Healthscan definitions updates: May 2025 store
Some HealthScan definitions are deprecated or updated between releases.
New definitions
The following definitions have been added for the May 2025 release to improve performance, reduce false positives, and meet the latest coding practices. Some of these definitions will have a positive or negative impact on your customer instance scores.
Due to process and technical constraints, a comprehensive impact analysis for the overall score impact could not be fully conducted for customer instances. As a result, there may be potential impact score drops that have not been identified or addressed.
| Number | Short description | Rating | Category | Update description |
|---|---|---|---|---|
| HSD0022569 | Service Operations Workspace ITSM Applications is installed and active | Discuss | User Experience | New definition that checks if the plugin sn_sow_itsm_cont is installed and activated |
| HSD0024649 | Reports with very long execution times | Discuss | User Experience | New definition to identify long running reports per DT thresholds |
Updated definitions
The following definitions have been updated for the May 2025 release to improve performance, reduce false positives, and meet the latest coding practices. Some of these definitions will have a positive or negative impact on your customer instance scores.
Due to process and technical constraints, a comprehensive impact analysis for the overall score impact could not be fully conducted for customer instances. As a result, there may be potential impact score drops that have not been identified or addressed.
| Number | Short description | Rating | Category | Update description |
|---|---|---|---|---|
| HSD0001011 | Common slow loading forms in the last 30 Days | Discuss | Performance | - New client threshold is 1 second \(1000ms\) - New total response threshold is 5 seconds \(5000ms\) |
| HSD0001106 | Applications should use Source Control | Discuss | Manageability | - New version runs in sub-prod only. - Added better error handling. - Added manual statistic |
| HSD0001107 | JavaScript Mode is not set correctly on application | Discuss | Manageability | New version makes clear distinction that globally scoped apps should be on ES5and scoped apps should be on ES12 |
| HSD0001116 | Client Scripts should not be defined against the Global table | Recommend | Performance | Changed documentation URL to: https://developer.servicenow.com/dev.do\#!/guides/latest/now-platform/tpb-guide/client\_scripting\_technical\_best\_practices\#avoid-global-client-scripts |
| HSD0001164 | Use state, not Incident State or Problem State | Recommend | Manageability | - Condition filtered only for global scope incident and problem tables - Overall code standardization |
| HSD0001174 | Scripted Web Services writing data directly | Recommend | Security | - Removed matching requirement for semicolons - Improved Regex to a single pattern - Removed repeated use of Regex patterns - Migrated from String.match to Pattern.test - Add updateMultiple\(\) to pattern - Added 1K limit to findings - Forced Statistic even on failures |
| HSD0001193 | Use the condition field in Business Rules | Discuss | Manageability | - Simplified scriptingAmended query to allow - Findings on insert, update, delete and query - Business RulesCorrected RegExp Pattern - Clarified verbiage - Added condition to ignore "Auto Business rules" generated by the system |
| HSD0001205 | Widgets not used in any dashboards | Discuss | Manageability | - New version ensures that each finding flags custom widget that it is truly unrelated to a dashboard - Added defensive scripting - Added statistic |
| HSD0001207 | Form layout whitespace: make sure layout split does not have large empty areas because only one side contains fields. | Recommend | User Experience | - Updated Findings to be against sys\_ui\_sections containing the elements - Updated script to confirm these - Sections were updated by customer - Updated Findings display to contain the view names for these forms |
| HSD0001275 | Scripts should not contain hard-coded IDs | Recommend | Manageability | Excluded any tables starting with itfm\_ |
| HSD0001281 | getMessage\(\) called in Client Script without preloading message key | Recommend | Manageability | - Condensed a couple regex into single pattern - Removed some string manipulation and replaced with regex capturing - Now detecting messages in double quotes as well |
| HSD0001344 | Minimize the number of options in a choice field | Discuss | User Experience | - Updated the script to correctly check for the presence of sys\_choice\_set updates in sys\_update\_xml - Updated the messaging in the Findings to show the Language in question to the customer - Confirmed that the sys\_language record is also active |
| HSD0001378 | Reports not run for 3 months | Discuss | Manageability | Updated the query to filter out reports that are no longer active |
| HSD0001385 | Check for automatic indicators with no scores collected | Recommend | Manageability | - Updated script to confirm that baseline / provided indicators have active m2m records to collection jobs which are also active - Adjusted some variable names and return values to be more intuitive - Updated short description and recommendation to be more clear |
| HSD0001398 | Script Includes with duplicate names | Act | Manageability | An additional Base version check is added to trigger a finding for only non OOB records. |
| HSD0001467 | Duplicate foundation/core data found | Act | Manageability | - Updated statistics and findings to show the duplicate count per foundation table - Findings url gives an encoded url for next experience instances showing a descending order and for the non next experience providing a non encoded url \(with out specifying order\) |
| HSD0001507 | Scheduled jobs should run as dedicated integration user accounts rather than as default system | Act | Security | - Short description: Scheduled jobs should run as dedicated integration user accounts rather than as default system - Excluded sys\_flow\_trigger\_auto\_script |
| HSD0001533 | The default "system" user preference for "rows per page" should be set to 50 or less | Recommend | Performance | Recommendation: Set the default rows per page global default property to max 50. Consider also setting the max allowable values in glide.ui.per\_page property to 10,25,50. To change specific user's preferences back from larger values to lower ones, consider using a scheduled job to reset them after 7-14 days back to lower values unless the user continues to require large sets of data. |
| HSD0001561 | Client Scripts should check for isLoading and return | Discuss | Performance | - Modified the regular expression for robustness - Filters out base version \(OOB\) client scripts - Elaborated the description |
| HSD0001627 | Do not query audit log in your custom integrations and code. | Recommend | Performance | Added ua\_scripted\_defn to the excluded tables list |
| HSD0001695 | Modification of State Choice set \(install\_status\) on alm\_asset table. | Act | Upgradeability | - Altered code from using hardcoded list of states to checking for sys\_update\_xml from the customer marking the sys\_choice\_set as replace on upgrade == false - Updated the short description to "Modification of State Choice set \(install\_status\) on alm\_assettable." Where it was previously "Modification of State" |
| HSD0001755 | Modification of State Choice set \(state\) on resource\_plan table. | Recommend | Upgradeability | Altered code from using hardcoded list of states to checking for sys\_update\_xml from the customer marking the sys\_choice\_set as replace on upgrade == false |
| HSD0002020 | Avoid long module titles | Discuss | User Experience | - Updated documentation url Updated code to ignore module titles containing "deprecated" - Added defensive scripting - Added statistic - Made code a little more efficient via more reliance on the database - Measurably improved performance |
| HSD0002089 | Breakdown element filter should have valid conditions | Act | Manageability | - Fixed issues with empty field name - General code cleanup - Now ignoring RLQ queries |
| HSD0002130 | Valid To dates set to reasonable values | Recommend | User Experience | - Updated definition to check for latest default - Valid to date = '2100-01-01' - Updated description to Valid to date = '2100-01-01' - Updated to relevant documentation url - Added defensive scripting |
| HSD0002151 | Use AngularJS services rather than window objects | Act | Performance | - Removed accidental inclusion of versioned HSD number in the short description - Added manual exception for the following line of code from cloned widgets: var dateFormat = window.NOW.dateFormat; |
| HSD0002342 | Each Policy Statement should have a valid attestation template. | Discuss | Manageability | - Description updated - Documentation link adjusted Implemented 1k threshold on Findings - Resolved HSINQ0006628, HSINQ0005842, HSINQ0006736 |
| HSD0002464 | Inactive Knowledge Author | Act | User Experience | - Adjusted the script to correctly return the link to the records indicated in the Finding - Also adjusted script to only return a Finding where this is 1 or more KB Articles with a non-active Author reference |
| HSD0002602 | List Layout with more than one List Element on the same position | Act | Manageability | An additional Base version check is added to trigger a finding for only non OOB records. |
| HSD0002737 | UI Actions displayed as a button should be short and precise | Discuss | User Experience | - Updated documentation url - Elaborated the recommendation a little more |
| HSD0002808 | Scripts without description | Recommend | Manageability | - Definition now queries only - Client Scripts and Script Includes. - Definition flags customized record versions only \(no base versions\). - Redundant code was eliminated. - Defensive coding was added. - Tests showed performance improvement with 50% run time reduction - Code is easier to read |
| HSD0003076 | Basic authentication credentials on SOAP Message definition | Recommend | Manageability | - If a SOAP Message Definition is utilizing a Basic Auth Profile, it is no longer reported - Added a standard try/catch to capture any potential errors - Added a summary Statistic |
| HSD0003094 | Enable Email Spam Scoring and Filtering | Recommend | Security | Updated documentation link to point to the same content in the newer syntax |
| HSD0003220 | Agent Workspace should be used for Incident Management | Recommend | User Experience | The definition is deprecated and is replaced by HSD0022569 \(Service Operations Workspace ITSM\). |
| HSD0003238 | Cannot Implement before Planned start date | Recommend | Manageability | - Fixed Query to look for future dates only - Updated documentation - URL Limiting to 1000 records |
| HSD0003995 | Change Management - CAB Manager role and CAB Management group | Recommend | Manageability | - Finding now pointing to the active CAB group without active members - Finding also created when there is no Active CAB groups - Finds more than one group with this scenario |
| HSD0004447 | Enforce Strict User Image Upload | Recommend | Security | Updated the docs link to point to same content in the newer syntax |
| HSD0007988 | Technical Service Offerings with Parent Technical Service Reference | Recommend | User Experience | - Fixed the calculation formula that was resulting in NaN - General code cleanup |
| HSD0008013 | Check for scheduled imports running at the same time. | Act | Performance | Removed a couple \|\| conditions that would never match to simplify the code. |
| HSD0008070 | Synchronous outbound calls should be carefully used in Business Rules and UI Actions. | Act | Performance | - Removed the 2nd sentence in the Recommendation field - Removed incorrect query condition incorrect query condition 'scriptNOTLIKEsetMIDServer' - Replaced the finding overrides and added line numbering to the output - Replaced ScriptUtils.removeCommentsfunction call use with new more performant and more accurate removeComments function |
| HSD0009985 | Last family release upgrade occurred over 1 year ago | Act | Upgradeability | Checking glide.war property instead |
| HSD0012244 | HW Product Model with Useful Life | Discuss | Manageability | - Updated Recommendation - Updated Documentation URL - Limited results to 100 |
| HSD0013510 | Validate Remote Host | Recommend | Security | Updated description to state that if the setting is set to False vs "if not set to true" |
| HSD0013559 | Do Not Use Demo Certificates for Active SAML Configurations | Discuss | Security | - Corrected logic problem - Added try/catch - Added forced statistic |
| HSD0015207 | Limit Attachment Size in Training and Prediction Flows | Recommend | Security | Corrected system property and code |
| HSD0015246 | Enforce Credential Alias Usage | Discuss | Security | - Optimized remote script to take only - Validated MID servers into account. \(at least 1\) - Added try / catch - Added Statistic - Altered documentation link to be more specific to this issue |
Parent Topic:HealthScan definitions