Thank you for your feedback.
Form temporarily unavailable. Please try again or contact docfeedback@servicenow.com to submit your comments.

Create an incident

Log in to subscribe to topics and get notified when content changes.

Create an incident

When a user calls or walks in to the service desk, the ITIL agent can log an incident from the Incident list.

Before you begin

Role required: itil

About this task

Incidents are also logged when a user fills out a record producer in the service catalog, or sends an email to the instance. This procedure describes how an ITIL agent completes the Incident form.

Procedure

  1. Navigate to Incident > Create New.
    You can also click New from the Incident list view.
  2. (Optional) Use a template, if one exists for the type of incident you are logging.
    If the organization uses form templates, you can apply a template to prepopulate some of the fields for specific types of incidents.
  3. Complete the form.
    Your organization has configured the Incident form to adhere to its incident management process. Enter information in the form field based on the process. The following table describes typical Incident form fields.
    Field Description
    Number Unique system-generated incident number.
    Caller The user who contacted you with an issue. Begin typing the first name of the caller to select from a list of matching names, or click the lookup icon and select the user.
    Category and Subcategory The type of issue. After selecting the category, select the subcategory, if applicable.
    Business service The affected business service, if applicable.

    If you select a business service as the configuration item and that business service is also listed as the configuration item in any other active task, the active tasks icon ( other active tasks ) appears. Click the icon to view the list of all the other active tasks that are affecting the business service.

    You can view the BSM map (dependency view) of the selected business service by clicking the dependency icon dependency icon.

    Configuration item The affected CI, if applicable.

    After a CI is selected, you can click the open dependency views icon beside the field to see how the CI maps into the infrastructure. The dependency view shows you what is impacted and whether other CIs or services are experiencing issues.

    State The state moves and tracks incidents through several stages of resolution.
    Tip: Use the State field, rather than the Incident State or Problem State fields, as your primary means of tracking the state of an incident as it progresses through the entire processing cycle. To learn more, see Incident Management state model.
    Impact The effect that the task has on business.
    Urgency The extent to which the task resolution can be delayed.
    Priority How quickly the service desk should address the task.
    Assignment group and Assigned to The group and user to work on this incident. If left blank, the incident is automatically assigned.
    Short description A brief description of the incident.
    Description Detailed explanation on the incident.
    Notes
    Watch list Users who receive notifications about this incident when comments are added. Click the add me icon to add yourself to the watch list.
    Work notes list Users who receive notifications about this incident when work notes are added. Click the add me icon to add yourself to the work notes list.
    Note: The administrator must create an email notification for the work notes list.
    Additional comments More information about the issue as needed. All users who can view incidents see additional comments.
    Work notes Information about how to resolve the incident, or steps taken to resolve it, if applicable.
    Actions taken A journal field where you can enter details of the actions taken for a major incident. This field is for only internal users.
    Note: This field is only visible when you activate Major Incident Management (com.snc.incident.mim) plugin.
    Related Records
    Problem Information on any related problem record that is related to the incident.
    Change Request Information on any related change request.
    Caused by Change Information on the change request that resulted in the creation of the incident.
    Resolution Information

    This section is only filled when an incident is resolved.

    Knowledge If the check box is selected, a knowledge article is created from this incident when it is closed.
    Resolution code Document how an incident is resolved.
    Resolution notes Information about how or why the incident was closed.
    Resolved by The user who resolved the issue and the date and time the incident was closed.
    Resolved The date and time when the incident was resolved.
    Major Incident

    This section is available only when the incident enters the major incident flow.

    Major incident state A major incident state can be one of the following:
    • Proposed: the initial state when a major incident candidate is created or proposed.
    • Accepted: the state when a major incident is directly created by a major incident manager or when a candidate is promoted to a major incident by a major incident manager.
    • Rejected: the major incident candidate is rejected by a major incident manager.
    • Canceled: the major incident is demote by a major incident manager.
    Proposed by The user who proposed the incident as a major incident candidate.
    Proposed Date and time when the incident was proposed as a major incident candidate.
    Promoted by The user who promoted the incident to a major incident.
    Promoted Date and time when the incident was promoted to a major incident.
    Business impact The business impact of the issue identified in the major case.
    Probable cause The probable cause of the issue identified in the major case.
    Post Incident Report

    This section is available only when an incident is resolved.

    Overview Summary of the incident.
    Findings Information on what caused the major incident and any lessons learnt in the process.
    Timeline Information of all the activity feeds not only of the incident but also of the incident communication plan and incident communication tasks related to the incident.
  4. Click Submit.
    Note: To mail the incident record, click the more options icon more options icon in the title bar and select Email. The user who requested the incident and the user who is assigned to the incident are automatically populated in the list of recipients.
Feedback