ServiceNow Incident Management

Incident Management is the most widely used process in ServiceNow. It handles the entire lifecycle of an IT issue — from the moment a user reports a problem to the moment the service is restored. ServiceNow's built-in Incident Management module follows ITIL best practices and automates most of the manual work involved in handling IT disruptions.

What Is an Incident?

An incident is any unplanned interruption or degradation of an IT service. Examples include:

• A user cannot log into their computer
• The company email server goes down
• A critical application throws errors during peak hours
• The office internet connection becomes slow or unavailable

The goal of Incident Management is to restore normal service as quickly as possible — regardless of the underlying cause.

The Incident Lifecycle

User reports problem
       │
       ▼
New (INC created, number assigned)
       │
       ▼
In Progress (agent assigned, investigation begins)
       │
       ├── Cannot solve immediately? → On Hold (waiting for vendor / user)
       │
       ▼
Resolved (fix applied, user notified)
       │
       ▼
Closed (user confirms fix OR auto-closed after 3 days)

Incident Priority

ServiceNow calculates incident priority based on two factors: Impact (how many users are affected) and Urgency (how critical the affected service is). The system uses a priority matrix to determine the final priority level automatically.

Priority Matrix:
               Urgency 1   Urgency 2   Urgency 3
               (High)      (Medium)    (Low)
Impact 1 (High)  P1-Crit     P2-High     P3-Mod
Impact 2 (Med)   P2-High     P3-Mod      P4-Low
Impact 3 (Low)   P3-Mod      P4-Low      P4-Low

Priority Levels and Response Times

• P1 - Critical: Respond within 15 minutes, resolve within 4 hours. Major service down, hundreds of users impacted.
• P2 - High: Respond within 1 hour, resolve within 8 hours. Key service degraded, several users impacted.
• P3 - Moderate: Respond within 4 hours, resolve within 24 hours. Minor issue, limited impact.
• P4 - Low: Respond within 8 hours, resolve within 72 hours. Single user, non-critical issue.

Creating an Incident

Users create incidents in four ways:

• Self-service: The user submits a form through the Service Portal.
• Phone: A help desk agent creates the incident on behalf of the caller.
• Email: ServiceNow's inbound email action automatically creates an incident from an email sent to the support address.
• Monitoring alert: An automated monitoring tool detects an issue and creates an incident through the API.

Key Fields on an Incident

• Caller: The user who reported the issue (reference to sys_user table).
• Short Description: A brief summary of the problem (mandatory).
• Category / Sub-Category: What type of issue it is (hardware, software, network).
• Priority: Calculated from impact and urgency.
• State: The current stage in the incident lifecycle.
• Assignment Group: The team responsible for resolving the incident.
• Assigned To: The specific agent working on it.
• Resolution Notes: What the agent did to fix the issue — required before resolving.
• Close Code: Categorizes how the incident was resolved (e.g., "Solved by user," "Known error").

SLA Tracking on Incidents

ServiceNow automatically attaches SLA timers to incidents when they are created. The timer starts immediately. If an agent changes the state to On Hold, the SLA timer pauses. When the state returns to In Progress, the timer resumes. A warning notification fires when 75% of the SLA time has elapsed. A breach notification fires if the timer reaches 100%.

SLA Timeline for P2 Incident (8-hour resolution target):
────────────────────────────────────────────────────────
09:00  Incident created        → SLA timer starts
09:30  Agent picks up          → Now In Progress
11:00  Waiting for vendor part → State: On Hold, timer PAUSES
01:00  Part arrives            → In Progress, timer RESUMES
       Time used so far: 2.5 hours (1.5h active + paused)
05:00  Issue resolved          → SLA met (4.5 hours active time)
────────────────────────────────────────────────────────

Major Incident Management

When a P1 incident affects the entire organization, it becomes a Major Incident. ServiceNow provides a dedicated major incident workspace that shows all related incidents, affected services, and live updates. A Major Incident Manager takes ownership and coordinates the response across multiple teams simultaneously.

Linking Incidents to Problems and Changes

After resolving an incident, agents identify whether a root cause exists and link the incident to a Problem record. If a change to the environment caused the incident, the agent links it to the Change that triggered the issue. These relationships build a connected history that helps prevent the same incident from recurring.