Product documentation Docs
    • English
    • Deutsch
    • 日本語
    • 한국어
    • Français
  • More Sites
    • Now Community
    • Developer Site
    • Knowledge Base
    • Product Information
    • ServiceNow.com
    • Training
    • Customer Success Center
    • ServiceNow Support Videos
  • Log in

Product documentation

  • Home
How search works:
  • Punctuation and capital letters are ignored
  • Special characters like underscores (_) are removed
  • Known synonyms are applied
  • The most relevant topics (based on weighting and matching to search terms) are listed first in search results
Topics are ranked in search results by how closely they match your search terms
  • A match on the entire phrase you typed
  • A match on part of the phrase you typed
  • A match on ALL of the terms in the phrase you typed
  • A match on ANY of the terms in the phrase you typed

Note: Matches in titles are always highly ranked.

  • Release version
    Table of Contents
    • IT Service Management
Table of Contents
Choose your release version
    Home New York IT Service Management IT Service Management Incident Management Managing Incidents Create incident

    Create incident

    • Save as PDF Selected topic Topic & subtopics All topics in contents
    • Unsubscribe Log in to subscribe to topics and get notified when content changes.
    • Share this page

    Create incident

    Create an incident record to document a deviation from an expected standard of operation.

    Before you begin

    Role required: itil, sn_incident_write, or admin

    About this task

    Incidents are also logged when a user fills out a record producer in the service catalog, or sends an email to the instance. This procedure describes how an ITIL agent completes the Incident form.

    Procedure

    1. Navigate to Incident > Create New.
      You can also click New from the Incident list view.
    2. (Optional) Use a template, if one exists for the type of incident you are logging.
      If the organization uses form templates, you can apply a template to prepopulate some of the fields for specific types of incidents.
    3. Complete the form.
      Your organization has configured the Incident form to adhere to its incident management process. Enter information in the form field based on the process. The following table describes typical Incident form fields.
      Field Description
      Number Unique system-generated incident number.
      Caller The user who contacted you with an issue. Begin typing the first name of the caller to select from a list of matching names, or click the lookup icon and select the user.
      Category and Subcategory The type of issue. After selecting the category, select the subcategory, if applicable.
      Business service The affected business service, if applicable.

      If you select a business service as the configuration item and that business service is also listed as the configuration item in any other active task, the active tasks icon ( other active tasks ) appears. Click the icon to view the list of all the other active tasks that are affecting the business service.

      You can view the BSM map (dependency view) of the selected business service by clicking the dependency icon open dependency view.

      Configuration item The affected CI, if applicable.

      After a CI is selected, you can click the open dependency views icon beside the field to see how the CI maps into the infrastructure. The dependency view shows you what is impacted and whether other CIs or services are experiencing issues.

      State The state moves and tracks incidents through several stages of resolution.
      Tip: Use the State field, rather than the Incident State or Problem State fields, as your primary means of tracking the state of an incident as it progresses through the entire processing cycle. To learn more, see Life cycle of an Incident.
      Impact Impact is a measure of the effect of an incident, problem, or change on business processes.
      Urgency Urgency is a measure of how long the resolution can be delayed until an incident, problem, or change has a significant business impact.
      Priority Priority is based on impact and urgency, and it identifies how quickly the service desk should address the task.
      Assignment group and Assigned to The group and user to work on this incident. If left blank, the incident is automatically assigned. If the Assignment group changes, the Assigned to field is cleared.
      Note: The sys_user_group read ACL calls the SNCRoleUtil function. The function checks to see whether the group being reviewed contains either the admin role or security_admin role. The function allows the user to view the group only if the user has the same role. As a result, an itil user cannot assign an incident to a group that has the admin role or security_admin role. Nor to one whose parent has the role.
      Short description A brief description of the incident.
      Description Detailed explanation on the incident.
      Notes
      Watch list Users who receive notifications about this incident when comments are added. Click the add me icon to add yourself to the watch list.
      Work notes list Users who receive notifications about this incident when work notes are added. Click the add me icon to add yourself to the work notes list.
      Note: The administrator must create an email notification for the work notes list.
      Additional comments More information about the issue as needed. All users who can view incidents see additional comments.
      Work notes Information about how to resolve the incident, or steps taken to resolve it, if applicable.
      Actions taken A journal field where you can enter details of the actions taken for a major incident. This field is for only internal users.
      Note: This field is only visible when you activate Major Incident Management (com.snc.incident.mim) plugin.
      Related Records
      Problem Information on any related problem record that is related to the incident.
      Change Request Information on any related change request.
      Caused by Change Information on the change request that resulted in the creation of the incident.
      Resolution Information

      This section is only filled when an incident is resolved.

      Knowledge If the check box is selected, a knowledge article is created from this incident when it is closed.
      Resolution code Document how an incident is resolved.
      Resolution notes Information about how or why the incident was closed.
      Resolved by The user who resolved the issue and the date and time the incident was closed.
      Resolved The date and time when the incident was resolved.
      Major Incident

      This section is available only when the incident enters the major incident flow.

      Major incident state A major incident state can be one of the following:
      • Proposed: the initial state when a major incident candidate is created or proposed.
      • Accepted: the state when a major incident is directly created by a major incident manager or when a candidate is promoted to a major incident by a major incident manager.
      • Rejected: the major incident candidate is rejected by a major incident manager.
      • Canceled: the major incident is demote by a major incident manager.
      Proposed by The user who proposed the incident as a major incident candidate.
      Proposed Date and time when the incident was proposed as a major incident candidate.
      Promoted by The user who promoted the incident to a major incident.
      Promoted Date and time when the incident was promoted to a major incident.
      Business impact The business impact of the issue identified in the major case.
      Probable cause The probable cause of the issue identified in the major case.
      Post Incident Report

      This section is available only when an incident is resolved.

      Overview Summary of the incident.
      Findings Information on what caused the major incident and any lessons learnt in the process.
      Timeline Information of all the activity feeds not only of the incident but also of the incident communication plan and incident communication tasks related to the incident.
    4. Click Submit.
      Note: To mail the incident record, click more options in the title bar and select Email. The user who requested the incident and the user who is assigned to the incident are automatically populated in the list of recipients.
    Related tasks
    • Create task record from incident
    Related concepts
    • Major incident management

    Tags:

    Feedback
    On this page

    Previous topic

    Next topic

    • Contact Us
    • Careers
    • Terms of Use
    • Privacy Statement
    • Sitemap
    • © ServiceNow. All rights reserved.

    Release version
    Choose your release version

      Create incident

      • Save as PDF Selected topic Topic & subtopics All topics in contents
      • Unsubscribe Log in to subscribe to topics and get notified when content changes.
      • Share this page

      Create incident

      Create an incident record to document a deviation from an expected standard of operation.

      Before you begin

      Role required: itil, sn_incident_write, or admin

      About this task

      Incidents are also logged when a user fills out a record producer in the service catalog, or sends an email to the instance. This procedure describes how an ITIL agent completes the Incident form.

      Procedure

      1. Navigate to Incident > Create New.
        You can also click New from the Incident list view.
      2. (Optional) Use a template, if one exists for the type of incident you are logging.
        If the organization uses form templates, you can apply a template to prepopulate some of the fields for specific types of incidents.
      3. Complete the form.
        Your organization has configured the Incident form to adhere to its incident management process. Enter information in the form field based on the process. The following table describes typical Incident form fields.
        Field Description
        Number Unique system-generated incident number.
        Caller The user who contacted you with an issue. Begin typing the first name of the caller to select from a list of matching names, or click the lookup icon and select the user.
        Category and Subcategory The type of issue. After selecting the category, select the subcategory, if applicable.
        Business service The affected business service, if applicable.

        If you select a business service as the configuration item and that business service is also listed as the configuration item in any other active task, the active tasks icon ( other active tasks ) appears. Click the icon to view the list of all the other active tasks that are affecting the business service.

        You can view the BSM map (dependency view) of the selected business service by clicking the dependency icon open dependency view.

        Configuration item The affected CI, if applicable.

        After a CI is selected, you can click the open dependency views icon beside the field to see how the CI maps into the infrastructure. The dependency view shows you what is impacted and whether other CIs or services are experiencing issues.

        State The state moves and tracks incidents through several stages of resolution.
        Tip: Use the State field, rather than the Incident State or Problem State fields, as your primary means of tracking the state of an incident as it progresses through the entire processing cycle. To learn more, see Life cycle of an Incident.
        Impact Impact is a measure of the effect of an incident, problem, or change on business processes.
        Urgency Urgency is a measure of how long the resolution can be delayed until an incident, problem, or change has a significant business impact.
        Priority Priority is based on impact and urgency, and it identifies how quickly the service desk should address the task.
        Assignment group and Assigned to The group and user to work on this incident. If left blank, the incident is automatically assigned. If the Assignment group changes, the Assigned to field is cleared.
        Note: The sys_user_group read ACL calls the SNCRoleUtil function. The function checks to see whether the group being reviewed contains either the admin role or security_admin role. The function allows the user to view the group only if the user has the same role. As a result, an itil user cannot assign an incident to a group that has the admin role or security_admin role. Nor to one whose parent has the role.
        Short description A brief description of the incident.
        Description Detailed explanation on the incident.
        Notes
        Watch list Users who receive notifications about this incident when comments are added. Click the add me icon to add yourself to the watch list.
        Work notes list Users who receive notifications about this incident when work notes are added. Click the add me icon to add yourself to the work notes list.
        Note: The administrator must create an email notification for the work notes list.
        Additional comments More information about the issue as needed. All users who can view incidents see additional comments.
        Work notes Information about how to resolve the incident, or steps taken to resolve it, if applicable.
        Actions taken A journal field where you can enter details of the actions taken for a major incident. This field is for only internal users.
        Note: This field is only visible when you activate Major Incident Management (com.snc.incident.mim) plugin.
        Related Records
        Problem Information on any related problem record that is related to the incident.
        Change Request Information on any related change request.
        Caused by Change Information on the change request that resulted in the creation of the incident.
        Resolution Information

        This section is only filled when an incident is resolved.

        Knowledge If the check box is selected, a knowledge article is created from this incident when it is closed.
        Resolution code Document how an incident is resolved.
        Resolution notes Information about how or why the incident was closed.
        Resolved by The user who resolved the issue and the date and time the incident was closed.
        Resolved The date and time when the incident was resolved.
        Major Incident

        This section is available only when the incident enters the major incident flow.

        Major incident state A major incident state can be one of the following:
        • Proposed: the initial state when a major incident candidate is created or proposed.
        • Accepted: the state when a major incident is directly created by a major incident manager or when a candidate is promoted to a major incident by a major incident manager.
        • Rejected: the major incident candidate is rejected by a major incident manager.
        • Canceled: the major incident is demote by a major incident manager.
        Proposed by The user who proposed the incident as a major incident candidate.
        Proposed Date and time when the incident was proposed as a major incident candidate.
        Promoted by The user who promoted the incident to a major incident.
        Promoted Date and time when the incident was promoted to a major incident.
        Business impact The business impact of the issue identified in the major case.
        Probable cause The probable cause of the issue identified in the major case.
        Post Incident Report

        This section is available only when an incident is resolved.

        Overview Summary of the incident.
        Findings Information on what caused the major incident and any lessons learnt in the process.
        Timeline Information of all the activity feeds not only of the incident but also of the incident communication plan and incident communication tasks related to the incident.
      4. Click Submit.
        Note: To mail the incident record, click more options in the title bar and select Email. The user who requested the incident and the user who is assigned to the incident are automatically populated in the list of recipients.
      Related tasks
      • Create task record from incident
      Related concepts
      • Major incident management

      Tags:

      Feedback

          Share this page

          Got it! Feel free to add a comment
          To share your product suggestions, visit the Idea Portal.
          Please let us know how to improve this content

          Check any that apply

          To share your product suggestions, visit the Idea Portal.
          Confirm

          We were unable to find "Coaching" in Jakarta. Would you like to search instead?

          No Yes
          • Contact Us
          • Careers
          • Terms of Use
          • Privacy Statement
          • Sitemap
          • © ServiceNow. All rights reserved.

          Subscribe Subscribed Unsubscribe Last updated: Tags: January February March April May June July August September October November December No Results Found Versions Search preferences successfully updated My release version successfully updated My release version successfully deleted An error has occurred. Please try again later. You have been unsubscribed from all topics. You are now subscribed to and will receive notifications if any changes are made to this page. You have been unsubscribed from this content Thank you for your feedback. Form temporarily unavailable. Please try again or contact  docfeedback@servicenow.com  to submit your comments. The topic you requested does not exist in the release. You were redirected to a related topic instead. The available release versions for this topic are listed There is no specific version for this documentation. Explore products Click to go to the page. Release notes and upgrades Click to open the dropdown menu. Delete Remove No selected version Reset This field is required You are already subscribed to this topic Attach screenshot The file you uploaded exceeds the allowed file size of 20MB. Please try again with a smaller file. Please complete the reCAPTCHA step to attach a screenshot
          Log in to personalize your search results and subscribe to topics
          No, thanks Login