Build Flow — example output

███╗ ██╗ ██████╗ ██╗ ██╗ █████╗ ██╗ ██╗ ██╗██╗████████╗ ████╗ ██║██╔═══██╗██║ ██║ ██╔══██╗██║ ██║ ██╔╝██║╚══██╔══╝ ██╔██╗██║██║ ██║██║ █╗ ██║ ███████║██║ █████╔╝ ██║ ██║ ██║╚████║██║ ██║██║███╗██║ ██╔══██║██║ ██╔═██╗ ██║ ██║ ██║ ╚███║╚██████╔╝╚███╔███╔╝ ██║ ██║██║ ██║ ██╗██║ ██║ ╚═╝ ╚══╝ ╚═════╝ ╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ✦ NowAIKit — The #1 AI App for ServiceNow - Running build-flow in direct mode (ollama)... # Flow Designer Build Report ## Step 1 — Understand the Requirement ### Analysis Based on the ServiceNow instance data provided, I notice the following patterns: Existing Flow Patterns: - Security Operations (Exchange Integration, Threat Lookups) - ITIL/Incident Management (On-Call Notifications, Flag Work Orders) - GRC/Privacy (Control mapping, Data subject type mapping) - Change Management (Remediation Change Triggers) - Service Catalog (Provisioning updates) Business Rules on Key Tables: - `sn_grc_metric_definition` - GRC metrics - `sn_ent_model` - Enterprise models - `sn_ti_m2m_task_attack_mode` - Threat intelligence tasks - `sys_properties` - System properties - `sn_vul_app_vulnerability` - Vulnerability management ### ⚠️ Requirement Not Provided No specific requirement was included in this request. To demonstrate the Flow Designer capability, I will create a sample flow that complements the existing security operations architecture. Assumed Requirement: > "When an Incident is marked as 'Critical' and involves a security-related category, automatically notify SOC team, create tracking tasks, and initiate threat lookup procedures." --- ## Step 2 — Check Existing Flows for Conflicts ### Existing Flow Analysi✔ Capability completed (2 data points gathered) # Flow Designer Build Report ## Analysis Summary I've reviewed the ServiceNow instance data from "demo2" and identified existing flows and business rules. However, no specific requirement was provided for the new flow to build. Based on the existing flow patterns in the instance, I'll create a representative example flow that aligns with the operational patterns observed: Observation: The instance contains 50+ active flows with patterns including: - Security operations integrations - Azure/Azure AD catalog task processing - On-call notification flows - Incident/task automation Recommendation: I will build an example "Security Incident Auto-Assignment and Escalation" flow that demonstrates the capability. This aligns with patterns like "Security Operations Microsoft Exchange Integration" and "On-Call: Send Notification - Email" that exist in the instance. --- # STEP 1 — Requirement Analysis ``` REQUIREMENT: Create an automated flow that handles security incidents with the following behavior: 1. Trigger: When a new incident (sn_incident) is created with: - State = "New" OR State changes to "Work in Progress" - Short Description contains "Security", "Threat", "Breach", "Virus", "Malware", "Phish" - Category = "Security" (if available) 2. Actions to perform: - Look up assigned security team member based on incident category/region - Auto-assign incident to appropriate security engineer - Set priority to "2" (High) for all security-related incidents - Create a watchlist ticket if threat indicators detected - Send notification to security operations manager - Create incident notes documenting automated assignment 3. Expected outcome: - All security incidents automatically assigned and prioritized - Notifications sent to appropriate stakeholders - Watchlist created for threat indicators - Full audit trail maintained 4. Error scenarios: - No security team member available → Log error, notify manager - REST call to threat feed fails → Retry 3 times, then fail gracefully - Notification fails → Log error, mark incident for manual review ``` Trigger Type Validation: ✓ `record` trigger is appropriate — incidents are created/updated on user activity, not scheduled events. --- # STEP 2 — Conflict Check ``` EXISTING FLOWS ANALYSIS: ┌─────────────────────────────────────────────────────────────┐ │ Flow Name │ ├─────────────────────────────────────────────────────────────┤ │ 1. Threat Lookups for Observables - ESCM Activity │ │ - Related: Security/Threat monitoring │ │ - No conflict with new flow │ │ - Complementary (threat detection vs incident response) │ ├─────────────────────────────────────────────────────────────┤ │ 2. Security Operations Microsoft Exchange Integration │ │ - Related: Email-based security alerts │ ... (400 more lines — full output truncated for screenshot)