Incident Management

When an incident is proposed as a major incident candidate, a major incident manager can accept or reject the candidate. The manager accepts a candidate as a major incident if the incident requires accelerated resolution.

Access the on-call roster and escalation details from the major incident workbench to contact a support group.

Activate the Incident Management Best Practice – San Diego plugin (com.snc.best_practice.incident.sandiego) if you have the admin role. This plugin includes demo data and activates related plugins if they are not already active.

You can activate the Incident Management Notification plugin (com.snc.incident_notification) if you have the admin role. This plugin includes demo data and activates related plugins if they are not already active.

Request the Incident Management — Core plugin (com.snc.incident_management), which provides the incident state model. The plugin includes demo data and activates related plugins if they are not already active.

You can activate the Incident Management — ATF Tests plugin (com.snc.incident.atf) if you have the admin role. The plugin delivers Automated Test Framework (ATF) tests for Incident Management. This plugin includes demo data.

You can activate the Incident plugin (com.snc.incident) if you have the admin role. This plugin includes demo data and activates related plugins if they are not already active.

You can activate the Incident Updates plugin (com.snc.incident.updates) to receive incident notification updates if you have the admin role. This plugin includes demo data and activates related plugins if they are not already active.

Help prevent unauthorized access to incident-related tables by activating the ITSM Enhanced Security Features plugin (com.snc.itsm.enhanced_security), which uses deny unless authenticated access control lists (ACLs).

Activate the KCS Integration for Incident Management plugin (com.snc.incident.knowledge) if you have the admin role. This plugin provides integration of Incident Management with the Advanced Knowledge Management features.

You can activate the Incident Management - Major Incident Management plugin (com.snc.incident.mim) if you have the admin role. This plugin includes demo data and activates related plugins if they are not already active.

You can install the ServiceNow Add-in for Microsoft Office plugin (com.sn_outlook_addin) if you have the admin role.

You can create a new communication plan or add a new communication task to an existing communication plan from the workbench. This UI action is helpful when you do not have an existing well-defined communication plan in the system.

Add a category or subcategory to help route incidents to the correct team and restore normal service faster.

Add similar incidents to a major incident so that the support teams can work on the parent record for a coordinated response process.

You can associate one or more incidents with a major incident using the Actions menu.

Create your own post incident report and associate the UI page with the View Complete Report button under the Post Incident Report tab. Using the customized report, you can add information that is specific to your organization.

Associate affected or impacted configuration items (CIs) with an incident record to find out how the incident affects other CIs with dependent relationships.

A bi-directional integration exchanges data between your ServiceNow instance and a third-party system so that incident information is synchronized between the systems.

Incident Management restores normal service operation while minimizing impact to business operations and maintaining quality.

Incident Management manages incidents through a defined set of states, from creation to closure, so you can track where each incident is in its life cycle.

An incident is considered resolved when you provide the user with a temporary workaround or a permanent solution for the issue.

An incident ticketing integration exchanges ticket data between your ServiceNow instance and a third-party system.

In a uni-directional integration, an external third-party system creates tickets in your ServiceNow instance. Define the data that must be sent to create a ticket and the validation that is required.

Specify the user that appears in the Updated by field when incidents are closed automatically.

Close a major incident manually after you validate the resolution and the major incident is in the Resolved state.

Help prevent unauthorized access to incident-related tables using Deny-Unless access control lists (ACLs). A Deny-Unless authentication ACL restricts access for a non-authenticated user.

Configure the incident ticket page where users view incident details in Service Portal.

Close incidents automatically based on the last updated date or the resolution date of the incident by configuring incident properties. You can also specify the number of days before resolved incidents close automatically.

Copy an incident or create a child incident without manually entering the value of all the fields in the new incident.

Provide a resolution for an issue by creating a knowledge article from an incident with fields defined in an article template.

Create a major incident directly, or review major incident candidates and promote them to major incidents.

Create an incident record to document a deviation from an expected standard of operation.

Create an associated ticket for another relevant department from an incident (primary ticket) when you realize that the issue can be resolved in that department.

Create an incident from a universal request record to restore service to a customer as soon as possible. After creating the incident record, you can investigate potential solutions.

To create incidents and VTB tasks, or to chat with a virtual agent from within your Outlook email, activate and deploy the ServiceNow Add-in for Microsoft Outlook.

Create an incident task to communicate and request work from assignment groups other than the one initially assigned to the incident.

Create a knowledge article from a resolved incident so that the resolution is available the next time the issue occurs.

Create a major incident candidate so that the major incident manager can evaluate it and decide whether to promote it to a major incident.

If a user needs catalog items such as an application or a laptop, create a request from the incident. Linking the request to the incident helps you track associated requests.

Enable the display of informative notes for a specific record or for a set of records that meet one or more conditions. Use these notes to help users understand the action that was taken for the incident or the next course of action to be taken.

Create a template that defines default values for the Incident form so that users don't have to enter the same values each time they create an incident.

Configure the Incident form to see the impact of an incident and then restore affected services. The CSDM framework enables you to view rich context for incidents: the CIs involved in the incident and the service offerings, business applications, and business services that the incident affects.

Customize which fields are automatically copied from a universal request to an associated incident record. This eliminates manual data entry each time you create an incident.

Define impact and urgency combinations that determine incident priority and the SLA for each priority for an organization. Only administrators and data lookup administrators can configure these rules.

Demote an incorrectly evaluated major incident, even after it is accepted. The incident is then handled as a regular incident.

Deploy the ServiceNow add-in for Microsoft Outlook so that users can chat with a virtual agent and create incidents and Visual Task Board (VTB) tasks from within Outlook.

Domain separation is supported in Incident Management. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

You can redirect users from email notification links to incident or major incident records in Service Operations Workspace (SOW) instead of the UI16 interface of Incident Management or Major Incident Management.

Use the ITSM Incident Management agentic workflows to manage, resolve and close incidents and incident tasks autonomously.

The Incident Management Best Practice – San Diego plugin (com.snc.best_practice.incident.sandiego) enhances integration and workflows for incidents and problems. You can use it to update agents and callers on the progress of a reported incident or problem.

Use incident tasks to collaborate with and request work from other stakeholders. An incident and its tasks are synchronized so that incident task states change based on the state of the incident.

Incident Management integrates with Universal Request so users can get incident-related services through a single service desk.

Incident Management integrations connect your incident response process with other tools so you can automate incident handling and address specific challenges directly.

Several user roles are installed with activation of the ITSM Roles — Incident Management plugin (com.snc.itsm.roles.incident_management).

You can configure the Incident form and other incident features, such as incident categories and UI behavior. The ITSM guided setup helps you configure Incident Management on your ServiceNow instance.

Platform Analytics Solutions and in-form analytics contain preconfigured dashboards. These dashboards contain actionable data visualizations that help you improve your business processes and practices.

View the last 28 days of incidents as raw trends, as a 7-day running average, or as a 28-day running average. Filter the scores by assignment groups or by the category of incident.

The Incident Management dashboard lets you see recent trends in incident creation, duration, and resolution. Use the information on this dashboard to spot problem areas and plan your incident management strategy going forward.

ServiceNow Incident Management supports the incident management process. Use it to identify, log, classify, prioritize, assign, escalate, resolve, and report incidents.

Incident Management properties control features such as copying and creating child incidents. The major incident properties control the promotion of major incident candidates to major incidents.

The Incident Management data model diagram shows the relationships between the tables within the application and provides an overall picture of how the Incident Management application operates.

Many of the Incident Management plugins are activated in the base system. You can activate the others when you're ready to use them. Some plugins include demo data.

Service desk and other IT managers can use dashboards and reports to monitor and track incident status and service levels.

Use this dashboard to view the status of the incidents for planning, prioritizing, and managing customer issues.

This dashboard uses Workbench widgets and other advanced Platform Analytics features to give you all the information about the Incident process in one place.

Platform Analytics Solutions contain preconfigured dashboards. These dashboards contain actionable data visualizations that help you improve your business processes and practices.

See how well the incidents that are subject to a Service Level Agreement meet the deadlines of those SLAs.

The Incident standard ticket page in Service Portal shows the details of an incident and provides actions to resolve, close, or reopen it.

Templates simplify the process of submitting new records by populating fields automatically. A template helps you capture incident information consistently. A record producer is a specific type of catalog item that allows end users to create task-based records, such as incident records, from the service catalog.

The Incident KCS Article table is installed when you activate the KCS Integration for Incident Management plugin (com.snc.incident.knowledge).

Several types of components are installed when you activate the Incident plugin in Incident Management.

Activating the Incident Management - Major Incident Management plugin installs several types of components, including tables and user roles.

Use this dashboard to view, maintain, and track the tasks and incidents for operating the IT service desk.

Incident Management helps restore normal service operation while minimizing impact to your business and maintaining the quality of your data.

Applying CSDM guidelines to Incident Management connects incidents to services, service offerings, and CIs so that you can see business impact and route incidents to the correct groups.

When you implement the CSDM framework, consider how business applications and application services relate to Incident Management, including when to use an application service on the Incident form.

Incident Management manages and uses CSDM tables. Several ServiceNow products benefit from and add value to Incident Management.

Users and agents log incidents from sources such as email, the service desk, the service catalog, or external applications. Business rules and SOAP messaging can also generate incidents automatically.

When an incident is proposed as a major incident candidate or promoted to a major incident, it's automatically assigned to the major incident management group that a system property defines. The assigned group works on the major incident and resolves it.

A major incident is a highest-impact, highest-urgency incident that affects many users, depriving the business of one or more crucial services. The urgency of the situation requires a well-coordinated response process to accelerate the resolution and minimize the business impact.

A major incident (MI) significantly disrupts the business and requires a response beyond the routine incident management process. Major incidents follow a separate procedure with shorter timescales and higher priority to speed up resolution for incidents with high business impact.

The Major Incident Overview module provides two versions of the Performance Analytics (PA) dashboard for reviewing major incident information at a glance.

Create trigger rules to define the conditions under which a trigger action is executed. You can create major incident trigger rules to define the conditions under which an incident is automatically considered as a major incident candidate.

The major incident workbench is a single-pane view for major incident managers, communication managers, and resolver groups. It aggregates actionable information to help these users manage major incidents.

The Collaborate tab displays the communication tasks that use conference calls as their communication channel so you can view and manage them.

The Communicate tab helps you understand the progress of a communication plan and its related tasks.

The Post Incident Report tab shows the cause of the major incident and the actions that teams took to resolve it.

The Summary tab displays information about records related to an incident in a card layout, including impacted services, affected configuration items (CIs), active outages, impacted locations, and child incidents.

The major incident workbench displays task summaries, communication plan progress, conferencing information, and cause and resolution reports.

You can activate the Major Incident Management plugins if you have the admin role.

View average age and assignment times and breakdown incidents in different age buckets.

View average age and number of reassignments and breakdown incidents in the New, In Progress, and On Hold states.

View the current information about open incidents as a list, or as a heatmap or pivot table organized by breakdown.

This dashboard lets you see incidents that are overdue according to an SLA, divided by age buckets. You can see the average age of the incidents, the average number of times they have been reassigned, and how long on average since the last update. You can also group them by standard breakdowns like Priority and Assignment Group.

See the currently open incidents that are subject to an SLA. You can view a list of the incidents or see how they break down in a heatmap or a pivot table.

This dashboard lets you see incidents that are overdue according to an SLA, divided by the New, In Progress, and On Hold states.

The state of a child incident follows the state of its parent incident for most incident states, which keeps related incidents aligned without manual updates.

Validate that Incident Management still works after you make any configuration change such as apply an upgrade or develop an application. Copy and customize these quick start tests to pass when using your instance-specific data.

Validate that Major Incident Management still works after you make any configuration change such as apply an upgrade or develop an application. Copy and customize these quick start tests to pass when using your instance-specific data.

Incident categories and subcategories help route incidents to the right team and reduce troubleshooting time. The base system includes predefined categories and subcategories that administrators can extend.

Reference sections provide additional information about components installed with Incident Management.

Refresh the Impacted Services or CIs related list of an incident to update its records and the records in the Service Offerings and Business Applications related lists. The records are refreshed and updated based on the affected CIs. You can then identify the impacted services and CIs and act on them.

Reject one or more major incident candidates at once from the Actions menu when they don't qualify as major incidents, and provide a rejection reason.

Delete a category or subcategory if your organization no longer uses the category or subcategory.

Reopen a resolved incident from the incident's resolution notification email or from the incident form in Incident Management to further investigate an issue that is still impacting you.

Request the ITSM Roles plugin (com.snc.itsm.roles) to activate the ITSM Roles — Incident Management plugin (com.snc.itsm.roles.incident_management) to gain more control over the access that different service desk agents, technicians, and managers have within your Incident Management process.

To activate the integration between Incident Management and Universal Request, request the Universal Request: Integration for Incident management plugin (com.snc.incident.universal_request) through the Now Support Customer Service system. This plugin includes demo data and activates related plugins if they are not already active.

Resolve an incident after the service is restored, and close it when the caller is satisfied with the resolution. Incidents can also close automatically after a set time, based on the incident auto-close properties.

As a requester, resolve, reopen, or close an incident from the Incident Actions widget on a universal request record. The widget is available only when an incident is the primary task of the universal request.

Restrict access to an incident that contains sensitive information so that only authorized agents can access it.

Transfer an incident back to the Universal Request queue or to another department, with or without a resolution. If the issue isn't related to an incident, transfer it without a resolution to the relevant department or service.

Slack notifications are added when you activate the Incident Management - Major Incident Management plugin (com.snc.incident.mim).

Configure incident categories and subcategories to classify incidents and route them to the right team. You can also generate reports based on incident categories and subcategories.

Close multiple incidents that share a resolution code at once from the incident list.

Create an incident template to capture incident information consistently. A template fills in standard field values so that you don't have to enter them for each new incident.

Create record producers to log incidents directly from Service Catalog.

Use a predefined incident template with a record producer to fill in standard information for the incidents that the record producer creates.

Create a UI action to close multiple incidents at once from the Actions list in the list view.

Define assignment rules to automatically assign incidents to the group or user who has the skills to work on them.

View callers with VIP status in the incident list and on the Incident form. Organizations designate VIP status in the user record.

Create a problem, change, or request record from an incident.

Modify the email template for the notification that the caller receives when an incident is resolved.

Use a template to apply values to an incident record. The template values replace existing field values, and fields that aren't in the template remain unchanged.

Create a module to log an incident with pre-filled field values from an existing template.

Use the Dependency Views map to identify the configuration items (CIs) that are affected by the CI that caused an incident.

View incident notifications that are sent during specific events in an incident life cycle. Recipients include employee self-service (ESS) users and users with the itil role.

Capture information about the asset configuration items (CIs) that are affected by an incident to keep a record of the CIs that are updated, repaired, swapped, or retired.

Create an incident or a Visual Task Board (VTB) task, or chat with a virtual agent, directly from Microsoft Outlook by using the ServiceNow add-in.

Incident and problem workflow enables you create a problem from an incident, attach Known Error (KE) articles, and communicate problem workarounds and fixes.

View major incident details on the Major Incident and Post Incident Report tabs, which appear on the Incident form when an incident enters the major incident life cycle.

Working on incidents involves diagnosing and investigating the incident, recording results, and sometimes escalating or promoting the incident.

Major incident management includes creating major incidents in different ways, rejecting major incident candidates, and demoting or closing major incidents.

After an incident is created, you can use the incident record form to track, process, and resolve the incident.