Work with ServiceNow attachments

TL;DR

• Your agent can list and download files attached to a ServiceNow incident, then analyze them in its workspace
• The tools are off by default. You opt in by adding them to a custom skill or sub-agent
• Requires read access to sys_attachment on top of the connection's existing incident access
• Downloads are limited to diagnostic file types and capped at 20 MB

Time: 5 minutes

Why this matters

Incidents often arrive with the evidence attached: a log file, an exception trace, a screenshot of the failure, or an exported configuration. Without those files, the agent works from the description alone.

With attachment access, the agent can download the file into its workspace and read it. It can parse a log for the error window, compare a configuration with what you expect, or pull the failing request out of a HAR capture.

Prerequisites

• ServiceNow connected as your incident platform
• The account the connection authenticates as needs read access to the sys_attachment table, in addition to its incident access (itil or equivalent)
• A custom skill or sub-agent that lists the tools (see below)

Turn the tools on

The built-in ServiceNow incident management skill doesn't include the attachment tools, so no agent has them until you add them:

1. Create a custom skill or sub-agent that your agent uses for ServiceNow incidents. See Create a skill or Create a custom agent.

2. In the skill's SKILL.md (or the sub-agent's configuration), list ListServiceNowIncidentAttachments under tools. Add DownloadServiceNowIncidentAttachment only if you want the agent to download files; listing alone shows file names, types, and sizes. For a skill:

   ---
   name: servicenow-attachments
   description: Read attachments on ServiceNow incidents
   tools:
     - ListServiceNowIncidentAttachments
     - DownloadServiceNowIncidentAttachment
   ---

   Type the tool names into the frontmatter in the code editor.

3. Optionally add a Deny rule in Tool Access Policies for either tool to block it.

Granting attachment access

Attachment reads use the same credential as every other ServiceNow operation. If the sys_attachment read ACL is missing, acknowledging, commenting on, and resolving incidents keep working, but attachment listing and download fail or come back empty. A missing ACL can look like "this incident has no attachments."

How it works

The agent works in two steps, so it can choose individual files before downloading:

1. List returns each attachment's ID, file name, content type, and size. Nothing is downloaded.
2. Download fetches one attachment, checks it, and saves it in the investigation thread's workspace under servicenow-attachments/<attachment id>/.

The file contents aren't pasted into the conversation. The agent gets the saved path and opens the file from the workspace.

Example conversation:

You: There's a log attached to INC0010005. What does it show?

Agent: INC0010005 has two attachments: app-errors.log (412 KB) and topology.png (88 KB). Downloaded app-errors.log. It shows 1,204 DNS resolution timeouts between 14:02Z and 14:19Z, all against the internal resolver, which matches the window in the incident.

What the agent can download

Category	Types
Logs, data, configuration	.log .json .jsonl .ndjson .csv .tsv .xml .yaml .yml .ini .conf .cfg .properties .toml
Documents	.pdf .docx .pptx .xlsx .txt .md
Images	.png .jpg .jpeg .gif .webp
Captures and diffs	.har .etl .diff .patch

Only these file types are supported. Anything else, including scripts (.ps1, .sh, .py, .js), archives (.zip, .gz, .7z, .rar), program source, .html, .svg, and .env files, is refused before it is transferred.

For file types that have a recognizable signature, such as PDF, Office, and image files, the agent also checks the signature against the extension, so an executable renamed to .pdf is rejected. Text types such as .log or .json have no signature, so scripts and source code are refused by extension only.

Limits

Limit	Value	Notes
Maximum file size	20 MB	Refused before download when ServiceNow reports the size; otherwise the download stops at 20 MB
Attachments listed	100 most recent	Listing is newest-first
Download by ID	Not limited by the listing cap	A known attachment ID works even if the listing did not show it

Troubleshooting

The agent says the incident has no attachments, but ServiceNow shows some

The connection's account is most likely missing the sys_attachment read ACL. Some instances return an empty result rather than an error in that case. Confirm the ACL with your ServiceNow administrator, then retry.

"Attachment is not attached to incident"

The attachment ID does not belong to that incident. Ask the agent to list the incident's attachments and use an ID from that list. This also appears if the attachment was deleted in ServiceNow after it was listed, or if the connection's account can't read that attachment's sys_attachment record.

"This tool does not download <type> files"

The file type isn't in the supported list above. Paste the relevant part of the file into the conversation if the agent needs it.

The attachment is too large

Files over 20 MB are refused. Ask the incident's owner for a smaller extract. The part of a log that matters is usually much smaller than the full capture.

A JSON or HAR file can't be downloaded

When ServiceNow is connected through an Azure API Connection, the agent can't download JSON-based files (.json, .jsonl, .ndjson, .har) or text that isn't UTF-8. The error message says so. To get these files, use direct authentication (basic or OAuth 2.0 Client Credentials) for the connection.

---

Related

Resource	What you'll learn
Connect to ServiceNow →	Configure the ServiceNow connection and its credentials
ServiceNow incidents →	How incident indexing, response plans, and field updates work
Incident Response →	How your agent investigates and responds to indexed incidents