Incident investigation with DEX
Service desk agents can diagnose and resolve issues for Digital End-User Experience (DEX) monitored devices from an incident record by using DEX diagnostics and suggested resolutions.
Incident investigation with DEX provides a comprehensive view of device and application health metrics, issue diagnosis, and suggested resolutions. It helps identify and resolve common device and application issues.
Important: Incident investigation with DEX is available starting with the Zurich release and requires Service Operations Workspace for ITSM starting with version 8.2.
Accessing DEX incident diagnostics and suggested resolutions
You can access incident diagnostics and suggested resolutions for DEX monitored devices from the Investigation tab of an incident record page. Navigate to the Service Operations Workspace and open the incident record from the Incidents list. For more information, see Incident Management in Service Operations Workspace and Features of the Investigation tab.
Important: The configuration item (CI) associated with the incident record must be a DEX monitored device.
[Omitted image "dex-diagnostics-investigation.png"] Alt text: DEX incident diagnostics and suggested resolutions accessed from the Investigation tab of an incident record
Device health and metric checklist
Review the overall health and performance of the device associated with the incident record in the Device health section. The Device health checklist shows details of device and application metrics for a specified duration. For more information, see Device health metrics for incident investigation.
Selecting the Refresh icon [Omitted image "icon-dex-refresh.png"] Alt text: displays the latest available data for device and application metrics.
Top processes by CPU and memory usage
Monitor the top processes by CPU and memory usage on DEX monitored devices. Automated snapshots capture data across different time range options and display the top processes by CPU and memory usage on a device, including the combined average usage percentages. For more information about viewing and interpreting snapshot data, see Top processes by resource usage in DEX incident investigation.
Work notes for configuration item updates
When the CI, Business Service, or Service Offering on an incident record is set or updated to an item monitored by DEX, an automatic work note is posted. For more information, see Work notes for incident field updates with DEX.
Suggested resolutions and remedial actions
View issue diagnosis and suggested resolutions to improve device and application performance in the Suggested resolutions tab. For more information, see Suggested resolutions in incident investigation with DEX.
Along with the suggested resolutions, you can run remedial actions from the Action library to resolve device and application issues. For more information, see Run remedial actions from the Action library.
Tracking remedial action executions
Two views are available for monitoring remedial actions:
-
Playbook for remedial actions in incident investigation with DEX
The Playbook Experience in the incident record displays current and past remedial actions run from any supported source. Each action card shows the action name, source, status, start time, and the user who initiated it. From the Playbook Experience, you can monitor current actions (New or In Progress) and cancel ongoing actions run from the Suggested resolutions or Action library within the incident record.
-
View remedial action execution
The Remedial action executions page in DEX Administration provides a consolidated view of all remedial actions triggered across every device, regardless of where the action was started.
Playbook Experience for remedial actions
Use the Playbook Experience in incident investigation with DEX to view details of remedial actions in progress, cancel ongoing actions, and view playbook history. For more information, see Manage remedial actions in DEX incident investigation Playbook.
---
title: Incident investigation with DEX
description: Service desk agents can diagnose and resolve issues for Digital End-User Experience \(DEX\) monitored devices from an incident record by using DEX diagnostics and suggested resolutions.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/digital-end-user-experience-dex/dex-diagnostics-guided-resolutions.html
release: australia
product: Digital End-User Experience \(DEX\)
classification: digital-end-user-experience-dex
topic_type: concept
last_updated: "2026-10-22"
reading_time_minutes: 4
breadcrumb: [Manage employee experience, Digital End-User Experience, IT Operations Management]
---
# Incident investigation with DEX
Service desk agents can diagnose and resolve issues for Digital End-User Experience \(DEX\) monitored devices from an incident record by using DEX diagnostics and suggested resolutions.
Incident investigation with DEX provides a comprehensive view of device and application health metrics, issue diagnosis, and suggested resolutions. It helps identify and resolve common device and application issues.
**Important:** Incident investigation with DEX is available starting with the Zurich release and requires Service Operations Workspace for ITSM starting with version 8.2.
## Accessing DEX incident diagnostics and suggested resolutions
You can access incident diagnostics and suggested resolutions for DEX monitored devices from the **Investigation** tab of an incident record page. Navigate to the Service Operations Workspace and open the incident record from the Incidents list. For more information, see [Incident Management in Service Operations Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/it-service-management/incident-sow.md) and [Features of the Investigation tab](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/it-service-management/features-of-investigation-tab.md).
**Important:** The configuration item \(CI\) associated with the incident record must be a DEX monitored device.
\[Omitted image "dex-diagnostics-investigation.png"\] Alt text: DEX incident diagnostics and suggested resolutions accessed from the Investigation tab of an incident record
## Device health and metric checklist
Review the overall health and performance of the device associated with the incident record in the Device health section. The Device health checklist shows details of device and application metrics for a specified duration. For more information, see [Device health metrics for incident investigation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/digital-end-user-experience-dex/device-health-metrics.md).
Selecting the Refresh icon \[Omitted image "icon-dex-refresh.png"\] Alt text: displays the latest available data for device and application metrics.
## Top processes by CPU and memory usage
Monitor the top processes by CPU and memory usage on DEX monitored devices. Automated snapshots capture data across different time range options and display the top processes by CPU and memory usage on a device, including the combined average usage percentages. For more information about viewing and interpreting snapshot data, see [Top processes by resource usage in DEX incident investigation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/digital-end-user-experience-dex/process-snapshot.md).
## Work notes for configuration item updates
When the CI, Business Service, or Service Offering on an incident record is set or updated to an item monitored by DEX, an automatic work note is posted. For more information, see [Work notes for incident field updates with DEX](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/digital-end-user-experience-dex/ci-update-work-notes.md).
## Suggested resolutions and remedial actions
View issue diagnosis and suggested resolutions to improve device and application performance in the **Suggested resolutions** tab. For more information, see [Suggested resolutions in incident investigation with DEX](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/digital-end-user-experience-dex/dex-suggested-resolutions.md).
Along with the suggested resolutions, you can run remedial actions from the Action library to resolve device and application issues. For more information, see [Run remedial actions from the Action library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/digital-end-user-experience-dex/remedial-actions-action-library.md).
## Tracking remedial action executions
Two views are available for monitoring remedial actions:
- [Playbook for remedial actions in incident investigation with DEX](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/digital-end-user-experience-dex/playbook-remedial-actions.md)
The Playbook Experience in the incident record displays current and past remedial actions run from any supported source. Each action card shows the action name, source, status, start time, and the user who initiated it. From the Playbook Experience, you can monitor current actions \(New or In Progress\) and cancel ongoing actions run from the Suggested resolutions or Action library within the incident record.
- [View remedial action execution](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/digital-end-user-experience-dex/view-remedial-action-execution.md)
The **Remedial action executions** page in DEX Administration provides a consolidated view of all remedial actions triggered across every device, regardless of where the action was started.
## Playbook Experience for remedial actions
Use the Playbook Experience in incident investigation with DEX to view details of remedial actions in progress, cancel ongoing actions, and view playbook history. For more information, see [Manage remedial actions in DEX incident investigation Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/digital-end-user-experience-dex/manage-incident-remedial-actions-playbook.md).
| title | Incident investigation with DEX |
| description | Service desk agents can diagnose and resolve issues for Digital End-User Experience \(DEX\) monitored devices from an incident record by using DEX diagnostics and suggested resolutions. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/it-operations-management/digital-end-user-experience-dex/dex-diagnostics-guided-resolutions.html |
| release | australia |
| product | Digital End-User Experience \(DEX\) |
| classification | digital-end-user-experience-dex |
| topic_type | concept |
| last_updated | 2026-10-22 |
| reading_time_minutes | 4 |
| breadcrumb | Manage employee experienceDigital End-User ExperienceIT Operations Management |