Incidents are being automatically updated by systemDescription<!-- div.margin { padding: 10px 40px 40px 30px; } table.tocTable { border: 1px solid; border-color: #e0e0e0; background-color: #fff; } .title { color: #d1232b; font-weight: normal; font-size: 28px; } h1 { color: #d1232b; font-weight: normal; font-size: 21px; margin-bottom: 5px; border-bottom-width: 2px; border-bottom-style: solid; border-bottom-color: #cccccc; } h2 { color: #646464; font-weight: bold; font-size: 18px; } h3 { color: #000000; font-weight: bold; font-size: 16px; } h4 { color: #666666; font-weight: bold; font-size: 15px; } h5 { color: #000000; font-weight: bold; font-size: 13px; } h6 { color: #000000; font-weight: bold; font-size:14px; } ul, ol { margin-left: 0; list-style-position: outside; } --> Symptoms Many incidents are being automatically being updated around 8:00 and a few minutes past that. The updated by shows that it is being updated by (user = system) but there are no records on the audit table showing that anything was updated at that time. Reviewed scheduled jobs but there are no jobs running at that time. Cause After checking the node logs, it was observed that the System updates to Incidents are made by SLA default scheduled jobs which run regularly to refresh the time calculations on each active task SLA associated to the Incidents. Also, it was observed that the Next Action field values of the SLA default scheduled jobs correlate with the system update on Incidents Resolution This is the expected behaviour. The System updates to Incidents are made by SLA default scheduled jobs which run regularly to refresh the time calculations on each active task SLA associated to the Incidents. Detailed information about the SLA scheduled Jobs can be found here: - Scheduled jobs for SLA https://docs.servicenow.com/csh?topicname=c_ScheduledJobsForSLA.html&version=latest These Scheduled jobs run more frequently when the task SLA associated to the Incident is closer to being breached.