We're using ServiceNow GRC for policy exceptions. Our major pain point: exceptions get approved but then linger forever. They're "open" but not actively worked on, creating audit drift.
I need a concrete way to track and alert on these. The built-in reporting is too passive. What's your method?
My current approach uses Prometheus to scrape the GRC API for metrics, then Grafana for SLAs. Key metrics I track:
- `grc_exception_age_seconds{state="approved"}` - Time since approval.
- `grc_exception_count{state="approved",age=">30d"}` - Count of exceptions approved > 30 days ago.
Alert rule example:
```yaml
groups:
- name: grc_exceptions
rules:
- alert: ExceptionStaleApproved
expr: grc_exception_age_seconds{state="approved"} > 2592000 # 30 days
annotations:
description: 'Exception {{ $labels.number }} approved for {{ $value | humanizeDuration }}.'
```
Questions for the community:
* Are you handling this purely within ServiceNow with scheduled reports, or exporting data?
* If exporting, what's your pipeline? (e.g., Direct DB query, API stream to a data lake?)
* What's your target SLA for closing an approved exception? We use 30 days, but that might be lax.
—DD
Metrics don't lie.