Role: ServiceNow Developer / Architect
Scope: Custom Scoped Application (x_1183354_resili)
Type: Governance, Risk, and Compliance (GRC) / SecOps
ResilienceOS is a custom ServiceNow application designed to solve "Alert Fatigue" and "Governance Drift" in enterprise infrastructure.
Unlike standard ticketing tools that simply log errors, ResilienceOS uses an "Ingest -> Intelligence -> Governance -> Action" architecture. It automatically ingests raw server alerts, calculates a confidence score to determine if an issue is real, enforces strict process governance, and triggers self-healing remediation—all in milliseconds.
The application follows a strict data pipeline:
- Ingestion (REST API): Decouples monitoring tools from the ServiceNow instance.
- Intelligence (Logic Engine): Parses unstructured data to assign risk.
- Governance (Validation): Prevents human error and SLA manipulation.
- Remediation (Flow Designer): Orchestrates the fix.
- Endpoint:
/api/x_1183354/ingest - Function: Accepts raw JSON payloads from external monitoring tools (e.g., SolarWinds, Datadog).
- Defensive Coding: Includes
try/catchblocks and input validation to ensure bad data does not corrupt the database.
- The Constraint: As this is built on a Personal Developer Instance (PDI), Now Assist (GenAI) licenses were unavailable.
- The Solution: I architected a Deterministic Logic Engine using advanced Business Rules to simulate the decision-making of an AI.
- Mechanism: The system parses error patterns (e.g.,
OutOfMemoryErrorvs.DiskLatency), calculates a Confidence Score (0-100), and assigns a remediation path. This mocks the classification result of an LLM to drive downstream automation.
- Problem: In many organizations, analysts manually downgrade "High Risk" items to "Triage" to pause SLA clocks.
- Solution: A Validation Business Rule acts as a guardrail.
- Scenario: If a user attempts to change the status of a High Confidence (>90) item back to "Analyzing", the system rejects the update with a governance violation error.
- Scenario: If a user attempts to force "Auto-Fixing" on a Low Confidence (<50) item, the system blocks the action to prevent dangerous automated changes on uncertain data.
- Trigger: Records entering the
Auto-Fixingstate. - Action: A Flow Designer workflow executes immediately (38ms execution time).
- MVP Implementation: Simulates an API call to an orchestration tool (like Ansible or SCCM) to patch the server, then automatically closes the ticket with a timestamped audit trail.
| Component | Technology Used |
|---|---|
| Application Scope | Custom Scoped App (x_1183354_resili) |
| Database | Custom Table (x_1183354_resili_0_resilience_alert) |
| Server-Side Logic | Scripted REST APIs, Advanced Business Rules |
| Automation | Flow Designer |
| Data Integrity | parseInt() sanitization, Enforced State Flows |
System Processing: Intelligence: Detects "Heap Space" -> Assigns Score: 98 -> Sets Status: Auto-Fixing. Governance: Validates Score > 90. Allows automation. Action: Triggers Flow.
Output (Audit Log): "2026-01-05 15:27:29 - System Administrator: Auto-Fix executed successfully. Server rebooted. Closing ticket."
Provides real-time visibility into Alert Fatigue reduction, auto-fix rates, and source system metrics.
Custom API endpoint designed to ingest signals from AWS, Datadog, and SolarWinds. Includes payload parsing and error handling.
Closed-loop remediation flow. The system evaluates the "Confidence Score" before attempting an auto-fix. If the score is low, it branches to human review.
Built-in safety rails prevent automation on low-confidence items. The system adheres to strict governance rules to prevent "flapping" or incorrect fixes.
If automation is blocked due to safety thresholds, the analyst is notified immediately with the specific reason.
1. Input (JSON sent via Postman):
{
"server": "DE-BER-01",
"error": "Java Heap Space OutOfMemoryError",
"source": "SolarWinds"
}