{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":32844,"path":"it-service-management/incident-management/create-an-incident.md","title":"Create an incident","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create an incident\n\nCreate an incident record to document a deviation from an expected standard of operation.\n\n## Before you begin\n\nRole required: itil, sn\\_incident\\_write, or admin\n\n## About this task\n\nThis procedure describes how an ITIL agent completes the Incident form. Incidents are also logged when a user fills out a record producer in the service catalog, or sends an email to the instance.\n\n## Procedure\n\n1. Navigate to **All** > **Incident** > **Create New**.\n\n You can also select **New** from the Incident list view.\n\n **Note:** If the **Incident** module is not visible in the **All** menu, contact your system administrator to verify that the **itil** or **sn\\_incident\\_write** role is assigned to you.\n\n2. [Use a template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-service-management/incident-management/t_UseATemplateFromAForm.md), if one exists for the type of incident that you are logging.\n\n If the organization uses form templates, then you can apply a template to pre-populate some of the fields for specific types of incidents.\n\n3. On the form, fill in the fields.\n\n Your organization has configured the Incident form to adhere to its incident management process. Enter information in the form field is based on the process. The following table describes typical Incident form fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nNumber\n\n\n\nUnique system-generated incident number.\n\n
\n\nCaller\n\n\n\nUser who contacted you with an issue.\n\n
\n\nCategory and Subcategory\n\n\n\nType of issue. After selecting the category, select the subcategory, if applicable.\n\n
\n\nService\n\n\n\nAffected business service, if applicable. **Note:**\n\nIf you select a business service as the configuration item and if that business service is also listed as the configuration item in any other active task, then the active tasks icon \\(\\[Omitted image \"other-active-task.png\"\\] Alt text: Other active tasks\\) appears. Click the icon to view the list of all the other active tasks that are affecting the business service.\n\nYou can view the BSM map \\(dependency view\\) of the selected business service by clicking the dependency icon \\(\\[Omitted image \"dependency-icon-r.png\"\\] Alt text: Open dependency view\\).\n\n
\n\nService Offering\n\n\n\nService offering consists of one or more service commitments that uniquely define the level of service in terms of availability, scope, pricing, and packaging options. This field enables you to receive different features and their levels of performance for a given service.\n\n
\n\nConfiguration item\n\n\n\nAffected CI, if applicable.After a CI is selected, you can click the open **Dependency views** icon \\(\\[Omitted image \"dependency-icon-r.png\"\\] Alt text: Open dependency view\\) next to the field to see how the CI maps into the infrastructure. The dependency view shows you what is impacted and whether other CIs or services are experiencing issues. To capture information on the affected CIs, refer to [Capture information on affected configuration items in an incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-service-management/incident-management/track-ci.md).\n\nWhen adding configuration items to the **Configuration item** field of an incident form, the search result containing a list of configuration items \\(CI\\) is displayed and sorted based on the CI names in alphabetical order.\n\n
\n\nChannel\n\n\n\nCommunication method that is used by the user to create the incident. Following are the available options:- Chat\n- Email\n- Phone\n- Monitoring\n- Self-service\n- Virtual agent\n- Walk-in\n\n\n
\n\nOrigin\n\n\n\nSource of the incident. For example, if an incident is created from alert, this field contains the value Alert. This is a auto-populated field and you cannot fill the value manually.\n\n
\n\nState\n\n\n\nState of the incident. The state moves and tracks incidents through several stages of resolution.**Tip:** Use the **State** field, rather than the **Incident State** or **Problem State** fields, as your primary means of tracking the state of an incident because this state progresses through the entire processing cycle. To learn more, see [Life cycle of an Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-service-management/incident-management/c_IncidentManagementStateModel.md).\n\n
\n\nImpact\n\n\n\nImpact is a measure of the effect of an incident, problem, or change on business processes.\n\n
\n\nUrgency\n\n\n\nUrgency is a measure of how long the resolution can be delayed until an incident, problem, or change has a significant business impact.\n\n
\n\nPriority\n\n\n\nPriority is based on impact and urgency, and it identifies how quickly the service desk should address the task.\n\n
\n\nAssignment group\n\n\n\nGroup who will work on the incident. The business rule **Populate Assignment Group based on CI/SO** populates the **Assignment group** field based on the support group available for the configuration item \\(CI\\) or the Service offering consecutively.\n\n**Note:** The business rule is triggered when an incident is created or updated, and when the **Assignment group** and the **Assigned to** fields are empty.\n\n If you want to override the default value, then you need to create new properties and provide the field in the property value that must be used to populate the **Assignment group** field. Create the properties in the following order of preference:\n\n- **com.snc.incident.ci\\_assignment\\_group.field\\_name**: Identifies which CI field populates the **Assignment group** field.\n- **com.snc.incident.service\\_offering\\_assignment\\_group.field\\_name**: Identifies which service offering field populates the **Assignment group** field.\n **Note:**\n\n- The sys\\_user\\_group **read** ACL calls the SNCRoleUtil function. The function verifies whether the group that is reviewed contains either the admin role or security\\_admin role. The function enables the user to view the group only if the user has the same role. As a result, a user with the itil role cannot assign an incident to a group that has the admin role or security\\_admin role, nor to any group whose parent has those roles.\n- Other than using the read ACLs, you can also restrict incidents with specific assignment group\\(s\\) for visibility only to the group members using before-query business rule. For details, see [How to restrict a specific group incidents to only its group members \\[KB0790987\\]](https://support.servicenow.com/nav_to.do?uri=%2Fkb%3Fid%3Dkb_article_view%26sysparm_article%3DKB0790987) article in the Now Support Knowledge Base. You must log in to view the article.\n\n\n
\n\nAssigned to\n\n\n\nUser who works on this incident. If the **Assignment group** changes, the **Assigned to** field is cleared.\n\n
\n\nShort description\n\n\n\nBrief description of the incident.\n\n
\n\nDescription\n\n\n\nDetailed explanation on the incident.\n\n
\n\nAttachments\n\n\n\nAttachments related to the incident that helps in incident resolution such as screenshots or pdfs. Select the Attachment \\(\\[Omitted image \"attachments-icon.png\"\\] Alt text: Attachment icon\\) to add and manage the attachments.\n\n
\n\nNotes\n\n
\n\nWatch list\n\n\n\nUsers who receive notifications about this incident when comments are added. Click the add me icon \\(\\[Omitted image \"add-me.png\"\\] Alt text: Add me icon\\) to add yourself to the watch list.\n\n
\n\nWork notes list\n\n\n\nUsers who receive notifications about this incident when work notes are added. Click the add me icon \\(\\[Omitted image \"add-me.png\"\\] Alt text: Add me icon\\) to add yourself to the work notes list.**Note:** The administrator must create an email notification for the work notes list.\n\n
\n\nAdditional comments\n\n\n\nMore information about the issue as needed. All users who can view incidents see additional comments.\n\n
\n\nWork notes\n\n\n\nInformation about how to resolve the incident, or steps taken to resolve it, if applicable.\n\n
\n\nActions taken\n\n\n\nA journal field where you can enter details of the actions taken for a major incident. This field is for only internal users. **Note:** This field is only visible when you activate the Major Incident Management plugin \\(com.snc.incident.mim\\).\n\n
\n\nRelated Records\n\n
\n\nParent Incident\n\n\n\nUnique number of the parent incident for this incident record.\n\n
\n\nProblem\n\n\n\nUnique number of any related problem record that is related to the incident.\n\n
\n\nChange Request\n\n\n\nUnique number of any related change request that is related to the incident.\n\n
\n\nCaused by Change\n\n\n\nUnique number of the change request that resulted in the creation of the incident.\n\n
**Note:** The **Caller** and **Company** fields are optional for the following situations:\n\n - An incident is created from an alert.\n - An incident is created from a change request. In such case, the change request number is populated in the **Caused by Change** field.\n4. Click **Submit**.\n\n\n## Result\n\nThe incident is created.\n\n## What to do next\n\n- If you want to mail the incident record, click the more options icon \\(\\[Omitted image \"more-options.png\"\\] Alt text: More options icon\\) in the title bar and select **Email**.\n\n The user who requested the incident and the user who is assigned to the incident are automatically populated in the list of recipients.\n\n- When an incident is created from a case, the Customer Service with Service Management plugin \\(com.sn\\_cs\\_sm\\) is installed and you have a customer service agent \\(sn\\_customerservice\\_agent\\) role, you can view the **Customer Cases** tab in the Related Links section of the Incident form. This tab contains the list of the customer cases associated with the incident record.\n- When there are one or more interaction records associated with the incident record, you can view the **Interaction** tab in the Related Links section of the Incident form that contains the list of the interaction records.\n- A **Primary device health** link appears on the Related Links section of the Incident form. Select to launch the Digital End-User Experience application and device health page for the selected CI in Service Operations Workspace on a separate browser tab. This tab enables agents to view all the available metrics and the device health for the selected CI, which were collected by DEX. You can also access this feature using the **View device health** option on the classic U16 CI record.\n\n **Note:**\n\n - DEX requires a separate entitlement.\n - This link is available to the agent only if the following conditions are met:\n - The selected CI is of type Device, which is also known as Endpoint.\n - The DEX plugin is installed on the instance. For more information on DEX, see [Digital End-User Experience](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-service-management/digital-end-user-experience-dex/dex-landing.md).\n - The DEX agent is installed on the selected CI.\n\n**Parent Topic:**[Managing incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-service-management/incident-management/work-on-incidents.md)\n\n**Related topics** \n\n\n[Create a record from incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-service-management/incident-management/t_PromoteAnIncident.md)\n\n[Managing major incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-service-management/incident-management/major-incident-management.md)\n\n"}}