Contact Us

eDiscovery Collection for ServiceNow

Incident‑related litigation

Pull ITSM incident records, chat transcripts, and attachments to reconstruct outage timelines.

Employment Disputes

Export HR Case (HRSD) tickets, Employee Center conversations, and audit logs to analyze workplace investigations.

Data‑breach response

Mine Security Incident Response (SIR) records and attached containment/action artifacts.

Regulatory Audits

Document change‑control evidence via Change Request tables and sys_audit history for SOX/ISO 27001.

Third‑party risk reviews

Analyze Vendor Risk Management (VRM) assessments, findings, and workflow comments.

The Now Platform

ServiceNow’s Now Platform is a multi‑tenant, metadata‑driven cloud architecture that unifies data, AI, and workflows across a single Common Service Data Model (CSDM). Key attributes relevant to eDiscovery:

  • Single data schema across all applications, enabling straightforward joins and lineage.
  • Row‑level auditing—every record insert/update/delete is captured in immutable sys_audit tables.
  • REST/SOAP, GraphQL, and JDBC interfaces plus 1,500+ IntegrationHub spokes for turnkey connectors.

Extracting ServiceNow Data for Investigation​​

Scheduled Export Sets (Admin > Export Sets > Schedule Export)Full‑table CSV or XML snapshots on a recurring scheduleFull‑table CSV or XML snapshots on a recurring scheduleMedium–HighAdd sys_id, created, and updated fields for defensible lineage.
CSV Web Service (table_name_list.do?CSV)Ad‑hoc list or full table export in CSVLow–HighAppend sysparm_default_export_fields=all to include hidden fields such as sys_id.
REST Table API (/api/now/table/{table})JSON or XML for any table with filter & paginationVariableIdeal for incremental collections; capture sys_created_on > last_cursor.
Attachment API (/api/now/attachment/{sys_id}/file)Binary files (images, PDFs, emails) linked to recordsLow–MediumHash files on ingest; preserve content_type metadata.
System Logs Export (System Logs > All > Export)Security & admin audit trails (CSV)Security & admin audit trails (CSV)LowFilter by date/IP; correlate with record changes for chain‑of‑custody.

Preservation Note: ServiceNow instances may auto‑purge sys_log and sys_audit tables after 30–90 days. Implement early legal holds or clone the instance to sandbox for defensible preservation.

"Being able to filter and sift through these records so efficiently is an absolute game changer."
Happy Attorney
Big Law Firm

Company Snapshot

ServiceNow, Inc. (NYSE: NOW) is a leading digital‑workflow and AI‑platform company that enables enterprises to streamline IT, employee, and customer workflows. In its Q1 FY 2025 results, ServiceNow reported $3.09 billion in total revenue (subscription revenue $3.01 billion), representing 18–20 % year‑over‑year growth, and current remaining performance obligations of $10.31 billion

Origin

ServiceNow was founded in 2004 by former Peregrine Systems CTO Fred Luddy, who started coding the prototype on a single laptop at his San Diego home with a mission to “build a cloud‑based platform that would make work easier.” The fledgling company quickly attracted a handful of volunteers, relocated to Silicon Valley in 2006, and has since grown into a global enterprise serving more than 7,700 customers—including ~80 % of the Fortune 500.

Other Technologies in the ServiceNow-owned Portfolio

  • Lightstep – Cloud‑native observability & APM
  • Intellibot – Robotic process automation (RPA)
  • Element AI – Enterprise AI research & tooling
  • Hitch Works – Skills intelligence & talent mapping
  • Era Software – Log management for observability
  • Moveworks – Generative‑AI assistants for employee support