Data Sources for eDiscovery Professionals
ServiceNow
Company Snapshot
ServiceNow, Inc. (NYSE: NOW) is a leading digital‑workflow and AI‑platform company that enables enterprises to streamline IT, employee, and customer workflows. In its Q1 FY 2025 results, ServiceNow reported $3.09 billion in total revenue (subscription revenue $3.01 billion), representing 18–20 % year‑over‑year growth, and current remaining performance obligations of $10.31 billion
Origin
ServiceNow was founded in 2004 by former Peregrine Systems CTO Fred Luddy, who started coding the prototype on a single laptop at his San Diego home with a mission to “build a cloud‑based platform that would make work easier.” The fledgling company quickly attracted a handful of volunteers, relocated to Silicon Valley in 2006, and has since grown into a global enterprise serving more than 7,700 customers—including ~80 % of the Fortune 500.
The Now Platform
ServiceNow’s Now Platform is a multi‑tenant, metadata‑driven cloud architecture that unifies data, AI, and workflows across a single Common Service Data Model (CSDM). Key attributes relevant to eDiscovery:
- Single data schema across all applications, enabling straightforward joins and lineage.
- Row‑level auditing—every record insert/update/delete is captured in immutable sys_audit tables.
- REST/SOAP, GraphQL, and JDBC interfaces plus 1,500+ IntegrationHub spokes for turnkey connectors.
Extracting ServiceNow Data for Investigation
| Scheduled Export Sets (Admin > Export Sets > Schedule Export) | Full‑table CSV or XML snapshots on a recurring scheduleFull‑table CSV or XML snapshots on a recurring schedule | Medium–High | Add sys_id, created, and updated fields for defensible lineage. |
| CSV Web Service (table_name_list.do?CSV) | Ad‑hoc list or full table export in CSV | Low–High | Append sysparm_default_export_fields=all to include hidden fields such as sys_id. |
| REST Table API (/api/now/table/{table}) | JSON or XML for any table with filter & pagination | Variable | Ideal for incremental collections; capture sys_created_on > last_cursor. |
| Attachment API (/api/now/attachment/{sys_id}/file) | Binary files (images, PDFs, emails) linked to records | Low–Medium | Hash files on ingest; preserve content_type metadata. |
| System Logs Export (System Logs > All > Export) | Security & admin audit trails (CSV)Security & admin audit trails (CSV) | Low | Filter by date/IP; correlate with record changes for chain‑of‑custody. |
Preservation Note: ServiceNow instances may auto‑purge sys_log and sys_audit tables after 30–90 days. Implement early legal holds or clone the instance to sandbox for defensible preservation.
Common eDiscovery & Investigation Use Cases
- Incident‑related litigation – Pull ITSM incident records, chat transcripts, and attachments to reconstruct outage timelines.
- Employment disputes – Export HR Case (HRSD) tickets, Employee Center conversations, and audit logs to analyze workplace investigations.
- Data‑breach response – Mine Security Incident Response (SIR) records and attached containment/action artifacts.
- Regulatory audits – Document change‑control evidence via Change Request tables and sys_audit history for SOX/ISO 27001.
- Third‑party risk reviews – Analyze Vendor Risk Management (VRM) assessments, findings, and workflow comments.
Other Technologies in the ServiceNow-owned Portfolio
- Lightstep – Cloud‑native observability & APM
- Intellibot – Robotic process automation (RPA)
- Element AI – Enterprise AI research & tooling
- Hitch Works – Skills intelligence & talent mapping
- Era Software – Log management for observability
- Moveworks – Generative‑AI assistants for employee support