New

Host Label correlation now supports tiered lookup across multiple CMDB CI classes. Host Labels assigned to Kubernetes services and other modern infrastructure types are now correlated to their respective CMDB CIs using an ordered search across hardware, Virtual Machines, Kubernetes, and API-based fallbacks. This enables alert enrichment and topology context for a broader range of infrastructure.
Admins can now configure and manage OpenTelemetry ingest sources via ServiceNow-native APIs. The new API endpoints allow registration, listing, status checking, updating, and removal of OTel data sources. MCP tool definitions are provided for agent-driven and Otto workflows, enabling programmatic onboarding and management without manual UI steps.
Expiring token email notifications are now available for MID-less data integrations. Users receive email alerts when integration tokens are nearing expiration, prompting timely refresh actions.
Admins can now add a certificate policy check option for Splunk Poll data inputs. The new usemidcertificatepolicycheck setting enables admins to control MID certificate policy enforcement for Splunk Poll integrations, with UI placement and compatibility logic for Brazil and later releases.

Changed

Raw manual test samples are now transient in Source Type Structure. Test samples entered in the manual sample field are no longer permanently saved; they are cleared on refresh, preventing contamination of subsequent flows.

Fixed

Admins can now suppress redundant keyword detections and prioritize message detections in HLA anomaly alerts. When multiple keyword detections occur for the same component at the same time, only the first detection is surfaced as an alert; subsequent detections are suppressed. If a message detection exists for the same component and pattern, keyword detections are suppressed in favor of message detection. Suppression is silent and applied in real time.