ServiceNow Security Incident Automation Lab
Independent Project / Cybersecurity / Security Operations / Incident Response / Workflow Automation
A recruiter-facing defensive security operations portfolio lab demonstrating synthetic incident intake, deterministic priority scoring, SLA management and escalation, guardrailed response automation, human approvals, evidence tracking, audit history, and advisory-only simulated AI triage.
Problem or objective
Security operations teams need incident intake, prioritization, SLA tracking, and response automation that is consistent, explainable, and auditable. Without deterministic scoring and human approval gates, triage decisions vary by analyst and cannot be reviewed after the fact.
Rachel's role
Sole designer and full-stack builder responsible for the incident data model, deterministic priority scoring, SLA and escalation logic, guardrailed automation playbooks, approval workflow, evidence and audit design, dashboards, testing, and public documentation.
Process
- 01Security operations requirements and recruiter-facing positioning
- 02Synthetic incident, host, identity, and detection fixture design
- 03Deterministic priority scoring model
- 04SLA clocks, breach thresholds, and escalation routing
- 05Guardrailed automation playbooks with human approval gates
- 06Evidence capture and append-only audit history
- 07Advisory-only simulated AI triage suggestions
- 08Executive overview, metrics, and reporting views
- 09Testing, typecheck, lint, and production build verification
Architecture components
Intake and detection
- Synthetic detection sources
- Incident intake normalization
- Typed incident fixtures
Triage engine
- Deterministic priority scoring
- Severity and impact weighting
- Advisory simulated AI triage
SLA and escalation
- SLA clocks per priority
- Breach thresholds
- Escalation routing
Response and approvals
- Guardrailed automation playbooks
- Human approval gates
- Response task tracking
Accountability
- Evidence records
- Append-only audit history
- Metrics and reporting
Case study
Business problem
Security operations teams handle high alert volume with inconsistent triage, unclear SLA ownership, and automation that is either unsafe or unused. This lab shows a workflow where every incident is scored the same way, tracked against an SLA, and acted on only through approved, guardrailed steps.
Incident triage and deterministic priority scoring
- Synthetic incidents normalized from simulated detection sources
- Priority derived from weighted severity, asset criticality, and exposure inputs
- Scoring is deterministic and transparent, so two analysts reach the same result
- Scores drive queue ordering rather than analyst preference
SLA and escalation model
- SLA clocks assigned per priority band at intake
- Breach thresholds with visible at-risk and breached states
- Escalation routing when a clock crosses its threshold
- SLA state surfaced on the executive overview and queue views
Guardrailed automation and human approval
- Response playbooks defined as explicit, reviewable steps
- Impactful actions require a human approval gate before execution
- Simulated execution only; no live containment, isolation, or account action
- Approval decisions recorded with the incident they belong to
Evidence and audit design
- Evidence records attached to incidents and response tasks
- Append-only audit history of triage, approvals, and automation events
- Timeline reconstruction for after-action review
- Reporting views summarizing volume, priority mix, and SLA performance
Responsible AI and advisory-only simulated triage
- Simulated AI triage produces suggestions, never decisions
- No autonomous closure, escalation, or containment
- Suggestions are labeled as simulated and non-authoritative in the interface
- Human accountability retained at every decision point
Architecture and production boundaries
- Implemented: synthetic fixtures, deterministic scoring, SLA and escalation logic, playbooks with approvals, evidence and audit history, dashboards, documentation, and tests
- Production would require real ServiceNow, SIEM, EDR, and identity-provider integrations
- Production would require authentication, role-based authorization, and protected secrets
- Production would require persistent storage and monitored, tamper-evident audit infrastructure
- Production would require operational runbooks and named owners for every automated action
Engineering quality
- TypeScript, React, and TanStack Start with typed domain modules
- Vitest suite green at 44 of 44 passing
- Typecheck clean with 0 errors
- Lint clean with 0 errors
- Successful production build
- 11 application routes verified
Tools and technologies
- TypeScript
- React
- TanStack Start
- Tailwind CSS
- Vitest
- Security Operations
- Incident Response
- SLA Management
- Security Automation
- Human-in-the-Loop AI
- Audit Evidence
Security and ethical considerations
- Synthetic incidents, hosts, identities, detections, and evidence only; no live ServiceNow, SIEM, EDR, or identity-provider systems connected
- Automation is guardrailed: no destructive action executes without an explicit human approval step
- Simulated AI triage is advisory only and never auto-closes or auto-escalates an incident
- Deterministic, explainable priority scoring so triage decisions can be reviewed and repeated
- Evidence and audit history designed for after-action review and accountability
- No secrets, credentials, or environment configuration in the public repository
Outcome
A public, documented security operations lab covering intake, deterministic triage, SLA escalation, guardrailed automation, approvals, and audit evidence, verified at 44 of 44 automated tests passing, typecheck clean with 0 errors, lint clean with 0 errors, a successful production build, and 11 application routes verified.
Portfolio lab using synthetic data only. All incidents, identities, hosts, detections, integrations, evidence, and operational data are synthetic or simulated. No live ServiceNow, SIEM, EDR, or identity-provider systems are connected. This project is not affiliated with, sponsored by, or endorsed by ServiceNow.