ai-lens

ServiceNow AI Lens

概述

AI Lens 可为任何 ServiceNow 记录提供上下文智能，呈现表单或列表视图中无法立即看到的洞察：

• 相关信息：关联记录、上游／下游依赖项以及相关知识
• 模式分析：类似记录的历史趋势、反复出现的问题和异常检测
• 风险评估：SLA 风险、升级可能性和潜在业务影响
• 建议操作：根据记录状态、历史记录和同类分析推荐的下一步最佳操作
• 跨模块上下文：来自 ITSM、CSM、HRSD、CMDB 和其他模块的信息，可帮助加深理解
• 预测性洞察：预计解决时间、可能的分配对象和可能的根本原因

**适用场景：**当 Agent、经理或分析师需要全面了解任何记录的上下文，且所需信息超出标准表单中可见的内容时，或在构建 AI 增强型工作区体验时。

先决条件

• 角色：itil、sn_customerservice_agent、sn_hr_core.case_reader 或 admin
• **插件：**平台基础功能（无需特定插件；利用现有模块数据）
• **访问权限：**对目标表和相关表（CMDB、知识、SLA）的读取权限
• **知识：**ServiceNow 跨模块数据模型、表之间的关系模式
• **相关技能：**用于活动上下文的 itsm/incident-activity-summarization，用于操作建议的 genai/playbook-recommendations

操作步骤

步骤 1：识别目标记录和表

确定用户正在查看的记录及其表上下文。

MCP 方法：

Tool: SN-Get-Record
Parameters:
  table_name: incident
  sys_id: <record_sys_id>
  fields: sys_id,sys_class_name,number,short_description,description,state,priority,impact,urgency,category,subcategory,assigned_to,assignment_group,opened_at,opened_by,caller_id,cmdb_ci,parent,caused_by,problem_id,rfc

REST 方法：

GET /api/now/table/incident/<record_sys_id>
  ?sysparm_fields=sys_id,sys_class_name,number,short_description,description,state,priority,impact,urgency,category,subcategory,assigned_to,assignment_group,opened_at,caller_id,cmdb_ci,problem_id,rfc
  &sysparm_display_value=true

步骤 2：发现用于上下文分析的表架构字段

了解此记录类型有哪些可用字段和引用字段。

MCP 方法：

Tool: SN-Get-Table-Schema
Parameters:
  table_name: incident

识别链接到其他表、可用于跨模块探索的引用字段。

步骤 3：呈现相关记录

查询通过引用关系、关联关系和共享属性与目标记录相关联的记录。

相关事件（相同 CI 或类别）：

MCP 方法：

Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: cmdb_ci=<ci_sys_id>^sys_id!=<current_sys_id>^active=true^ORDERBYDESCopened_at
  fields: sys_id,number,short_description,state,priority,opened_at,assigned_to
  limit: 10

CMDB 关系（上游／下游服务）：

Tool: SN-Query-Table
Parameters:
  table_name: cmdb_rel_ci
  query: parent=<ci_sys_id>^ORtype_id.name=Depends on::Used by
  fields: sys_id,parent,child,type_id
  limit: 20

相关知识文章：

Tool: SN-Query-Table
Parameters:
  query: workflow_state=published^123TEXTQUERY321=<short_description>
  table_name: kb_knowledge
  limit: 5

关联变更请求：

Tool: SN-Query-Table
Parameters:
  table_name: change_request
  query: cmdb_ci=<ci_sys_id>^state!=closed^ORstate=closed^closed_at>javascript:gs.daysAgo(7)
  fields: sys_id,number,short_description,state,type,start_date,end_date,risk
  limit: 5

问题记录：

Tool: SN-Query-Table
Parameters:
  table_name: problem
  query: sys_id=<problem_id>^ORcmdb_ci=<ci_sys_id>^active=true
  fields: sys_id,number,short_description,state,root_cause,workaround
  limit: 5

步骤 4：分析历史模式

从过去的类似记录中发现模式。

过去的类似事件：

MCP 方法：

Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: category=<category>^subcategory=<subcategory>^state=6^resolved_at>javascript:gs.daysAgo(180)
  fields: sys_id,number,short_description,resolved_at,resolution_code,close_notes,assigned_to,assignment_group,calendar_duration
  limit: 25

汇总统计：

REST 方法：

GET /api/now/stats/incident
  ?sysparm_query=category=<category>^subcategory=<subcategory>^resolved_at>javascript:gs.daysAgo(180)
  &sysparm_avg_fields=calendar_duration,reassignment_count
  &sysparm_count=true

构建模式分析：

=== PATTERN ANALYSIS ===
Based on 47 similar incidents (same category/subcategory, last 180 days):

Resolution Statistics:
- Average Resolution Time: 4.2 hours
- Median Resolution Time: 2.8 hours
- 90th Percentile: 12 hours
- Current Incident Age: 1.5 hours (below average)

Common Resolution Methods:
1. Service restart (42%) - Average 1.5 hours
2. Configuration change (28%) - Average 3.2 hours
3. Vendor escalation (18%) - Average 18 hours
4. Patch deployment (12%) - Average 8 hours

Assignment Patterns:
- Most frequently resolved by: Network Operations (38%)
- Second: Application Support (25%)
- Current assignment: Database Team (resolves 15% of similar incidents)

Recurrence:
- Same CI has had 3 similar incidents in 90 days
- Same category averages 8 incidents per month

步骤 5：评估风险因素

评估记录当前的风险指标。

SLA 状态：

MCP 方法：

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: task=<record_sys_id>
  fields: sys_id,sla,stage,has_breached,planned_end_time,percentage,business_percentage
  limit: 5

升级风险：

=== RISK ASSESSMENT ===

SLA Risk:
- Response SLA: 45% elapsed, 55% remaining (ON TRACK)
- Resolution SLA: 35% elapsed, target in 6.5 hours (ON TRACK)
- Breach Probability: 15% (based on similar incident resolution times)

Escalation Indicators:
- VIP Caller: No
- Business-Critical CI: Yes (production database)
- Priority: P2 (escalation at 4 hours if unresolved)
- Current Age: 1.5 hours
- Reassignment Count: 0 (good)

Impact Assessment:
- Affected Users: ~200 (based on CI dependency mapping)
- Dependent Services: 3 (Order Processing, Reporting, Auth)
- Business Impact: Medium-High (production service, business hours)
- Revenue Impact: Potential (Order Processing affected)

步骤 6：生成建议操作

根据收集到的所有上下文，建议后续步骤。

=== RECOMMENDED ACTIONS ===
Record: INC0067890 - Database connection pool exhaustion

IMMEDIATE ACTIONS:
1. [HIGH PRIORITY] Check current connection pool status
   - Similar incidents resolved 42% of the time by service restart
   - Run diagnostic: Query connection pool metrics via monitoring API

2. [RECOMMENDED] Review recent changes on this CI
   - CHG0012340 was implemented 2 hours ago on related app server
   - Potential correlation with incident timing

3. [SUGGESTED] Engage Network Operations
   - This team resolves 38% of similar incidents (highest rate)
   - Current team (Database) resolves 15% of similar incidents

KNOWLEDGE RESOURCES:
4. Review KB0012345: "Database Connection Pool Troubleshooting"
   - Rating: 4.5/5, used to resolve 12 similar incidents
   - Key procedure: Connection pool drain and restart (Section 3)

5. Review KB0013001: "Application Server Health Checks"
   - Related to recent change CHG0012340

PREVENTIVE ACTIONS:
6. Create Problem record to investigate recurrence
   - 3 similar incidents on this CI in 90 days suggests systemic issue
   - Link to existing Problem PRB0004567 if related

COMMUNICATION:
7. Notify affected service owners
   - Order Processing team (primary dependency)
   - Send proactive status update via major incident channel

步骤 7：丰富跨模块上下文

从其他 ServiceNow 模块获取上下文数据。

客户上下文（适用于 CSM 案例）：

MCP 方法：

Tool: SN-Query-Table
Parameters:
  table_name: sn_customerservice_case
  query: account=<account_sys_id>^active=true
  fields: sys_id,number,short_description,priority,state,product
  limit: 10

HR 上下文（适用于员工相关记录）：

Tool: SN-Query-Table
Parameters:
  table_name: sn_hr_core_case
  query: subject_person=<caller_sys_id>^active=true
  fields: sys_id,number,short_description,hr_service,state
  limit: 5

CMDB 资产上下文：

Tool: SN-Query-Table
Parameters:
  table_name: alm_hardware
  query: ci=<ci_sys_id>
  fields: sys_id,display_name,model,serial_number,warranty_expiration,install_status,cost
  limit: 1

步骤 8：汇总 AI Lens 视图

将所有洞察整合到全面的上下文面板中：

=== AI LENS: INC0067890 ===
Database Connection Pool Exhaustion on prod-db-01

--- Quick Stats ---
Age: 1h 30m | Priority: P2 | SLA: On Track (65% remaining)
Similar Incidents (180d): 47 | Avg Resolution: 4.2h
Recurrence on this CI: 3 in 90 days (FLAGGED)

--- Related Records ---
Active on Same CI:
  - INC0067885 (P3, monitoring alert - auto-resolved)
  - CHG0012340 (Normal, app server config - completed 2h ago) *CORRELATION*

Known Problems:
  - PRB0004567: Recurring connection pool issues (Under Investigation)

Knowledge:
  - KB0012345: Connection Pool Troubleshooting (4.5 stars, 12 resolves)
  - KB0013001: App Server Health Checks (relevant to recent change)

--- Insights ---
1. Recent change CHG0012340 correlates with incident timing -- investigate
2. Connection pool issues are recurring (3 in 90 days) -- systemic root cause likely
3. Service restart resolves 42% of similar incidents -- try first
4. Current team assignment may not be optimal -- Network Ops has higher success rate

--- Recommended Actions ---
1. Check connection pool metrics [Most Likely Resolution: Service Restart]
2. Investigate correlation with CHG0012340 [Change-Related Root Cause]
3. Consider reassignment to Network Operations [Higher Success Rate]
4. Create/link to Problem PRB0004567 [Prevent Recurrence]

步骤 9：跟踪 Lens 的使用情况和有效性

监控 AI Lens 建议的使用情况。

MCP 方法：

Tool: SN-Create-Record
Parameters:
  table_name: u_ai_lens_usage
  data:
    u_record: "<record_sys_id>"
    u_table: "incident"
    u_recommendations_shown: 4
    u_recommendation_followed: ""
    u_user: "<current_user_sys_id>"
    u_timestamp: "2025-12-10 04:00:00"

步骤 10：为列表视图提供 Lens

为记录列表生成汇总洞察。

MCP 方法：

Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: assignment_group=<group_sys_id>^active=true^ORDERBYpriority
  fields: sys_id,number,short_description,priority,state,opened_at,cmdb_ci,category
  limit: 50

=== AI LENS: Team Queue Overview ===
Team: Database Administration | Active Incidents: 12

Queue Health:
- P1: 0 | P2: 2 | P3: 7 | P4: 3
- SLA At Risk: 1 (INC0067888 - 85% elapsed)
- Avg Age: 3.2 days | Oldest: 8 days (INC0067500)
- Reassignment Rate: 15% (below team average of 22%)

Patterns Detected:
- 4 incidents related to "connection pool" on database CIs (cluster)
- 3 incidents from same caller (possible systemic issue for that user)
- 2 incidents linked to CHG0012340 (change correlation)

Priority Actions:
1. Address SLA-at-risk incident INC0067888 immediately
2. Investigate connection pool cluster (4 incidents) as potential problem
3. Contact repeat caller to address underlying issue

工具使用

工具	用途	使用时机
SN-Get-Record	获取目标记录详情	初始上下文收集
SN-Query-Table	获取相关记录、历史记录和模式	检索跨模块数据
SN-Natural-Language-Search	按相似度查找知识文章	知识推荐
SN-Update-Record	将 Lens 洞察保存到记录	持久化建议
SN-Get-Table-Schema	发现可用字段和引用字段	了解记录结构

最佳实践

1. 优先提供可执行的见解 —— 展示用户可以采取行动的内容，而不只是信息
2. 为每条见解提供证据 —— 将观点与数据关联（例如，“基于 47 起事件的解决率为 42%”）
3. 突出相关性 —— 近期变更、重复模式和相关记录具有很高价值
4. 兼顾性能 —— 将查询限制在相关时间范围和记录数量内
5. 根据记录类型调整 —— 事件视角不同于变更请求视角或 HR 案例视角
6. 标记异常情况 —— 不寻常的模式（频繁转派、重复来电者、短时间内重新打开）值得关注
7. 主动纳入知识 —— 始终搜索相关知识库文章
8. 展示 SLA 上下文 —— 对于任务记录，剩余时间和违约概率至关重要
9. 交叉引用 CMDB —— CI 依赖关系可以揭示影响范围和根因关联
10. 同时支持表单视图和列表视图 —— 单条记录的见解和队列级模式适用于不同场景

故障排除

问题	原因	解决方案
未找到相关记录	记录中的 CI 字段为空	改用基于类别和描述的相似度进行匹配
模式分析缓慢	查询的历史记录过多	缩短时间范围（从 365 天缩至 90 天），并添加类别筛选条件
知识搜索结果不相关	简短描述过于模糊	将 short_description 与类别结合，以改进自然语言搜索
缺少 CMDB 关系	CI 不在 CMDB 中或未映射关系	直接使用 cmdb_ci 表获取基本 CI 信息
缺少 SLA 记录	此记录类型没有 SLA 定义	跳过 SLA 部分，并在输出中注明
无法访问跨模块数据	其他模块表受到角色限制	根据用户角色，将视角限制在可访问的表上

示例

示例 1：事件表单 AI 视角

输入：“显示 INC0067890 的 AI 视角”

**步骤：**检索事件，查询同一 CI 上的相关事件，获取 CMDB 依赖关系，查找知识文章，分析历史模式，评估 SLA 风险，并生成建议操作。

示例 2：CSM 案例 AI 视角

输入：“使用 AI 视角分析案例 CS0034567”

**步骤：**检索案例，获取客户账户历史记录，按产品／类别查找类似案例，检查已知问题或服务中断，获取客户情绪趋势，并建议响应策略。

示例 3：队列级 AI 视角

输入：“显示 Network Operations 事件队列的 AI 视角”

**步骤：**查询该组的所有活动事件，按优先级／类别／时长汇总，识别聚类和模式，标记 SLA 风险，检测重复问题，并生成队列管理建议。

相关技能

• itsm/incident-activity-summarization - 生成单个事件的详细活动摘要
• genai/playbook-recommendations - 将记录与自动化操作手册匹配
• cmdb/impact-analysis - CI 依赖关系和影响分析
• knowledge/content-recommendation - 推荐知识文章
• reporting/trend-analysis - 历史趋势分析和报告
• itsm/incident-triage - 事件分类和路由