Predict SLA breach risk and escalate ServiceNow incidents with Slack alerts
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 14 nodes and runs on a schedule (every 15 minutes). Along the way it connects Slack and ServiceNow.
How it runs
Trigger: On a schedule (every 15 minutes).
- Retrieve Current Incidents (ServiceNow): get many (incident)
- Set Incident Field Data (Edit Fields (Set)): sets 6 fields: sys_id, number, priority…
- Group Incidents by Category (Code): runs custom JavaScript code
- Batch Process Incidents (Loop Over Items (Split in Batches)): loops over the items in batches
- Compute Breach Probability (Code): runs custom JavaScript code
- Retrieve Past Resolutions (ServiceNow): get many (incident)
- Limit: keeps the first few items
- Pause for 1 Second (Wait): waits 1 seconds
- Check Breach Risk > 70% (If): checks a condition and branches into true / false
- Escalate SLA Breach Incident (ServiceNow): update (incident)
…plus 2 more steps. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (10)
- If
n8n-nodes-base.if - Slack
n8n-nodes-base.slack - ServiceNow
n8n-nodes-base.serviceNow - No Operation, do nothing
n8n-nodes-base.noOp - Code
n8n-nodes-base.code - Edit Fields (Set)
n8n-nodes-base.set - Schedule Trigger
n8n-nodes-base.scheduleTrigger - Limit
n8n-nodes-base.limit - Loop Over Items (Split in Batches)
n8n-nodes-base.splitInBatches - Wait
n8n-nodes-base.wait
From the author
Quick overview Video Demo : https://youtu.be/rjEGRcFq2L0 This workflow polls ServiceNow every 15 minutes to estimate SLA breach risk for open incidents using recent resolution history, then escalates high-risk tickets in ServiceNow and alerts a Slack channel.…