector or Weaviate when the playbook grows.

Links

• ServiceNow plugin docs: https://kestra.io/plugins/plugin-servicenow
• Kestra AI plugin docs: https://kestra.io/plugins/plugin-ai