How to Automate ServiceNow to Slack Incident Alerts?
Description
Keep your team on top of new tickets without watching dashboards. Every five minutes, new ServiceNow incidents are checked and posted to a Slack channel so people can act fast. Ideal for IT support and operations teams that work in Slack all day.
A schedule trigger runs on a five minute loop, and a manual trigger helps with safe testing. The flow calculates a timestamp from five minutes ago in UTC, queries ServiceNow for incidents created after that time, and checks if any records exist. When records are found, they are sorted by incident number and sent to Slack as a rich message with the ID, description, severity, caller, priority, state, category, open date, and a direct link to the record. If nothing is new, the path ends quietly. If ServiceNow cannot be reached, a clear error message posts to Slack so credentials can be fixed quickly.
Setup is simple. You need a ServiceNow account with access to the incident table and a Slack app that can post to the chosen channel. Expect faster triage, fewer missed tickets, and less context switching because updates arrive where people already work. Most teams see response times drop as alerts appear quickly with all the key details.
Tools Required
What this workflow does?
- Runs on a five minute schedule to look for new incidents
- Manual test trigger lets you validate changes without waiting
- Calculates a UTC timestamp from five minutes ago for accurate time windows
- Queries the ServiceNow incident table using a created after filter and returns display values
- Checks for the presence of a system ID to confirm new records
- Sorts incidents by incident number in ascending order for clear reading
- Sends a Slack block message with key fields and a direct link to the ServiceNow record
- Posts a Slack error alert if the ServiceNow connection fails
- Quiet no action path when no new incidents are found
What are the benefits?
- Reduce manual checks from hourly sweeps to an automated five minute cadence
- Cut triage time by up to 50 percent with key fields and direct links in Slack
- Eliminate 100 percent of copy paste steps for incident updates
- Connect ServiceNow and Slack so teams act in one place
- Handle higher ticket volume without adding extra manual work
How to set this up?
- Import the template into n8n: Create a new workflow in n8n > Click the three dots menu > Select 'Import from File' > Choose the downloaded JSON file.
- You'll need accounts with ServiceNow and Slack. See the Tools Required section above for links to create accounts with these services.
- In the n8n credentials manager, create a ServiceNow Basic Auth credential using your instance URL, username, and password. The user must have read access to the incident table.
- Open the ServiceNow node. Select your ServiceNow credential. Set Resource to incident and Operation to getAll. In Options, keep the query that filters by sys_created_on greater than the queryDate and enable display values. Click Execute Node to confirm it returns records.
- Double click a Slack node. In the Credential dropdown, click Create new credential and follow the on screen steps to connect your Slack workspace. Ensure the app has permission to post messages and is invited to your target channel.
- In both Slack nodes, choose the channel where notifications should post. Send a test message to confirm the app can post to that channel.
- Open the Schedule Trigger node and set it to run every five minutes. Save the workflow.
- Open the DateTime node. Set operation to subtract from date, base time to now in UTC, amount to 5, unit to minutes, and output field name to queryDate.
- Check the If node condition so it verifies that the sys_id field exists. Run a test to make sure it routes correctly when records are returned.
- In the Sort node, sort by the number field in ascending order to keep incidents in a clear sequence.
- Customize the Slack message blocks if needed. Keep the incident link so responders can open the record with one click.
- Create a test incident in ServiceNow and trigger the workflow manually. Confirm that a formatted alert arrives in Slack when the incident was created within the last five minutes.
- Troubleshoot common issues: if a Slack error alert says ServiceNow failed, refresh or fix the ServiceNow credential. If no alerts arrive, check channel permissions, confirm the app is added to the channel, and verify time zone settings match UTC.
Need help or want to customize this?
Ask in the Free Futurise Community.
Similar Templates
These templates were sourced from publicly available materials across the web, including n8n’s official website, YouTube and public GitHub repositories. We have consolidated and categorized them for easy search and filtering, and supplemented them with links to integrations, step-by-step setup instructions, and personalized support in the Futurise community. Content in this library is provided for education, evaluation and internal use. Users are responsible for checking and complying with the license terms with the author of the templates before commercial use or redistribution.Where an original author was identified, attribution has been provided. Some templates did not include author information. If you know who created this template, please let us know so we can add the appropriate credit and reference link. If you are the author and would like this template removed from the library, email us at info@futurise.com and we will remove it promptly.
