Incident Management state model

Incident Management offers a flexible state model to move and track incidents through several states.

Note: While this new state model is available by default for new instances, it is not available on upgrade. Refer to KB0564465 for further details.

The following table provides a list of all the states that an incident can progress through.

Table 1. Incident states
State Description
New Incident is logged but not yet triaged.
In progress Incident is assigned and is being investigated in detail.
On Hold The responsibility for the incident shifts temporarily to another entity that is tasked with providing further relevant information, evidence, or in some cases, a resolution. When you select the On Hold option, the On hold reason choice list appears. You must select one of the following options:
  • Awaiting Caller
  • Awaiting Evidence
  • Awaiting Problem Resolution
  • Awaiting Vendor
Note: An incident can be placed in the On Hold state one or more times prior to being closed.
Resolved A satisfactory fix is provided for the incident to ensure it does not occur again.
Closed Incident is marked closed after it has been in the Resolved state for a specific duration and it is confirmed that the incident is satisfactorily resolved.
Canceled Incident was triaged but found to be a duplicate incident, an unnecessary incident, or not an incident at all.
Figure 1. Incident management state model flow
Note: Closed incidents are read-only. Only administrators can change the state value on the incident record directly via the form.

When an incident is Closed, you receive a notification stating the change. If you reply to the email with a subject containing Please reopen a new incident, an incident is created from the information of the original incident.

When an incident is Resolved, you receive a notification stating the change. If you reply to the email with a subject containing Please reopen a current incident, the incident is updated and moved back to a state of In Progress.

If you do not have any roles in the system (ESS) and you change the incident state to Resolved, you receive a notification with a Reopen incident link.