Automatically detect, link, and propose major case candidates with AI

 

Many teams already rely on Predictive Intelligence to surface potential major issues by clustering structured case data. Major Cases Similarity Search complements this with a semantic, AI Search-driven skill that reads and catches cases worded differently but describing the same underlying problem, and it covers more of the major case lifecycle: proposing new candidates, linking new cases to an already-accepted major case, and consolidating cases under a proposal that's still pending review.

 

Key Capabilities

 

Depending on where a support team is in the major case lifecycle, different possibilities are:

 

• No major case exists yet: As cases come in, the skill scans for patterns across them. If enough similarity is found, it proposes that a new major case be created.

• A major case is already accepted: The question shifts from "is this a new pattern" to "does this belong to something we already know about." New matching cases are recommended for linking as children of the existing major case.

• A major case has been proposed but not yet accepted: An incoming case that matches the proposal is consolidated under that pending candidate rather than triggering a separate one.

Catch the feature short here:

https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FYvSWA2qjrVY%3Ffeature%3Doembed&display_name=YouTube&url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DYvSWA2qjrVY&image=https%3A%2F%2Fi.ytimg.com%2Fvi%2FYvSWA2qjrVY%2Fhqdefault.jpg&type=text%2Fhtml&schema=youtube

 

Although the AI lies in the skill, the overall out-of-the-box capability works like an agentic flow, with a 3-pronged approach:

 

1. Skill: An AI skill called Major Cases Similarity Search semantically matches incoming cases against existing ones, using an AI Search profile with a semantic relevancy model, so it recognizes cases that mean the same thing even when they read differently.

2. Flow: A sub-flow (called 'Search similar major case' in the flow designer, part of the 'Major case agentic workflow' flow) triggers the skill automatically whenever a new case comes in, running two parallel branches of checks, one against existing major cases and one against other non-major cases, so no case handler has to remember to check for a pattern manually.

3. Governance: At the configuration level, an extension point (NowAssistMajorIssueExtPoint) decides what the skill's output should mean for your business. The skill might return a similarity score of 70%, but it's the extension point's configured threshold that decides whether that's enough to act on. The same applies to the minimum number of similar cases required before proposing a major case, five by default.

 

As a result, one of three things happens for any given case, mentioned above. 

 

Implementation

 

The Major Cases Similarity Search AI skill (as well as the sub-flow and the extension point) ships within the Now Assist (a.k.a ServiceNow Otto) for CSM Major Issue Management app, part of ServiceNow Otto for CSM.

 

• Install or update the Now Assist for CSM Major Issue Management app (sn_csm_mim_gen_ai).

• Install or update Major Issue Management (sn_majorissue_mgt), which this app builds on.

• Navigate to Process Automation > Flow Designer and confirm the subflow named "Search similar major case," part of the Now Assist for CSM Major Issue Management application, is active and published.

• Make a copy, ground, and activate the Major Cases Similarity Search AI skill for your use case using the Now Assist Admin Console or Now Assist Skill Kit within the correct application scope.

 

Prerequisites

 

• ServcieNow Otto for CSM is activated.

• Now Assist for CSM Major Issue Management is activated.

• Users have appropriate roles assigned to review and confirm proposed major case candidates.

 

What Makes Major Cases Similarity Search Different

 

The skill is more than a search wrapper. It calls a retrieval tool, detectMajorCases, that performs the actual AI Search query using whatever configuration the extension point supplied for whichever of those two checks is running, and then reasons over the results before returning a verdict.

 

Out of the Box Provider Variants

 

The skill ships with the same prompt published across four LLM provider definitions: Azure OpenAI, Amazon Bedrock (Claude), Google Gemini, and the Now LLM Service. Unlike a skill that varies its output sections by case state, this skill's output structure stays the same across providers, and instead varies by which of the two profile types it's evaluating.

 

Profile-Aware Output: Major vs. Non-Major

 

The skill automatically determines its profile type from the retrieved data, based on whether the first similar case has a major_case_state of accepted or proposed, and changes its analysis accordingly:

 

Profile type

|

When it applies

|

What the skill does

|

Possible recommendations

|
|

Major

|

Similar cases returned are already accepted or proposed major cases

|

Ranks each candidate individually by similarity score, never aggregating cases together, and identifies the single best match

|

link_to_existing, no_action

|
|

Non-major

|

Similar cases returned are ordinary, non-major cases

|

Runs a full pattern analysis: similarity classification, temporal/velocity trend, common attribute detection, and a major case assessment (volume, velocity, impact, pattern strength)

|

link_to_child_cases, propose_child_cases, monitor, no_action

|

 

Detection and Validation Logic

 

Before any analysis runs, the skill checks the count of similar cases returned by detectMajorCases. If the count is zero, it stops immediately and returns only "No results found currently," without generating any JSON, recommendation, or fabricated analysis.

 

Similarity and Pattern Analysis (Non-Major Profile)

 

For the non-major profile, the skill classifies the average semantic similarity of the retrieved cases as High (above 0.75), Moderate (0.65 to 0.75), or Low (below 0.65). This can, of course, be altered as per your requirements. It also groups cases by creation time into the last 1, 4, and 24 hours to classify the trend as Increasing, Active, or Decreasing, and detects common attributes across geographic, technical, classification, impact, organizational, and symptom-based fields, including any fields constrained by the extension point's match field list.

 

Major Case Assessment (Non-Major Profile)

 

Before recommending escalation, the skill evaluates volume (exact case count, never estimated), velocity (cases in the last 4 and 24 hours), impact (number of P1/critical cases, unique customers or accounts affected), and pattern strength (the field with the most matching values). Each of these feeds directly into the final recommendation, confidence level, and risk level.

 

Justification and Grounding Rules

 

Every recommendation is paired with a 2 to 3 sentence justification that is explicitly restricted to data present in the retrieval results:

 

• Cases are referenced by case number only (for example, CS0012345); sys_ids and other internal identifiers are never included.

• The skill will not estimate, assume, or extrapolate any detail, field value, or pattern not explicitly present in the retrieved data.

• A similarity score of exactly 0 indicates a keyword or filter match rather than a true semantic match, and is omitted from the justification and insights entirely rather than shown as zero.

 

Registered Inputs

 

Out of the box, the skill uses seven inputs, all populated by the extension point's configuration for whichever of the major-case or non-major-case checks is running:

 

• searchQuery is the text used to find semantically similar cases.

• searchProfile identifies which AI Search profile to use, the major-case or non-major-case profile.

• similarityThreshold is the minimum semantic similarity score a candidate case must meet to be considered.

• maxSearchResults caps how many similar cases are retrieved.

• tableName identifies the source table being searched, the customer service case table by default.

• filterConditions is an encoded query (for example, "account=xyzproduct=abc") that constrains which cases are eligible to be returned as similar.

• additionalFields lists the field names constrained by filterConditions, so their values are also returned in the retrieved case data for the skill's pattern analysis.

 

On the output side, the skill returns status, provider, response, error, and errorCode, in addition to the structured JSON payload containing the justification, insights, and the ranked list of similar cases with their similarity scores and major case state.

 

Built-in Quality Monitoring

 

The skill has Correctness Metric, Correctness Metric with Golden Response, and Faithfulness Metric registered against it, so its retrieval-grounded output can be evaluated for accuracy the same way any other Now Assist skill is monitored.

 

Customization with Now Assist Skill Kit

 

Administrators can customize or ground this skill using Now Assist Skill Kit or Now Assist Admin. This capability is designed to be tuned at two different levels:

 

• Navigate to Now Assist Skill Kit and ensure the correct scope is selected (Now Assist for CSM Major Issue Management).

• Open the Major Cases Similarity Search skill.

• Go to the Prompts section and clone the default prompt for the relevant LLM provider variant (Azure OpenAI, Amazon Bedrock, Google Gemini, or Now LLM Service).

• Modify the cloned prompt to your requirements, for example adjusting how similarity classifications or velocity trends are worded.

• Save the cloned prompt, run tests to validate the changes across major-case and non-major-case scenarios, enable "Make it default," and finalize using the lock icon.

• Publish the skill and select which finalized prompts to include. Changes take effect the next time the "Search similar major case" subflow calls the skill.

For more on customizing AI Skills in CSM: https://www.youtube.com/watch?v=Jv5h-wZ5W6s

 

Separately, and at a lower effort level, admins can navigate to Scripted Extension Points and locate NowAssistMajorIssueExtPoint to tune the similarity threshold, the minimum number of matching cases required, and scope the search by fields like account or product.

 

Example Customizations

 

A few examples of how you could ground this capability for your business: 

 

• Extension point, tiered escalation sensitivity: Override getConfigForNonMajorCase to return a lower minSimilarCasesForMajor for specific account types and the default for everyone else, so certain customers (who might typically experience such cases more) escalate to a major case faster while the other accounts still need stronger corroborating evidence.

• Skill, Common Attribute Detection section: In the cloned prompt, under Step 2 > C. Common Attribute Detection, the instructions list which field categories to scan for shared values (Geographic, Technical, Classification, Impact, Organizational, Symptoms). Add a category of your own, for example a Contractual category referencing SLA tier or contract type, so the pattern analysis explicitly checks for it on every run instead of only the out-of-the-box categories.

• Skill, Temporal Analysis section: In the cloned prompt, under Step 2 > B. Temporal Analysis, the instructions define the velocity windows as the last 1, 4, and 24 hours, with worked examples for what counts as an Increasing, Active, or Decreasing trend. For a lower-volume support organization, widen these windows, for example to the last 4, 24, and 72 hours, and update the worked examples to match, so the trend classification actually fits how quickly your cases accumulate.

• Sub-flow, routing on risk level: Add a step after the skill runs to notify a specific team or channel automatically when the skill's risk level comes back as critical, rather than waiting for a case handler to review the proposal in the queue.

Measured Success and Outcome Examples:

 

Outcome

|

Value to Operations

|

Key Metric

|
|

Earlier major issue detection

|

Surfaces emerging patterns before a human notices them across separately-handled cases

|

Time from first case creation to major case proposal

|
|

Reduced duplicate investigation

|

Links related cases to a single major case instead of separate teams investigating the same root cause independently

|

% of related cases linked automatically vs. manually

|
|

Consistent escalation criteria

|

Applies the same configured thresholds to every case, reducing variability in when a major case gets proposed

|

% of major case proposals accepted without threshold adjustment

|
|

Grounded, auditable recommendations

|

Every proposal comes with a justification citing specific case numbers, reviewable before confirmation

|

% of proposals confirmed vs. rejected by case handlers

|

 

Key Best Practices

 

• Start with the out-of-the-box thresholds and observe before tuning. The default values are conservative on purpose; watch how many candidates get proposed before deciding they're too aggressive or too conservative.

• Scope the extension point deliberately if major issue detection only makes sense for certain products, case types, or brands in your business, rather than letting it run everywhere and get overridden by irrelevant proposals.

• Exercise caution if you need to modify the {{detectMajorCases.output}}, {{filterConditions}}, or {{additionalFields}} placeholder references in cloned prompts. They are runtime resolution tokens that must remain intact for the skill to receive retrieval results and extension point configuration correctly.

• Preserve the JSON output schema structure exactly. Downstream flow logic relies on specific field names, such as profile_type, semantic_similarity, and major_case_state, to decide what action to take.

• Ensure you require human confirmation on proposals. This capability proposes and links; it should not auto-create major cases without a case handler or major issue manager reviewing the evidence.

• If you customize the extension point, extend the out-of-the-box implementation rather than editing the base class directly, so your changes survive future app updates.

• Test cloned prompts across both major-case and non-major-case scenarios before publishing, since the two profiles exercise very different parts of the prompt's logic.

 

Frequently Asked Questions

 

1. Does this replace the major case service rep./human agent's decision to declare a major case? No. The capability proposes candidates and suggests links based on similarity evidence; a service rep still confirms before a case is formally escalated or linked.

2. What triggers it? Any new record created on the Customer Service case table.

3. How is this different from Predictive Intelligence-based major issue detection? Predictive Intelligence clusters structured case data to surface patterns. This capability adds a semantic layer that reads case narratives directly, so it can catch cases worded very differently that still describe the same issue, and it covers proposing, linking, and consolidating across the full major case lifecycle.

4. Can I change how sensitive the detection is? Yes. The similarity threshold and the minimum number of matching cases required are both exposed through the NowAssistMajorIssueExtPoint extension point.

5. Can I customize the skill itself, not just the thresholds? Yes. The Major Cases Similarity Search skill can be cloned and edited from Now Assist Skill Kit if you need to change the underlying prompt rather than just the governance around it.

6. Can I scope this to only certain case types, products, or accounts? Yes, both through the extension point's search configuration and through the match fields it supports.

7. How do we ensure this skill won't fabricate similar cases or patterns if none are found?  If the retrieval tool returns zero similar cases, the skill stops immediately and returns "No results found currently" without generating any analysis.

8. Why does the skill treat major and non-major matches differently? Because the two situations call for different decisions. Matching an existing major case is a ranking problem, finding the single best fit. Detecting a brand new pattern among non-major cases is a broader analysis problem, requiring velocity, volume, and impact assessment before a new major case is worth proposing.