This article provides an approach to identifying all modifications that have been made to OOTB/Baseline records. Since such modifications lead to increased efforts during an upgrade, it is important to monitor them in order to be able to question them accordingly.

Data vs. Artifacts

In ServiceNow, there are basically two different types of tables: Those that inherit from the sys_metadata table and are commonly referred to as configuration data (e.g. Script Includes) and those that do not and are considered real data (e.g. Incidents). In the first case, I like to call the corresponding records "artifacts" to have a better distinction from the real data.

Customizations & skipped Records

A ServiceNow baseline instance ships with a ton of out-of-the-box (OOTB) artifacts, and each plugin or application adds to that inventory considerably. And in every ServiceNow project, sooner or later you will come to the point where changes to OOTB artifacts become necessary (e.g. modification of a Business Rule or simply deactivation of Email Notifications) to be able of fulfilling customer requirements accordingly.

There are various definitions of the word "customization", and I define a customization as a modification of an OOTB artifact. Each customization will cause a so-called "skipped record" in the next instance upgrade. That means these records are not overridden by ServiceNow, but marked for reviewing and thus requiring an action. This is fine if only a few records are skipped, but if you have several hundred records or more, then an instance upgrade can be turned into a single small project that consumes the appropriate resources.

Instance Scans for continuous Monitoring of Customizations

Responsible roles such as the platform architect or the platform owner therefore strive to keep the number of customizations as small as possible. For permanent control, Instance Scans are the perfect answer, but finding out what changed OOTB artifacts are is not that easy. I experimented around a bit and by combining two API methods I was able to find a working solution.

Technical Approach

In the following code the method getCustomizedBaselineRecordSysIDs() expects a GlideRecord object with an executed query. The API method new global.UpdateVersionAPI().getCustomerFileIds() will return an array with Sys IDs of all newly created custom artifacts. And after excluding these custom records, API method global.SncAppFiles.hasCustomerUpdate() can be used to check if any changes have been made to an artifact.

function getCustomizedBaselineRecordSysIDs(grTableRecords) {
    //determine all new custom records to exclude false positives
    var objUpdateVersionAPI     = new global.UpdateVersionAPI();
    var arrCustomRecordSysIDs   = objUpdateVersionAPI.getCustomerFileIds(grTableRecords);
    var arrChangedBaslineSysIDs = [];

    //move back the pointer to the beginning of the record set as the method
    //"getCustomerFileIds" is iterating the GlideRecord set
    grTableRecords.restoreLocation();

    while (grTableRecords.next()) {
        //was that record changed?
        if (global.SncAppFiles.hasCustomerUpdate(grTableRecords)) {
            var strSysID = grTableRecords.getValue('sys_id');

            //test whether the record is a newly created custom one
            if (arrCustomRecordSysIDs.indexOf(strSysID) == -1) {
                arrChangedBaslineSysIDs.push(strSysID);
            }
        }
    }

    return arrChangedBaslineSysIDs;
}

var grTableRecords = new GlideRecord('sysevent_email_action');

grTableRecords.query();

gs.info(getCustomizedBaselineRecordSysIDs(grTableRecords));

For use in an Instance Scan check, you cannot feed the records of all tables derived from sys_metadata, because that would take too long. Instead, you have to focus on the most important ones. For example, it may not make sense to scan the table sysevent_email_action from above code since you always have to adapt a lot of OOTB Email Notifications to the special requirements of the customer.

Further Readings

Configurations vs. Customizations:

Upgrades & Skipped Records