drop servicenow sys_audit export · parse field changes + actor + table · flag acl changes admin grants incident mass updates · timeline + csv/json export · runs locally
flags acl changes · admin role grants · incident mass updates · integration spikes · off-hours · actor spikes · bulk deletes
export schema varies by tenant/version — heuristic column mapping · screener · not definitive proof