# AI Lens

> Analyze records in context, surface related information, identify patterns, and recommend actions across enterprise platform tables.

- Skill: `happy-technologies-llc/ai-lens` (Agent Skill)
- Install (CLI): `npx skillmds@latest add happy-technologies-llc/ai-lens`
- Raw SKILL.md: https://api.skillmd.com/api/skills/happy-technologies-llc/ai-lens/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Happy-Technologies-LLC (https://skillmd.com/u/happy-technologies-llc)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/happy-technologies-llc/ai-lens

---


# ServiceNow AI Lens

## Overview

AI Lens provides contextual intelligence for any ServiceNow record, surfacing insights that are not immediately visible on the form or list view:

- **Related Information**: Connected records, upstream/downstream dependencies, and associated knowledge
- **Pattern Analysis**: Historical trends for similar records, recurring issues, and anomaly detection
- **Risk Assessment**: SLA risk, escalation likelihood, and potential business impact
- **Recommended Actions**: Next best actions based on record state, history, and peer analysis
- **Cross-Module Context**: Information from ITSM, CSM, HRSD, CMDB, and other modules that enrich understanding
- **Predictive Insights**: Estimated resolution time, likely assignment, and probable root cause

**When to use:** When agents, managers, or analysts need a comprehensive contextual view of any record that goes beyond what is visible on the standard form, or when building AI-augmented workspace experiences.

## Prerequisites

- **Roles:** `itil`, `sn_customerservice_agent`, `sn_hr_core.case_reader`, or `admin`
- **Plugins:** Platform foundation (no specific plugin required; leverages existing module data)
- **Access:** Read access to the target table and related tables (CMDB, knowledge, SLA)
- **Knowledge:** Cross-module ServiceNow data model, relationship patterns between tables
- **Related Skills:** `itsm/incident-activity-summarization` for activity context, `genai/playbook-recommendations` for action recommendations

## Procedure

### Step 1: Identify the Target Record and Table

Determine what record the user is viewing and its table context.

**MCP Approach:**
```
Tool: SN-Get-Record
Parameters:
  table_name: incident
  sys_id: <record_sys_id>
  fields: sys_id,sys_class_name,number,short_description,description,state,priority,impact,urgency,category,subcategory,assigned_to,assignment_group,opened_at,opened_by,caller_id,cmdb_ci,parent,caused_by,problem_id,rfc
```

**REST Approach:**
```
GET /api/now/table/incident/<record_sys_id>
  ?sysparm_fields=sys_id,sys_class_name,number,short_description,description,state,priority,impact,urgency,category,subcategory,assigned_to,assignment_group,opened_at,caller_id,cmdb_ci,problem_id,rfc
  &sysparm_display_value=true
```

### Step 2: Discover Table Schema for Context Fields

Understand what fields and references are available for this record type.

**MCP Approach:**
```
Tool: SN-Get-Table-Schema
Parameters:
  table_name: incident
```

Identify reference fields that link to other tables for cross-module exploration.

### Step 3: Surface Related Records

Query for records connected to the target through references, relationships, and shared attributes.

**Related Incidents (same CI or category):**

**MCP Approach:**
```
Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: cmdb_ci=<ci_sys_id>^sys_id!=<current_sys_id>^active=true^ORDERBYDESCopened_at
  fields: sys_id,number,short_description,state,priority,opened_at,assigned_to
  limit: 10
```

**CMDB Relationships (upstream/downstream services):**
```
Tool: SN-Query-Table
Parameters:
  table_name: cmdb_rel_ci
  query: parent=<ci_sys_id>^ORtype_id.name=Depends on::Used by
  fields: sys_id,parent,child,type_id
  limit: 20
```

**Related Knowledge Articles:**
```
Tool: SN-Query-Table
Parameters:
  query: workflow_state=published^123TEXTQUERY321=<short_description>
  table_name: kb_knowledge
  limit: 5
```

**Associated Change Requests:**
```
Tool: SN-Query-Table
Parameters:
  table_name: change_request
  query: cmdb_ci=<ci_sys_id>^state!=closed^ORstate=closed^closed_at>javascript:gs.daysAgo(7)
  fields: sys_id,number,short_description,state,type,start_date,end_date,risk
  limit: 5
```

**Problem Records:**
```
Tool: SN-Query-Table
Parameters:
  table_name: problem
  query: sys_id=<problem_id>^ORcmdb_ci=<ci_sys_id>^active=true
  fields: sys_id,number,short_description,state,root_cause,workaround
  limit: 5
```

### Step 4: Analyze Historical Patterns

Find patterns from similar records in the past.

**Similar Past Incidents:**

**MCP Approach:**
```
Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: category=<category>^subcategory=<subcategory>^state=6^resolved_at>javascript:gs.daysAgo(180)
  fields: sys_id,number,short_description,resolved_at,resolution_code,close_notes,assigned_to,assignment_group,calendar_duration
  limit: 25
```

**Aggregate Statistics:**

**REST Approach:**
```
GET /api/now/stats/incident
  ?sysparm_query=category=<category>^subcategory=<subcategory>^resolved_at>javascript:gs.daysAgo(180)
  &sysparm_avg_fields=calendar_duration,reassignment_count
  &sysparm_count=true
```

Build pattern analysis:
```
=== PATTERN ANALYSIS ===
Based on 47 similar incidents (same category/subcategory, last 180 days):

Resolution Statistics:
- Average Resolution Time: 4.2 hours
- Median Resolution Time: 2.8 hours
- 90th Percentile: 12 hours
- Current Incident Age: 1.5 hours (below average)

Common Resolution Methods:
1. Service restart (42%) - Average 1.5 hours
2. Configuration change (28%) - Average 3.2 hours
3. Vendor escalation (18%) - Average 18 hours
4. Patch deployment (12%) - Average 8 hours

Assignment Patterns:
- Most frequently resolved by: Network Operations (38%)
- Second: Application Support (25%)
- Current assignment: Database Team (resolves 15% of similar incidents)

Recurrence:
- Same CI has had 3 similar incidents in 90 days
- Same category averages 8 incidents per month
```

### Step 5: Assess Risk Factors

Evaluate current risk indicators for the record.

**SLA Status:**

**MCP Approach:**
```
Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: task=<record_sys_id>
  fields: sys_id,sla,stage,has_breached,planned_end_time,percentage,business_percentage
  limit: 5
```

**Escalation Risk:**
```
=== RISK ASSESSMENT ===

SLA Risk:
- Response SLA: 45% elapsed, 55% remaining (ON TRACK)
- Resolution SLA: 35% elapsed, target in 6.5 hours (ON TRACK)
- Breach Probability: 15% (based on similar incident resolution times)

Escalation Indicators:
- VIP Caller: No
- Business-Critical CI: Yes (production database)
- Priority: P2 (escalation at 4 hours if unresolved)
- Current Age: 1.5 hours
- Reassignment Count: 0 (good)

Impact Assessment:
- Affected Users: ~200 (based on CI dependency mapping)
- Dependent Services: 3 (Order Processing, Reporting, Auth)
- Business Impact: Medium-High (production service, business hours)
- Revenue Impact: Potential (Order Processing affected)
```

### Step 6: Generate Recommended Actions

Based on all gathered context, recommend next steps.

```
=== RECOMMENDED ACTIONS ===
Record: INC0067890 - Database connection pool exhaustion

IMMEDIATE ACTIONS:
1. [HIGH PRIORITY] Check current connection pool status
   - Similar incidents resolved 42% of the time by service restart
   - Run diagnostic: Query connection pool metrics via monitoring API

2. [RECOMMENDED] Review recent changes on this CI
   - CHG0012340 was implemented 2 hours ago on related app server
   - Potential correlation with incident timing

3. [SUGGESTED] Engage Network Operations
   - This team resolves 38% of similar incidents (highest rate)
   - Current team (Database) resolves 15% of similar incidents

KNOWLEDGE RESOURCES:
4. Review KB0012345: "Database Connection Pool Troubleshooting"
   - Rating: 4.5/5, used to resolve 12 similar incidents
   - Key procedure: Connection pool drain and restart (Section 3)

5. Review KB0013001: "Application Server Health Checks"
   - Related to recent change CHG0012340

PREVENTIVE ACTIONS:
6. Create Problem record to investigate recurrence
   - 3 similar incidents on this CI in 90 days suggests systemic issue
   - Link to existing Problem PRB0004567 if related

COMMUNICATION:
7. Notify affected service owners
   - Order Processing team (primary dependency)
   - Send proactive status update via major incident channel
```

### Step 7: Cross-Module Enrichment

Pull contextual data from other ServiceNow modules.

**Customer Context (for CSM cases):**

**MCP Approach:**
```
Tool: SN-Query-Table
Parameters:
  table_name: sn_customerservice_case
  query: account=<account_sys_id>^active=true
  fields: sys_id,number,short_description,priority,state,product
  limit: 10
```

**HR Context (for employee-related records):**
```
Tool: SN-Query-Table
Parameters:
  table_name: sn_hr_core_case
  query: subject_person=<caller_sys_id>^active=true
  fields: sys_id,number,short_description,hr_service,state
  limit: 5
```

**CMDB Asset Context:**
```
Tool: SN-Query-Table
Parameters:
  table_name: alm_hardware
  query: ci=<ci_sys_id>
  fields: sys_id,display_name,model,serial_number,warranty_expiration,install_status,cost
  limit: 1
```

### Step 8: Compile the AI Lens View

Assemble all insights into a comprehensive contextual panel:

```
=== AI LENS: INC0067890 ===
Database Connection Pool Exhaustion on prod-db-01

--- Quick Stats ---
Age: 1h 30m | Priority: P2 | SLA: On Track (65% remaining)
Similar Incidents (180d): 47 | Avg Resolution: 4.2h
Recurrence on this CI: 3 in 90 days (FLAGGED)

--- Related Records ---
Active on Same CI:
  - INC0067885 (P3, monitoring alert - auto-resolved)
  - CHG0012340 (Normal, app server config - completed 2h ago) *CORRELATION*

Known Problems:
  - PRB0004567: Recurring connection pool issues (Under Investigation)

Knowledge:
  - KB0012345: Connection Pool Troubleshooting (4.5 stars, 12 resolves)
  - KB0013001: App Server Health Checks (relevant to recent change)

--- Insights ---
1. Recent change CHG0012340 correlates with incident timing -- investigate
2. Connection pool issues are recurring (3 in 90 days) -- systemic root cause likely
3. Service restart resolves 42% of similar incidents -- try first
4. Current team assignment may not be optimal -- Network Ops has higher success rate

--- Recommended Actions ---
1. Check connection pool metrics [Most Likely Resolution: Service Restart]
2. Investigate correlation with CHG0012340 [Change-Related Root Cause]
3. Consider reassignment to Network Operations [Higher Success Rate]
4. Create/link to Problem PRB0004567 [Prevent Recurrence]
```

### Step 9: Track Lens Usage and Effectiveness

Monitor how AI Lens recommendations are used.

**MCP Approach:**
```
Tool: SN-Create-Record
Parameters:
  table_name: u_ai_lens_usage
  data:
    u_record: "<record_sys_id>"
    u_table: "incident"
    u_recommendations_shown: 4
    u_recommendation_followed: ""
    u_user: "<current_user_sys_id>"
    u_timestamp: "2025-12-10 04:00:00"
```

### Step 10: Provide Lens for List Views

Generate aggregate insights for a list of records.

**MCP Approach:**
```
Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: assignment_group=<group_sys_id>^active=true^ORDERBYpriority
  fields: sys_id,number,short_description,priority,state,opened_at,cmdb_ci,category
  limit: 50
```

```
=== AI LENS: Team Queue Overview ===
Team: Database Administration | Active Incidents: 12

Queue Health:
- P1: 0 | P2: 2 | P3: 7 | P4: 3
- SLA At Risk: 1 (INC0067888 - 85% elapsed)
- Avg Age: 3.2 days | Oldest: 8 days (INC0067500)
- Reassignment Rate: 15% (below team average of 22%)

Patterns Detected:
- 4 incidents related to "connection pool" on database CIs (cluster)
- 3 incidents from same caller (possible systemic issue for that user)
- 2 incidents linked to CHG0012340 (change correlation)

Priority Actions:
1. Address SLA-at-risk incident INC0067888 immediately
2. Investigate connection pool cluster (4 incidents) as potential problem
3. Contact repeat caller to address underlying issue
```

## Tool Usage

| Tool | Purpose | When to Use |
|------|---------|-------------|
| SN-Get-Record | Retrieve target record details | Initial context gathering |
| SN-Query-Table | Fetch related records, history, patterns | Cross-module data retrieval |
| SN-Natural-Language-Search | Find knowledge articles by similarity | Knowledge recommendation |
| SN-Update-Record | Save lens insights to record | Persisting recommendations |
| SN-Get-Table-Schema | Discover available fields and references | Understanding record structure |

## Best Practices

1. **Prioritize actionable insights** -- surface what the user can act on, not just information
2. **Show evidence for every insight** -- link claims to data (e.g., "42% resolution rate based on 47 incidents")
3. **Highlight correlations** -- recent changes, recurring patterns, and related records are high-value
4. **Respect performance** -- limit queries to relevant time windows and record counts
5. **Adapt to record type** -- incident lens differs from change request lens or HR case lens
6. **Flag anomalies** -- unusual patterns (high reassignment, repeat caller, rapid reopen) deserve attention
7. **Include knowledge proactively** -- always search for relevant KB articles
8. **Show SLA context** -- time remaining and breach probability are critical for task records
9. **Cross-reference CMDB** -- CI dependencies reveal blast radius and root cause connections
10. **Support both form and list views** -- individual record insights and queue-level patterns serve different needs

## Troubleshooting

| Issue | Cause | Resolution |
|-------|-------|------------|
| No related records found | CI field is empty on the record | Fall back to category-based and description-based similarity |
| Pattern analysis slow | Too many historical records queried | Narrow time window (90 days instead of 365) and add category filter |
| Knowledge results irrelevant | Short description too vague | Combine short_description with category for better NL search |
| CMDB relationships missing | CI not in CMDB or relationships not mapped | Use `cmdb_ci` table directly for basic CI info |
| SLA records absent | No SLA definitions for this record type | Skip SLA section and note in output |
| Cross-module data inaccessible | Role restrictions on other module tables | Limit lens to accessible tables based on user roles |

## Examples

### Example 1: Incident Form AI Lens

**Input:** "Show AI Lens for INC0067890"

**Steps:** Retrieve incident, query related incidents on same CI, fetch CMDB dependencies, find knowledge articles, analyze historical patterns, assess SLA risk, generate recommended actions.

### Example 2: CSM Case AI Lens

**Input:** "Analyze case CS0034567 with AI Lens"

**Steps:** Retrieve case, pull customer account history, find similar cases by product/category, check for known issues or outages, retrieve customer sentiment trend, recommend response strategy.

### Example 3: Queue-Level AI Lens

**Input:** "Show AI Lens for the Network Operations incident queue"

**Steps:** Query all active incidents for the group, aggregate by priority/category/age, identify clusters and patterns, flag SLA risks, detect repeat issues, generate queue management recommendations.

## Related Skills

- `itsm/incident-activity-summarization` - Detailed activity summaries for individual incidents
- `genai/playbook-recommendations` - Match records to automation playbooks
- `cmdb/impact-analysis` - CI dependency and impact analysis
- `knowledge/content-recommendation` - Knowledge article recommendations
- `reporting/trend-analysis` - Historical trend analysis and reporting
- `itsm/incident-triage` - Incident classification and routing