CSA Hub Part 3 Email Notifications & Templates
💬 Part 3 · Topic 1 of 4

Email Notifications & Templates

⏱ ~65 min read · Part 3 — Collaboration & Communication · 20% Exam Weight
Exam Weight: Part 3 carries 20% of the CSA exam. Notifications, templates, events, and inbound email actions are heavily tested. Pay close attention to the weight/deduplication rules, variable syntax, and the event-driven notification pattern.

Notification Overview

ServiceNow notifications are automated messages sent to users when specific conditions are met on platform records. They are the primary mechanism for keeping users informed about record state changes, assignments, and important events.

What Triggers Notifications?

Notifications can be triggered by three fundamental mechanisms:

📥

Record Insert / Update

Fires when a record is created (inserted) or modified (updated) in a specified table. The most common trigger type. You define which table and optionally which field changes matter.

Example: Send notification when an Incident is inserted with High priority, or when the State field changes to "Resolved."

Event-Based

Fires when a named platform event is queued. Business Rules or Scripts fire events using gs.eventQueue(), and a notification listens for that event name. Decouples the triggering logic from the notification.

Example: A Business Rule fires incident.assigned event; a notification listens for that event and emails the assignee.

Time-Based

Fires based on a time condition relative to a date/time field on a record — e.g., send a reminder X days before a contract expires, or escalate if an incident has been open for more than 4 hours.

Example: Email requester 2 days before SLA breach. Runs on a scheduled interval checking eligible records.

The sys_notification Table

All notification rules are stored in the sys_notification table. You can access and manage them via:

  • Navigate to: System Notification > Email > Notifications
  • Direct table: type sys_notification.list in the Filter Navigator
  • Each record in this table defines one complete notification rule
  • Notifications can be active or inactive — only active notifications fire

Three Delivery Types

Delivery Type Description Use Case
Email Standard HTML or plain-text email sent to recipients via configured mail server. Most common type. Incident assignments, approvals, SLA warnings, status updates
SMS Short text message to a user's mobile device. Requires a configured SMS provider / integration. Critical P1 alerts, on-call pages, urgent escalations
Meeting Invitation Calendar invitation (iCal format) sent to recipients. Creates a calendar event in the recipient's calendar application. Change advisory board meetings, scheduled maintenance windows

Notification vs. Event vs. Email Client — Key Distinctions

Notification
A configured rule in sys_notification that defines when to send, who receives it, and what message to deliver. It is the complete notification rule record.
Event
A named signal queued in the sysevent table using gs.eventQueue(). An event carries a name and optional parameters but has no delivery logic of its own — notifications listen for events.
Email Client
The Connect Sidebar email composition tool that allows users to manually send emails from within a record context. This is an ad hoc user action, not an automated notification rule.
Architecture Note: Notifications are processed asynchronously. When a trigger condition is met, the notification is queued and processed by a background job — it is not sent instantaneously inline with the user's action. This is why you may see a brief delay between a record change and the email arriving.

Notification Rule Anatomy (CRITICAL for Exam)

Understanding every field in a notification rule is essential for the CSA exam. Each field controls a distinct aspect of when, how, and to whom the notification is sent.

Core Fields

Field What It Controls Example / Notes
Name Descriptive label for the notification rule Incident Assigned to User
Table Which table this notification monitors. Changes to records in this table can trigger the notification. Incident [incident]
Active Whether the notification is enabled. Inactive notifications never fire. Checkbox — must be checked for the notification to work
Weight Integer priority value used for deduplication. When multiple notifications would fire for the same record/event, only the one with the highest weight is sent. Default weight is 0. 50 — higher number = higher priority
Category Groups notifications for subscription management. Users can opt out of entire categories (if the notification is subscribable). Incident, Change, Approval
Subscribable If checked, users can opt in/out via Notification Preferences. If unchecked (mandatory), users cannot unsubscribe. Mandatory approval notifications should not be subscribable

When to Send (Trigger Tab)

Inserted
Fires when a new record is created in the table. Use for "new ticket created" notifications to the submitter.
Updated
Fires when any field on an existing record is modified. Can combine with "Field changes" to be more specific.
Field changes
Refines the "Updated" trigger. Fires only when a specific field changes value — e.g., only when assigned_to changes, ignoring all other updates.
Event fired
Fires when a named platform event is queued via gs.eventQueue(). Enter the event name — e.g., incident.assigned. Decouples trigger logic from notification config.
Time-based
Runs on a schedule. Specify an offset (positive = after, negative = before) relative to a date field. A scheduler job evaluates eligible records periodically.

Weight and Deduplication — Exam Critical

Weight Rule: When multiple notification rules are configured for the same table and same trigger type, and more than one would fire for a given record change, ServiceNow uses the Weight field to deduplicate. Only the notification with the highest weight value is actually sent to each recipient. Lower-weight notifications are suppressed.

Example: Two notifications fire on Incident update — one with weight 10, one with weight 50. Only the weight-50 notification is delivered. If both have weight 0, both fire (no deduplication).
Common Misconception: Weight does NOT mean "more important = sent first." Weight means "if competing notifications would go to the same person for the same record event, only the highest weight one fires." Think of it as a deduplication priority, not a delivery order.

Conditions (Who Qualifies)

The Conditions section uses a filter condition builder to determine which records trigger the notification. Only records matching all conditions will generate the notification.

  • Works like any standard record filter in ServiceNow
  • Example: Priority is 1 - Critical AND State is not Resolved
  • If no conditions are set, the notification fires for all matching inserts/updates
  • Conditions are evaluated server-side against the current record state

Who Receives — Recipients Tab

The Recipients tab is one of the most important sections for the exam. It defines exactly who gets the email. Multiple recipient types can be combined.

Recipient Type Description Example
Users Specific named user records. Hardcodes individual users as always receiving this notification. Always notify the IT manager: John Smith
Groups All members of a specified group receive the notification. Dynamic — group membership changes apply automatically. Notify all members of Service Desk group
Roles All users with a specified role. Broader than groups — any user with that role on the instance receives it. All users with itil_manager role
Field values (record fields) Dynamic recipient pulled from a reference field on the triggering record. The user in that field gets notified. Most flexible and most common for record-specific notifications. Opened by, Assigned to, Watch list
Watch List: The Watch list field on many ServiceNow records (e.g., Incident, Problem) holds a list of users who have subscribed to updates on that specific record. Adding the Watch list as a recipient source in a notification rule means any user who adds themselves to the watch list on a particular record will receive notifications about that record. This is different from a group membership — it is record-scoped.

Send Condition

Send always
Notification fires every time the trigger condition is met, regardless of any additional check. Used when you always want the notification for matching records.
Send only if condition met
An additional filter script or condition that is evaluated at send time. If it evaluates to false, the notification is suppressed even if the trigger fired. Useful for complex send logic that cannot be expressed in the trigger conditions alone.

Advanced Tab: Subject, Message, Devices

  • Subject: The email subject line. Supports ${field_name} variable substitution for dynamic content.
  • Message (HTML): The body of the email. Full HTML is supported. Can reference an Email Template or contain inline content with variable substitution.
  • Message (Text): Plain-text fallback for email clients that do not render HTML.
  • Device: The delivery channel — Email, SMS, or Meeting Invitation. Defaults to Email.
  • Content type: HTML or plain text message format.

Email Templates

Email Templates allow you to create reusable HTML message bodies and subject lines that multiple notification rules can reference, maintaining consistency across communications and avoiding duplication.

  • Stored in the sys_email_template table
  • Navigate to: System Notification > Email > Templates
  • A template defines reusable Subject and Message content
  • Notification rules can reference a template, inheriting its content
  • Individual notifications can override template content if needed

Variable Substitution Syntax

Both templates and inline notification messages support dynamic variable insertion using a dollar-sign bracket syntax. Variables are resolved at send time against the triggering record.

Syntax What It Inserts Example
${field_name} The value of a field on the triggering record itself. ${number}INC0001234
${table.field} A field from a related (dot-walked) record via a reference field. Traverses the relationship at send time. ${caller_id.email} → the caller's email address
${assignment_group.name} → group name
${URI} The full URL to the record on the instance. Inserts a clickable link to open the record directly. Generates: https://instance.service-now.com/nav_to.do?uri=incident.do?sys_id=...
${URI_REF} An HTML anchor tag wrapping the record number as a clickable link. More user-friendly than raw URI. Renders as: INC0001234
$[link] Inserts a formatted hyperlink to the record. Common shorthand for generating a "View Record" link in the email body. Renders as a "Click here to view the record" style link
Exam Must-Know — Variable Syntax:
  • ${field_name} — inserts a field value from the current (triggering) record
  • ${table.field} — dot-walk to related record field (e.g., ${caller_id.name})
  • $[link] — inserts the record URL as a clickable hyperlink
  • ${subject} — inserts the value of the subject field within the message body
Know the difference between ${...} (field value) and $[...] (link/URL syntax).

Template Example Structure

<!-- Subject line -->
[${number}] Your incident has been updated: ${short_description}

<!-- Message HTML body -->
<p>Dear ${caller_id.first_name},</p>

<p>Your incident <strong>${number}</strong> has been updated.</p>

<table>
  <tr><td><strong>State:</strong></td><td>${state}</td></tr>
  <tr><td><strong>Assigned To:</strong></td><td>${assigned_to.name}</td></tr>
  <tr><td><strong>Priority:</strong></td><td>${priority}</td></tr>
</table>

<p>$[link]</p>

<p>Thank you,<br>IT Service Desk</p>

Shared Templates vs. Notification-Specific Content

Shared Template
A standalone record in sys_email_template that multiple notification rules reference. Changes to the template propagate to all notifications using it. Best for consistent corporate branding or standard message structures used across many notifications.
Notification-Specific Content
Subject and message content entered directly in the notification rule's Advanced tab. Does not reference a separate template. Best for one-off or highly custom notifications where reuse is not needed.

Notification Subscriptions

ServiceNow gives users control over which notifications they receive through a Notification Preferences system. Administrators control which notifications can be opted out of and which are mandatory.

How Users Manage Preferences

  • Users access preferences via: Profile icon > Notification Preferences (or System Settings > Notifications)
  • The preferences UI shows all subscribable notification categories and individual notifications
  • Users can opt in or opt out per notification, per category, and per device type (email vs. SMS)
  • Admin-set mandatory notifications do not appear in the opt-out list — users cannot disable them

Mandatory vs. Subscribable Notifications

Type Subscribable Checkbox User Can Opt Out? Typical Use Case
Mandatory Unchecked (not subscribable) No — always sent Security alerts, compliance notifications, approval requests
Subscribable Checked Yes — user may opt out Status updates, informational digests, non-critical updates
Exam Key Point: Mandatory notifications cannot be unsubscribed by end users. To make a notification mandatory, ensure the Subscribable checkbox is unchecked. Conversely, checking Subscribable allows users to control whether they receive it. This is a common exam question framing.

Notification Categories and Devices

  • Categories group related notifications together (e.g., all "Incident" notifications in one category). Users can enable/disable an entire category at once.
  • Devices represent delivery channels. A single notification can have preferences managed per device — a user may want Incident email alerts but not SMS alerts for the same event.
  • Categories are configured on notification records and help users navigate their preferences UI.

sys_notif_subscription Table

User subscription preferences are stored in the sys_notif_subscription table. Each record represents a user's explicit opt-in or opt-out choice for a specific notification.

  • Navigate to: sys_notif_subscription.list in the Filter Navigator
  • Contains: User, Notification, Device, Subscribed (yes/no)
  • Administrators can view and manage subscriptions for users from this table
  • If no subscription record exists for a user, the notification's default behavior (send or don't send) applies

Email Digest vs. Immediate Delivery

Immediate
Notification is sent as soon as the trigger condition is met and the notification job processes it. Default behavior. Best for time-sensitive communications like incident assignments or approval requests.
Digest
Multiple notifications are batched together and sent as a single consolidated email at a configured interval (e.g., hourly, daily). Reduces email volume for high-frequency, low-urgency updates. Users or admins can configure digest schedules.

Events

Events are a core part of the ServiceNow automation architecture. They decouple the action that triggers something from the action that responds to it, enabling clean separation of concerns and reusable event-driven logic.

The Event Pattern

Pattern: A Business Rule (or Script Include, Scheduled Job, etc.) fires an event using gs.eventQueue(). The event is written to the Event Queue (sysevent table). A background processor reads the queue and executes any registered handlers — including sending notifications that are configured to listen for that event name.

This pattern means: the notification definition does not need to contain any complex trigger logic. The complexity lives in the Business Rule; the notification simply declares "send me when event X fires."

gs.eventQueue() — The Event Firing Method

// Signature:
gs.eventQueue(eventName, record, param1, param2);

// Example: fire an event when an incident is assigned
// Typically called from a Business Rule (After, on update)
gs.eventQueue('incident.assigned', current, current.assigned_to, current.assignment_group);

// eventName  — string matching a registered event in the Event Registry
// record     — the GlideRecord context (current, previous, etc.)
// param1     — optional parameter 1 (max 256 chars), accessible in notification as ${event.parm1}
// param2     — optional parameter 2 (max 256 chars), accessible in notification as ${event.parm2}
Exam Must-Know: gs.eventQueue() takes the event name as its first argument. The event name must match a registered event in the Event Registry. Know the method signature and the fact that it is asynchronous — the event is queued, not executed inline.

Event Registry (sysevent_register)

  • The Event Registry (sysevent_register table) contains all defined/registered event names on the instance
  • Navigate to: System Policy > Events > Registry
  • Before you can fire an event, it should be registered here (though it will still queue even if unregistered)
  • Each registration record includes: Event Name, Table, Description, fired by (which system component)
  • Best practice: always register custom events before using them in scripts

Event Log (sysevent)

  • The Event Log (sysevent table) is the actual queue of fired events
  • Navigate to: System Policy > Events > Event Log or sysevent.list
  • Each row represents one queued event instance, with columns for: Event Name, Table, Record sys_id, Param1, Param2, State (ready, processed, error), Processing time
  • The event processor runs periodically and changes State from "ready" to "processed"
  • Invaluable for debugging: if a notification is not firing, check the Event Log to verify the event was actually queued and processed

Business Rule → Event → Notification Pattern (Exam Scenario)

Step Component Action
1 User saves a record Incident is updated; assigned_to field changes
2 Business Rule (After, Update) Detects assigned_to changed, calls gs.eventQueue('incident.assigned', current, ...)
3 Event Log (sysevent) Event record created with name incident.assigned, state = ready
4 Event Processor (background job) Reads the event queue, finds the incident.assigned event, triggers registered handlers
5 Notification rule Notification configured with "When: Event fired = incident.assigned" matches and queues the email
6 Email sent Assignee receives email notification about their new incident assignment

Inbound Email Actions

Inbound Email Actions allow ServiceNow to automatically process incoming emails and take actions on records — creating new records, updating existing ones, or running scripts based on email content.

  • Stored in the sys_email_inbound_action table
  • Navigate to: System Notification > Inbound Actions
  • ServiceNow's mail server receives incoming email, which is then matched against inbound action rules
  • Multiple inbound actions can be defined; they are evaluated in order by the Order field
  • An inbound action can stop processing further rules once matched (like a catch-all)

Inbound Action Anatomy

Field Description Example
Name Descriptive name for the inbound action rule Create Incident from Email
Active Whether the rule is enabled Must be checked to process emails
Order Integer execution order. Lower numbers run first. First matching rule wins (by default). 100
Type Reply (match email to existing record by correlation ID) or New (always create a new record) Reply or New record
Target table The table on which to create or update records Incident [incident]
Conditions Filter conditions on the email itself (e.g., subject contains a keyword, from a specific domain). Determines if this rule applies to the incoming email. Subject contains "URGENT"
Action script Server-side script executed when the rule matches. Has access to current (the target record), email (the incoming email object), and email_action. Set fields, call APIs, create related records

Reply Separators

When a user replies to a notification email, ServiceNow must extract the new content from the reply and ignore the quoted original message. Reply separators define the delimiter between new and quoted content.

  • Navigate to: System Notification > Inbound Actions > Reply Separators
  • Default separator patterns match common email client quotation markers (e.g., --- Reply above this line ---)
  • Only the text above the separator is processed as new content and added to the record
  • Custom separators can be added to handle non-standard email clients or formats

Email-to-Record Correlation

How Replies Map to Records: When ServiceNow sends a notification email, it embeds a correlation ID (a unique watermark) in the email headers. When a user replies to that email, the incoming email contains the same correlation ID. The inbound action of type "Reply" uses this ID to find the original record and add the reply as a work note or comment — no manual record lookup needed.

Common Inbound Action Use Cases

Email-to-Incident

An email to support@company.com automatically creates an Incident record. Subject becomes short_description; body becomes description. Caller is matched by sender email address.

Reply Updates Work Notes

A technician's email reply to a notification email adds a work note to the incident. Uses reply separator to extract only the new content.

Auto-close via Email

If a user replies "Resolved" or "Close ticket", an inbound action script can change the incident state to Resolved automatically.

Key Exam Facts & Common Traps

This section consolidates the highest-frequency exam points on notifications and templates. Review these carefully before exam day.

Trap 1 — Weight Means Deduplication, Not Delivery Order: Notification weight is used for deduplication — when multiple notifications compete for the same recipient/record/event, only the highest weight notification fires. A common wrong answer is to say "weight controls delivery speed" or "highest weight fires last."
Trap 2 — Mandatory vs. Subscribable: If a notification has Subscribable = unchecked, it is mandatory and users cannot opt out. If Subscribable is checked, users can disable it in their Notification Preferences. The exam often presents a scenario asking what the correct setting is — remember: mandatory = subscribable checkbox is OFF.
Trap 3 — Variable Syntax:
  • ${field_name} — inserts the value of a field on the triggering record
  • ${table.field} — dot-walk syntax to traverse a reference field (e.g., ${caller_id.name})
  • $[link] — inserts the record's URL as a clickable link (note: square brackets, not curly)
  • ${subject} — inserts the subject line content within the message body
Do not confuse ${...} (field value) with $[...] (link / special variable).
Trap 4 — Watch List Scope: The Watch list lets individual users subscribe to a specific record's notifications. It is per-record (one user watching one incident), not a global subscription. Adding Watch list as a recipient on a notification rule means: "send to whoever is watching this particular record."
Trap 5 — Notifications Are Asynchronous: Notifications are processed by background jobs — they are NOT sent synchronously when the record saves. There is always a processing delay. This means if a notification does not fire immediately, it may still be queued or processing.
Trap 6 — Event Must Be Queued Before Notification Fires: For event-triggered notifications, the event must be explicitly fired via gs.eventQueue(). Simply having the notification configured to listen for an event does nothing unless something actually fires that event. The Business Rule or script is the initiating component.
Trap 7 — sys_notification vs. sys_email_template:
  • sys_notification — the notification rule (when, who, what trigger)
  • sys_email_template — the reusable message template (subject and body HTML)
  • sysevent — the event log / queue of fired events
  • sysevent_register — the event registry (registered event names)
  • sys_notif_subscription — user subscription preferences
  • sys_email_inbound_actioninbound email action rules
Debugging Notifications: If a notification is not firing, follow this diagnostic path:
  1. Verify the notification rule is Active
  2. Check that the trigger condition actually fired (is the record matching the "When to send" and "Conditions"?)
  3. For event-triggered: check the Event Log (sysevent.list) — was the event queued? Was it processed?
  4. Check the Email Log (System Mailboxes > Outbound > Sent) to see if the email was generated but possibly filtered or bounced
  5. Verify the recipient actually has a valid email address in their user record
  6. Check if the user has opted out (if the notification is subscribable) in sys_notif_subscription.list

Quick Reference — All Key Tables

Table Name Navigator Path Contains
sys_notification System Notification > Email > Notifications All notification rules (when, who, what)
sys_email_template System Notification > Email > Templates Reusable email subject and body templates
sysevent System Policy > Events > Event Log Queue of fired event instances
sysevent_register System Policy > Events > Registry Registered event name definitions
sys_notif_subscription sys_notif_subscription.list User opt-in/opt-out subscription records
sys_email_inbound_action System Notification > Inbound Actions Rules for processing incoming emails
Putting It All Together — Notification Flow:
  1. Trigger fires — record insert/update matches notification rule, or event is queued
  2. Conditions evaluated — does the record match all filter conditions?
  3. Weight deduplication — if multiple notifications match, highest weight wins per recipient
  4. Recipients resolved — users, groups, roles, and field-value recipients are expanded to a list of users
  5. Subscription check — mandatory notifications go to all; subscribable notifications skip users who opted out
  6. Template/message rendered — variable substitution resolves ${...} and $[...] placeholders
  7. Email queued and sent — message enters the outbound mail queue and is delivered
← Security & Access Controls Reporting & Dashboards →